Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 03:27
General
- Target RFQ_432000_WORLD TECH ENGINEERING CO.,LTD..cmd
- Size 1.0MB
- Sample261104-dz2bvast5k
- SHA256 842b6a4d1c13bac3f5168b1e7b7b75ce5b3bb210b219820b8a6b6c9f0b0082dd
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
29_10_26_RemoteHost
-
derealforcloves.duckdns.org:8110
-
brtannyrose.duckdns.org:8110
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-1T5MK3
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Detects DonutLoader 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RFQ_432000_WORLD TECH ENGINEERING CO.,LTD..cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /y "C:\Users\Admin\AppData\Local\Temp\RFQ_432000_WORLD TECH ENGINEERING CO.,LTD..cmd" "C:\Users\Admin\AppData\Roaming\2uc1bs.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\2uc1bs.exe"C:\Users\Admin\AppData\Roaming\2uc1bs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c copy /y PWGINDBJYKMKEYIC.EXE C:\ProgramData\ && copy /y CIYEKMKYJBDNIGWP C:\ProgramData\ && copy /y lua51.dll C:\ProgramData\ && cd /d C:\ProgramData\ && start "" PWGINDBJYKMKEYIC.EXE CIYEKMKYJBDNIGWP & exit3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\PWGINDBJYKMKEYIC.EXEPWGINDBJYKMKEYIC.EXE CIYEKMKYJBDNIGWP4⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Reads the TCP/IP host and domain name from the registry
- outlook_office_path
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CIYEKMKYJBDNIGWP
PWGINDBJYKMKEYIC.EXE
lua51.dll
2uc1bs.exe
memory/6084-17-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-18-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-19-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-20-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-21-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-23-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-22-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-25-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-24-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-28-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-26-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-29-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-27-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-32-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-33-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-30-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-31-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-34-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-35-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-36-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-37-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-38-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-40-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-44-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-43-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-42-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-39-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-41-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-45-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-57-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-55-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-54-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-53-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-52-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-51-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-50-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-49-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-48-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-47-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-46-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-56-0x0000000057FD0000-0x0000000057FE0000-memory.dmp
memory/6084-59-0x00000000025C0000-0x0000000002669000-memory.dmp
memory/6084-60-0x0000000014490000-0x000000001453F000-memory.dmp
memory/6084-58-0x00000000025C0000-0x00000000035C0000-memory.dmp
memory/6084-61-0x0000000180000000-0x000000018012C000-memory.dmp
memory/6084-64-0x0000000180000000-0x000000018012C000-memory.dmp
memory/6084-65-0x0000000180000000-0x000000018012C000-memory.dmp
memory/6084-66-0x0000000000400000-0x000000000040D000-memory.dmp
memory/6084-67-0x0000000066D80000-0x0000000066DF4000-memory.dmp