Analysis
- user interaction
yes - max time kernel
1049s - max time network
1023s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/11/2026, 01:04
General
- Target HR_Update_Performance_Clearance_Oct2026.vbs
- Size 84KB
- Sample261109-bfacxabe59
- SHA256 aeeb1b4c78f83c07c2b810718bce48d511fea89eaae5e7b2a30fbc3199ecce4e
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
RemoteHost
-
31.57.216.102:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-K5HL7W
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- UAC bypass 3 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HR_Update_Performance_Clearance_Oct2026.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /q /v:on /c echo ^%Revivability^% | !Afbrndtes! -2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %Revivability% "3⤵
-
-
\??\c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundtaskhost.exe"C:\Windows\SysWOW64\backgroundtaskhost.exe"4⤵
-
-
C:\Windows\SysWOW64\backgroundtaskhost.exe"C:\Windows\SysWOW64\backgroundtaskhost.exe"4⤵
- UAC bypass
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundtaskhost.exe"C:\Windows\SysWOW64\backgroundtaskhost.exe"5⤵
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Process Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Debugger Evasion
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1880-0-0x00000000742B2000-0x00000000742B3000-memory.dmp
memory/1880-1-0x0000000004B20000-0x0000000004B56000-memory.dmp
memory/1880-3-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-2-0x00000000052A0000-0x00000000058EA000-memory.dmp
memory/1880-4-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-5-0x0000000005990000-0x00000000059B2000-memory.dmp
memory/1880-7-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/1880-6-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/1880-10-0x0000000005BB0000-0x0000000005F0B000-memory.dmp
memory/1880-11-0x0000000006000000-0x000000000601E000-memory.dmp
memory/1880-12-0x0000000006040000-0x000000000608C000-memory.dmp
memory/1880-13-0x00000000071B0000-0x00000000071F8000-memory.dmp
memory/1880-14-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-15-0x0000000007AB0000-0x000000000812C000-memory.dmp
memory/1880-16-0x0000000007450000-0x000000000746A000-memory.dmp
memory/1880-17-0x0000000007580000-0x0000000007616000-memory.dmp
memory/1880-18-0x0000000007530000-0x0000000007552000-memory.dmp
memory/1880-19-0x00000000086F0000-0x0000000008CAA000-memory.dmp
memory/1880-20-0x00000000742B2000-0x00000000742B3000-memory.dmp
memory/1880-21-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-22-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-23-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-24-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-25-0x0000000008CB0000-0x000000000E4A5000-memory.dmp
memory/1880-27-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/1880-28-0x00000000742A0000-0x0000000074A5C000-memory.dmp
memory/4224-41-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-46-0x000000001EA50000-0x000000001EB47000-memory.dmp
memory/4224-49-0x000000001EA50000-0x000000001EB47000-memory.dmp
memory/4224-50-0x000000001EA50000-0x000000001EB47000-memory.dmp
memory/4224-51-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-52-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-53-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-54-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-55-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-56-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-57-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-58-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-59-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-60-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-61-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-62-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-63-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-64-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-65-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-66-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-67-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-68-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-69-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-70-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-71-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-72-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-73-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-74-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-78-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-79-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-80-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-84-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-85-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-86-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-87-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-88-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-89-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-93-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-94-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-95-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-96-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-97-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-98-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-99-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-100-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-101-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-102-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-124-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-125-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-126-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-127-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-128-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-129-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-136-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-137-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-138-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-142-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-143-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-144-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-145-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-146-0x0000000000870000-0x0000000001B56000-memory.dmp
memory/4224-147-0x0000000000870000-0x0000000001B56000-memory.dmp