Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 13:33
General
- Target Sipariş onaylamak.js
- Size 651KB
- Sample261102-qtpgbacv6j
- SHA256 f0c70b32a0e75a910dd8d98253640e82580bb5e5574db346bb56dde6d56eea9a
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
NED TR
-
103.83.87.47:3838
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-M768B2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Sipariş onaylamak.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\nobxcjaams\w91977.ps1"1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nv4ufcc2\nv4ufcc2.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C6C.tmp" "c:\Users\Admin\AppData\Local\Temp\nv4ufcc2\CSC44340ABD6BB476591B7ABA83FEAB60.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES6C6C.tmp
w91977.ps1
nv4ufcc2.dll
CSC44340ABD6BB476591B7ABA83FEAB60.TMP
nv4ufcc2.0.cs
nv4ufcc2.cmdline
memory/3616-32-0x0000000074CA2000-0x0000000074CA3000-memory.dmp
memory/3616-3-0x00000000051A0000-0x00000000057EA000-memory.dmp
memory/3616-11-0x0000000005970000-0x0000000005CCB000-memory.dmp
memory/3616-12-0x0000000005E40000-0x0000000005E5E000-memory.dmp
memory/3616-13-0x0000000005E80000-0x0000000005ECC000-memory.dmp
memory/3616-7-0x0000000005030000-0x0000000005096000-memory.dmp
memory/3616-15-0x00000000074B0000-0x0000000007B2C000-memory.dmp
memory/3616-16-0x0000000006410000-0x000000000642A000-memory.dmp
memory/3616-6-0x0000000004F70000-0x0000000004F92000-memory.dmp
memory/3616-5-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-4-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-43-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-2-0x0000000002600000-0x0000000002636000-memory.dmp
memory/3616-29-0x0000000006460000-0x0000000006468000-memory.dmp
memory/3616-30-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-31-0x0000000007280000-0x000000000729A000-memory.dmp
memory/3616-1-0x0000000074CA2000-0x0000000074CA3000-memory.dmp
memory/3616-33-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-34-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-35-0x0000000074C90000-0x000000007544C000-memory.dmp
memory/3616-37-0x00000000072A0000-0x00000000072A8000-memory.dmp
memory/3616-8-0x00000000050A0000-0x0000000005106000-memory.dmp
memory/5356-38-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-41-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-40-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-39-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-45-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-44-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-46-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-48-0x0000000010000000-0x00000000100F7000-memory.dmp
memory/5356-50-0x0000000010000000-0x00000000100F7000-memory.dmp
memory/5356-51-0x0000000010000000-0x00000000100F7000-memory.dmp
memory/5356-52-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-53-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-54-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-55-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-56-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-57-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-58-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-59-0x0000000000400000-0x0000000000490000-memory.dmp
memory/5356-60-0x0000000000400000-0x0000000000490000-memory.dmp