Analysis
- max time kernel
299s - max time network
276s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 15:18
General
- Target AB 0172_2508026_docx.bat
- Size 1.0MB
- Sample260825-sppydsbm2t
- SHA256 979eee6c5c21488122461a29a7b4a2430ec921437f4df6194de9fcb00da9c732
Malware Config
Extracted
-
remcos
-
7.3.0 Pro
-
X64 7.30
-
dentalux202.ydns.eu:58268
-
dentalux202bk.ydns.eu:58798
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MIQ0UM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AB 0172_2508026_docx.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:EAALUFV))"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:EAALUFV))"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:EAALUFV))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\opnzszyx\opnzszyx.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6047.tmp" "c:\Users\Admin\AppData\Local\Temp\opnzszyx\CSC6864EEF7F7D14DF3B8B18DCF59E20D4.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\achjkeqg\achjkeqg.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6121.tmp" "c:\Users\Admin\AppData\Local\Temp\achjkeqg\CSCA4795A9CFDD7485FB55D4B3BE4E566DE.TMP"5⤵
-
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\choice.exe"C:\Windows\system32\choice.exe"4⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RES6047.tmp
RES6121.tmp
__PSScriptPolicyTest_4wsfxwnm.03t.ps1
achjkeqg.dll
handoff_dbg_968_e596269.txt
handoff_dbg_968_e596269.txt
handoff_dbg_968_e596269.txt
opnzszyx.dll
CSCA4795A9CFDD7485FB55D4B3BE4E566DE.TMP
achjkeqg.0.cs
achjkeqg.cmdline
CSC6864EEF7F7D14DF3B8B18DCF59E20D4.TMP
opnzszyx.0.cs
opnzszyx.cmdline
memory/968-61-0x000001DB9B4D0000-0x000001DB9B4E8000-memory.dmp
memory/968-34-0x000001DB9B8F0000-0x000001DB9B91A000-memory.dmp
memory/968-48-0x000001DB9B180000-0x000001DB9B188000-memory.dmp
memory/968-35-0x000001DB9B8F0000-0x000001DB9B914000-memory.dmp
memory/968-33-0x000001DB9B5C0000-0x000001DB9B5CA000-memory.dmp
memory/968-31-0x000001DB9B510000-0x000001DB9B52E000-memory.dmp
memory/968-32-0x000001DB9B610000-0x000001DB9B6C2000-memory.dmp
memory/1996-16-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/1996-21-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/1996-20-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/1996-15-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/2092-79-0x00000202E8330000-0x00000202E8370000-memory.dmp
memory/2092-83-0x00000202E8370000-0x00000202E8412000-memory.dmp
memory/2092-82-0x00000202E8370000-0x00000202E8412000-memory.dmp
memory/2092-85-0x00000202E8330000-0x00000202E8370000-memory.dmp
memory/2092-66-0x0000000180000000-0x0000000180040000-memory.dmp
memory/2092-62-0x00000202E8330000-0x00000202E8370000-memory.dmp
memory/3348-7-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-13-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-4-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-0-0x00007FFFF8E1F000-0x00007FFFF8E20000-memory.dmp
memory/3348-5-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-6-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-12-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-8-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-9-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-10-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-11-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-28-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-14-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp
memory/3348-3-0x000001467A4A0000-0x000001467A4C2000-memory.dmp
memory/5404-143-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-151-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-94-0x0000022362FC0000-0x0000022362FC1000-memory.dmp
memory/5404-128-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-135-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-139-0x0000022364C80000-0x0000022364C81000-memory.dmp
memory/5404-142-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-90-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-144-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-145-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-148-0x0000000180000000-0x000000018012C000-memory.dmp
memory/5404-150-0x0000000180000000-0x000000018012C000-memory.dmp
memory/5404-149-0x0000000180000000-0x000000018012C000-memory.dmp
memory/5404-92-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-152-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-153-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-155-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-154-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-156-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-157-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-159-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-158-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-161-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-160-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-163-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-162-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-168-0x0000000140000000-0x00000001400B0000-memory.dmp
memory/5404-169-0x0000000140000000-0x00000001400B0000-memory.dmp