Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 12:23
General
- Target Narudžba 26-0204-001033190180_PDF.js
- Size 2.2MB
- Sample260420-pkg57sd13y
- SHA256 48974f4176b42b3fa40793832b176f90516c9468d1ef5b67747307b1cd1cca3f
Malware Config
Extracted
-
remcos
-
3.8.0 Pro
-
JIDE001
-
jide001.duckdns.org:31993
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7P3T4S
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Narudžba 26-0204-001033190180_PDF.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\mfhmpdcdzt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\whvwivmxnbaey"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\zbapjofybjsiisisi"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
__PSScriptPolicyTest_b23dxzgg.u1y.ps1
mfhmpdcdzt
memory/1712-35-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1712-40-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1712-37-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1712-33-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2992-1-0x000001B06BD50000-0x000001B06BD5C000-memory.dmp
memory/2992-0-0x000001B06D870000-0x000001B06D98E000-memory.dmp
memory/3916-18-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-48-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-14-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-23-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-20-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-81-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-80-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-24-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-27-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-28-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-29-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-30-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-31-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-32-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-73-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-72-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-64-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-65-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-57-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-56-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-51-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3916-15-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4004-12-0x000001F232A10000-0x000001F232BAC000-memory.dmp
memory/4004-26-0x000001F219F50000-0x000001F219F62000-memory.dmp
memory/4004-2-0x000001F219F70000-0x000001F219F80000-memory.dmp
memory/4004-10-0x000001F2324F0000-0x000001F232512000-memory.dmp
memory/4004-25-0x000001F219C70000-0x000001F219C7C000-memory.dmp
memory/4004-3-0x000001F219F70000-0x000001F219F80000-memory.dmp
memory/4004-13-0x000001F2328C0000-0x000001F2328CA000-memory.dmp
memory/4004-11-0x000001F219F70000-0x000001F219F80000-memory.dmp
memory/4544-42-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4544-43-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4544-41-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4568-39-0x0000000000400000-0x0000000000457000-memory.dmp
memory/4568-38-0x0000000000400000-0x0000000000457000-memory.dmp
memory/4568-34-0x0000000000400000-0x0000000000457000-memory.dmp