Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
18/10/2026, 12:36
General
- Target wegivenmebestthings.js
- Size 31KB
- Sample261018-ps1braes7x
- SHA256 aab8685f629963b95409754e00795c3d444c44e2fcf2f3fa8f7b0e4bd99a02dd
Malware Config
Extracted
-
remcos
-
6.0.0 Pro
-
Dragxcall00
-
ferdinandcumberbatchx3.duckdns.org:14643
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PRNDWE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\wegivenmebestthings.js1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\V5QE5DTM.ps1"2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\joucqaxojjbtbzhwdrvutkurgvq"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\uqzmrsiifrtyefvauuiwexpaocatxv"4⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_office_path
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ekefkdtjtzllotredecphbjrpiscqgtep"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
V5QE5DTM.ps1
__PSScriptPolicyTest_ywcl4cso.qfx.ps1
joucqaxojjbtbzhwdrvutkurgvq
memory/3744-46-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3744-42-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3744-44-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4460-32-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-24-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-14-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-16-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-17-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-18-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-19-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-20-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-9-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-21-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-13-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-8-0x0000012DCB770000-0x0000012DCB792000-memory.dmp
memory/4460-25-0x0000012DCB7B0000-0x0000012DCB7C4000-memory.dmp
memory/4460-27-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-28-0x0000012DE3E50000-0x0000012DE3E64000-memory.dmp
memory/4460-40-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-2-0x00007FFFB9CAF000-0x00007FFFB9CB0000-memory.dmp
memory/4460-11-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-23-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-22-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4460-12-0x00007FFFB9B20000-0x00007FFFBA4C4000-memory.dmp
memory/4616-48-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4616-47-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4616-43-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4712-49-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4712-45-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4712-50-0x0000000000400000-0x0000000000424000-memory.dmp
memory/5604-29-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-41-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-36-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-35-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-34-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-33-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-55-0x0000000010000000-0x0000000010019000-memory.dmp
memory/5604-31-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-30-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-38-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-37-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-39-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-61-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-58-0x0000000010000000-0x0000000010019000-memory.dmp
memory/5604-60-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-62-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-59-0x0000000010000000-0x0000000010019000-memory.dmp
memory/5604-63-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-65-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-64-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-66-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-67-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-69-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5604-70-0x0000000000400000-0x0000000000480000-memory.dmp