Overview

overview

10

Static

static

1

Confirmaç...nto.js

windows10-2004-x64

10

Confirmaç...nto.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 15:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Confirmação_de_Pagamento.js
  • Size 763KB
  • Sample260930-s1gfdsbf79
  • SHA256 9f0df64cc8a15b2c96e639a975acb9f54ff26721dc60a8035d4bbc65476485e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remotehostdiscoveryexecutionremcosrat

Malware Config

Extracted

Family

  • remcos

Version

  • 3.8.0 Pro

Botnet

  • RemoteHost

C2

  • 155.103.69.174:4981

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-XMIE8L

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Confirmação_de_Pagamento.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\34f984fea6_d.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3392
    • C:\Users\Admin\AppData\Local\Temp\remx.exe
      "C:\Users\Admin\AppData\Local\Temp\remx.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5312

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        34f984fea6_c.b64
        • Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_c.b64
        • Size 626KB
        • SHA256 6fb8556cc7cfc10a91a97e9b3bea3a9f6ba5b7a510be320a69bc19c0466b5913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        34f984fea6_d.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_d.ps1
        • Size 728B
        • SHA256 c44e1e78b6102cbc7307ea38b5b548d0c838485ae40005ae1b84155939c138e1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        34f984fea6_i.b64
        • Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_i.b64
        • Size 24B
        • SHA256 1864b5780779f0bb6cd04241cec2f29fc153f961d9a0bd3f131a4e6d00a35892
        • MD5 SHA1 SHA512
        Submit Download

        34f984fea6_k.b64
        • Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_k.b64
        • Size 44B
        • SHA256 576ef8f43834f224a7c3a28505f2f19e838f4ca8b3b0261cdd7e8d3befa4ca9d
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_2hffh2jv.qzs.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2hffh2jv.qzs.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        remx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\remx.exe
        • Size 469KB
        • SHA256 6f3ac78109bb86b7cad6342b2194f93ae3916bb221adba9e344f01493128a642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3392-4-0x000001B8A1F60000-0x000001B8A1F70000-memory.dmp
        Download

        memory/3392-5-0x000001B8A1F70000-0x000001B8A1F92000-memory.dmp
        Download