Analysis
- max time kernel
299s - max time network
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 15:28
General
- Target Priority Quotation Request_Ongoing Project Poland Warsaw_ROSINSKI PACKAGING Sp zoo 08_24_2026.js
- Size 1.0MB
- Sample260824-swdtpsea58
- SHA256 ddeaad34e9921052a1619b63f60c2cbdafcd1b3afc3b57e36b2462d0a49f389a
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
Buffalo
-
buffalobr.duckdns.org:51842
-
buffalobrbk.duckdns.org:50810
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R0KK6D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Priority Quotation Request_Ongoing Project Poland Warsaw_ROSINSKI PACKAGING Sp zoo 08_24_2026.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $EGFXXFX=$env:DKYW;$YMHWC=$env:FNWTUDMM;$VEMQKP=$env:DYEVUIUO+$env:HHWM+$env:MTTRSHES+'.'+$env:DSON;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($VEMQKP));$BZOEN=foreach($SHSTJ in [IO.File]::ReadAllLines($YMHWC)){if($SHSTJ.IndexOf($EGFXXFX)-eq 0){$SHSTJ.Substring($EGFXXFX.Length)}};[IO.File]::WriteAllLines($VEMQKP,[string[]]@($BZOEN),[Text.Encoding]::ASCII)2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267241787585295541.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267241787585295541.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WXVJQI))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WXVJQI))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WXVJQI))"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\es5p3jmc\es5p3jmc.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AD3.tmp" "c:\Users\Admin\AppData\Local\Temp\es5p3jmc\CSC687DAB2476E145E2875422920A6A918.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\45jtthn5\45jtthn5.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C5A.tmp" "c:\Users\Admin\AppData\Local\Temp\45jtthn5\CSC9EECB94542C349BA89C9A6BF476E2B29.TMP"6⤵
-
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267241787585295541.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
20267241787585295541.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
45jtthn5.dll
RES7AD3.tmp
RES7C5A.tmp
__PSScriptPolicyTest_tc2kxuqi.q5m.ps1
es5p3jmc.dll
handoff_dbg_3436_e597e10.txt
handoff_dbg_3436_e597e10.txt
45jtthn5.0.cs
45jtthn5.cmdline
CSC9EECB94542C349BA89C9A6BF476E2B29.TMP
CSC687DAB2476E145E2875422920A6A918.TMP
es5p3jmc.0.cs
es5p3jmc.cmdline
memory/1404-149-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-142-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-176-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-174-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-175-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-172-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-173-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-168-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-166-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-167-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-165-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-164-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-163-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-162-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-161-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-160-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-159-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-158-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-156-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-143-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-84-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-86-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-87-0x0000019F23210000-0x0000019F23211000-memory.dmp
memory/1404-144-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-145-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-128-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-132-0x0000019F23720000-0x0000019F23721000-memory.dmp
memory/1404-121-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-148-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-150-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-135-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-136-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-137-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-138-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-139-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-147-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-146-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-155-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-157-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/1404-154-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-153-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-152-0x0000000180000000-0x000000018012D000-memory.dmp
memory/1404-151-0x0000000180000000-0x000000018012D000-memory.dmp
memory/2840-63-0x0000000180000000-0x0000000180040000-memory.dmp
memory/2840-79-0x000002BBC6B00000-0x000002BBC6B40000-memory.dmp
memory/2840-73-0x000002BBC6B00000-0x000002BBC6B40000-memory.dmp
memory/2840-77-0x000002BBC6B40000-0x000002BBC6BDD000-memory.dmp
memory/2840-76-0x000002BBC6B40000-0x000002BBC6BDD000-memory.dmp
memory/2840-59-0x000002BBC6B00000-0x000002BBC6B40000-memory.dmp
memory/3436-45-0x0000027833760000-0x0000027833768000-memory.dmp
memory/3436-58-0x0000027833770000-0x0000027833788000-memory.dmp
memory/3608-5-0x000002868A5F0000-0x000002868A612000-memory.dmp
memory/3608-9-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-19-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-6-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-1-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-7-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-8-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-2-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-10-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-0-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp
memory/3608-11-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-12-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-14-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-13-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-15-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp
memory/3608-17-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp