Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 11:40
General
- Target invoice_scan.js
- Size 1.9MB
- Sample261101-ns7kdsvset
- SHA256 08ac0b0b248a5982f4140e5111b7b25132437da350cd92451c10d5929ecb917e
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
AedesEgypti
-
23.132.164.115:2595
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AS5Y4K
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- UAC bypass 3 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\invoice_scan.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ChannelIndex58" /xml "C:\Users\Admin\AppData\Local\Temp\3406428.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\graphviewcg.exe"C:\Users\Admin\AppData\Local\Temp\graphviewcg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- UAC bypass
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
3406428.xml
cachecg.store
graphviewcg.exe
memory/4908-12-0x0000000000406000-0x0000000000407000-memory.dmp
memory/4964-36-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-40-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-16-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-17-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-20-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-21-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-23-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-24-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-13-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-28-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-37-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-14-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-38-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-15-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-41-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-42-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-43-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-44-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-46-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-47-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-48-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-49-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-52-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-56-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-57-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-65-0x0000000000400000-0x0000000000490000-memory.dmp
memory/4964-64-0x0000000000400000-0x0000000000490000-memory.dmp