Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im wscript.exe
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
Modifies file system
Creates the following files
- C:\temp\ps_md1y5hq7nxlb_1781657189498.ps1
- %ALLUSERSPROFILE%\remcos\logs.dat
Deletes following files that it created itself
- C:\temp\ps_md1y5hq7nxlb_1781657189498.ps1
Network activity
UDP
- DNS ASK br######oughgee.ddns.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_mD1Y5hQ7nXlB_1781657189498.ps1"
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe'
- '<SYSTEM32>\taskkill.exe' /f /im wscript.exe' (with hidden window)
