Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 18:05
General
- Target Purchasing_Order_23342.pdf.js
- Size 717KB
- Sample261020-wpf72avt2j
- SHA256 ffe615cf5607d1fc36d694ab6419d7babc9c0b164ef8848bea077da734b98d92
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
RemoteHost
-
102.220.160.103:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7HG1MU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Purchasing_Order_23342.pdf.js1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\28a7de4d.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xzublq3r.prd.ps1
28a7de4d.ps1
memory/4508-22-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-25-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-9-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-11-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-12-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-2-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-14-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-15-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-16-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-17-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-18-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-19-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-20-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-21-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-1-0x00007FFC8873F000-0x00007FFC88740000-memory.dmp
memory/4508-23-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-8-0x0000025DD8F30000-0x0000025DD8F52000-memory.dmp
memory/4508-26-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-24-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-27-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-28-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-29-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-30-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-31-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-32-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-33-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-35-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-36-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-37-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-34-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4508-38-0x0000025DD92A0000-0x0000025DD92AA000-memory.dmp
memory/4508-41-0x00007FFC885B0000-0x00007FFC88F54000-memory.dmp
memory/4548-39-0x0000000140000000-0x00000001400AF000-memory.dmp