Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/02/2026, 16:20
General
- Target Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe
- Size 1.2MB
- Sample260226-ts9yeaht6f
- SHA256 2944010e5dc27c32e209f1aa2f0e9fb2ba05e90acb0beaccf16622b31389a349
Malware Config
Extracted
-
remcos
-
6.0.0 Pro
-
ugHost
-
smartprince111111:2404
-
91.92.242.99:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-9TWITZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe" /stext "C:\Users\Admin\AppData\Local\Temp\msgylseypjrggqzpxpfqoovrsbsofdto"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wmlq"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe"C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi ve Termin Bilgisi Rica Ederiz. SiparisNHM-0026.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zoqbmva"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
__PSScriptPolicyTest_tp2jcfmi.uox.ps1
msgylseypjrggqzpxpfqoovrsbsofdto
memory/712-81-0x0000000001B40000-0x0000000001B59000-memory.dmp
memory/712-77-0x0000000000400000-0x0000000000424000-memory.dmp
memory/712-80-0x0000000001980000-0x0000000001A3B000-memory.dmp
memory/712-76-0x0000000000400000-0x0000000000424000-memory.dmp
memory/712-74-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1408-48-0x0000027B7B7B0000-0x0000027B7B7F6000-memory.dmp
memory/1408-47-0x0000027B7B6E0000-0x0000027B7B702000-memory.dmp
memory/1408-108-0x0000027B62F50000-0x0000027B62F5C000-memory.dmp
memory/1408-109-0x0000027B63010000-0x0000027B63022000-memory.dmp
memory/2580-70-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2580-73-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2580-75-0x0000000001690000-0x000000000170C000-memory.dmp
memory/2580-71-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3080-94-0x0000000007D70000-0x0000000007D7E000-memory.dmp
memory/3080-95-0x0000000007D80000-0x0000000007D95000-memory.dmp
memory/3080-19-0x0000000005220000-0x0000000005230000-memory.dmp
memory/3080-20-0x0000000005220000-0x0000000005230000-memory.dmp
memory/3080-29-0x0000000005860000-0x0000000005E8A000-memory.dmp
memory/3080-83-0x0000000007D40000-0x0000000007D51000-memory.dmp
memory/3080-30-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/3080-31-0x00000000061A0000-0x0000000006206000-memory.dmp
memory/3080-16-0x0000000005180000-0x00000000051B6000-memory.dmp
memory/3080-37-0x0000000006210000-0x0000000006567000-memory.dmp
memory/3080-39-0x00000000067E0000-0x00000000067FE000-memory.dmp
memory/3080-40-0x0000000006810000-0x000000000685C000-memory.dmp
memory/3080-67-0x0000000007BB0000-0x0000000007BBA000-memory.dmp
memory/3080-82-0x0000000007DC0000-0x0000000007E56000-memory.dmp
memory/3080-96-0x0000000007E80000-0x0000000007E9A000-memory.dmp
memory/3080-97-0x0000000007E70000-0x0000000007E78000-memory.dmp
memory/3080-100-0x0000000002DC0000-0x0000000002DD9000-memory.dmp
memory/3080-101-0x0000000005210000-0x0000000005216000-memory.dmp
memory/3080-102-0x0000000006170000-0x0000000006188000-memory.dmp
memory/3080-56-0x00000000715A0000-0x00000000715EC000-memory.dmp
memory/3080-63-0x0000000006DA0000-0x0000000006DBE000-memory.dmp
memory/3080-55-0x00000000077D0000-0x0000000007804000-memory.dmp
memory/3080-64-0x0000000007810000-0x00000000078B4000-memory.dmp
memory/3080-65-0x0000000008170000-0x00000000087EA000-memory.dmp
memory/3080-66-0x0000000007B30000-0x0000000007B4A000-memory.dmp
memory/3712-92-0x0000000001160000-0x000000000121B000-memory.dmp
memory/3712-69-0x0000000000400000-0x000000000047E000-memory.dmp
memory/3712-68-0x0000000000400000-0x000000000047E000-memory.dmp
memory/3712-93-0x0000000001280000-0x0000000001299000-memory.dmp
memory/3712-72-0x0000000000400000-0x000000000047E000-memory.dmp
memory/3904-15-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-50-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-49-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-23-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-163-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-28-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-26-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-22-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-51-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-17-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-86-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3904-90-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3904-89-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3904-91-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-52-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-162-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-146-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-54-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-111-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-145-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-128-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-112-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-107-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3904-106-0x0000000001210000-0x00000000012CB000-memory.dmp
memory/4136-4-0x0000000005890000-0x000000000589A000-memory.dmp
memory/4136-5-0x0000000007BA0000-0x0000000007BC2000-memory.dmp
memory/4136-3-0x0000000005AC0000-0x0000000005AD0000-memory.dmp
memory/4136-2-0x00000000057F0000-0x0000000005882000-memory.dmp
memory/4136-9-0x0000000007C10000-0x0000000007D2E000-memory.dmp
memory/4136-6-0x0000000007B70000-0x0000000007B8A000-memory.dmp
memory/4136-1-0x0000000005E80000-0x0000000006426000-memory.dmp
memory/4136-7-0x00000000056A0000-0x0000000005704000-memory.dmp
memory/4136-8-0x0000000005AC0000-0x0000000005AD0000-memory.dmp
memory/4136-10-0x0000000007F40000-0x0000000007FDC000-memory.dmp
memory/4136-0-0x0000000000BA0000-0x0000000000CE0000-memory.dmp
memory/4136-27-0x00000000056A0000-0x0000000005704000-memory.dmp