Analysis
- max time kernel
298s - max time network
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 12:33
General
- Target EUROPA ANFRAGE E261138 A001 PRODUKT DIENSTLEISTUNG SPEZIFIKATIONEN.js
- Size 745KB
- Sample260622-prgg9ab13p
- SHA256 8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92
Malware Config
Extracted
-
remcos
-
Animal
-
animal342.duckdns.org:53522
-
animal342bk.duckdns.org:60507
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-D7SC7T
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
remcos
-
7.2.1 Pro
-
Animal
-
animal342.duckdns.org:53522
-
animal342bk.duckdns.org:60507
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-D7SC7T
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\EUROPA ANFRAGE E261138 A001 PRODUKT DIENSTLEISTUNG SPEZIFIKATIONEN.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exePowerShell.exe "$intratracheal=gc ($HOME+'/app'+'data/local/Hereat');$contestableness=$intratracheal[3592]+$intratracheal[3593]+$intratracheal[3594]; . ($contestableness) $intratracheal"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$intratracheal=gc ($HOME+'/app'+'data/local/Hereat');$contestableness=$intratracheal[3592]+$intratracheal[3593]+$intratracheal[3594]; . ($contestableness) $intratracheal"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Startup key" /t REG_EXPAND_SZ /d "%Uva130% -windowstyle 2 $Stendysses=(.'gp' 'HKCU:\Software\Luftvrnsskytsets\').'Afhvlet';%Uva130% ($Stendysses)"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Startup key" /t REG_EXPAND_SZ /d "%Uva130% -windowstyle 2 $Stendysses=(.'gp' 'HKCU:\Software\Luftvrnsskytsets\').'Afhvlet';%Uva130% ($Stendysses)"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\userinit.exe/stext "C:\Users\Admin\AppData\Local\Temp\vnupstrgokkwzjzsmewuwdw"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\userinit.exe/stext "C:\Users\Admin\AppData\Local\Temp\ypihtlczcscbbxvwvpjozqryyn"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
-
-
C:\Windows\SysWOW64\userinit.exe/stext "C:\Users\Admin\AppData\Local\Temp\ijnauvnbqauomdjamawpkvlphtlgx"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
vnupstrgokkwzjzsmewuwdw
Propitiable.Ind
Hereat
memory/1048-33-0x00000000062A0000-0x00000000062BE000-memory.dmp
memory/1048-35-0x0000000007570000-0x0000000007606000-memory.dmp
memory/1048-41-0x0000000008E90000-0x000000000BE0A000-memory.dmp
memory/1048-21-0x0000000074B12000-0x0000000074B13000-memory.dmp
memory/1048-39-0x0000000008810000-0x0000000008E8C000-memory.dmp
memory/1048-38-0x0000000007BD0000-0x000000000818A000-memory.dmp
memory/1048-37-0x0000000006830000-0x0000000006852000-memory.dmp
memory/1048-36-0x00000000067B0000-0x00000000067CA000-memory.dmp
memory/1048-23-0x0000000074B00000-0x00000000752BC000-memory.dmp
memory/1048-44-0x0000000074B00000-0x00000000752BC000-memory.dmp
memory/1048-43-0x0000000074B00000-0x00000000752BC000-memory.dmp
memory/1048-25-0x0000000074B00000-0x00000000752BC000-memory.dmp
memory/1048-26-0x0000000005B50000-0x0000000005B72000-memory.dmp
memory/1048-27-0x0000000005BF0000-0x0000000005C56000-memory.dmp
memory/1048-28-0x0000000005C60000-0x0000000005CC6000-memory.dmp
memory/1048-31-0x0000000005DB0000-0x000000000610B000-memory.dmp
memory/1048-22-0x0000000004E10000-0x0000000004E46000-memory.dmp
memory/1048-42-0x0000000074B12000-0x0000000074B13000-memory.dmp
memory/1048-34-0x0000000006360000-0x00000000063AC000-memory.dmp
memory/1048-24-0x00000000054A0000-0x0000000005AEA000-memory.dmp
memory/1060-68-0x0000000000400000-0x000000000047E000-memory.dmp
memory/1060-77-0x0000000000400000-0x000000000047E000-memory.dmp
memory/2888-72-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2888-73-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4124-69-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4124-74-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4948-15-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-5-0x000002C584110000-0x000002C584132000-memory.dmp
memory/4948-11-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-13-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-10-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-16-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-20-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-12-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-1-0x00007FF9E80EF000-0x00007FF9E80F0000-memory.dmp
memory/4948-2-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-9-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-8-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-7-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/4948-6-0x00007FF9E7F60000-0x00007FF9E8904000-memory.dmp
memory/5008-82-0x000000001EAC0000-0x000000001EAD9000-memory.dmp
memory/5008-89-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-62-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-79-0x000000001EAC0000-0x000000001EAD9000-memory.dmp
memory/5008-83-0x000000001EAC0000-0x000000001EAD9000-memory.dmp
memory/5008-53-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-84-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-85-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-86-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-87-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-88-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-63-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-90-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-91-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-92-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-93-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-94-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-95-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-96-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-97-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-98-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-99-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-100-0x0000000000D50000-0x0000000002036000-memory.dmp
memory/5008-101-0x0000000000D50000-0x0000000002036000-memory.dmp