remcos | 50d113ca212ad87b6d19e14c12cd91638b8cd4da4c8fc7c020dda0557c93fd85

Analysis

max time kernel
298s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NOGHCV09800.exe
Size

1.4MB
MD5

52213367d8528d5da7e3ed356d80ddc3
SHA1

f99fa064f78f516f7b4e6a0167fc54a193cd642d
SHA256

17a545082a45c4c219bd09093349cb12cafef84e37a8dd989b6382a434b89544
SHA512

a1d4fadf5dbfb32bdc6939b12d0f11c09be991fb1a397d4bfe97db880baf0d8803103be5166993038b79b8ec3f03122c4e44703d7485a6b77bc97c17a777472e
SSDEEP

24576:CiUmSB/o5d1ubcvI9/0XhFXSQMJ/ZDfJvXnaPw9Qs287sKeXnusOag6hj3:C/mU/ohubcvIx0xFXtMr7JvXa4x28Knt

Score

10^/10

remcos remotehost collection discovery rat spyware stealer upx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

192.210.150.26:3678

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-UJY4D8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 6 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3648-39-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3648-48-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3132-47-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3984-40-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3984-38-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3984-50-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3648-39-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3648-48-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3984-40-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3984-38-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3984-50-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milburr.vbs	Milburr.exe

Executes dropped EXE 5 IoCs

pid	Process
4668	Milburr.exe
3708	Milburr.exe
3984	Milburr.exe
3648	Milburr.exe
3132	Milburr.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Milburr.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4668-7-0x00000000005E0000-0x00000000008C7000-memory.dmp	autoit_exe
behavioral2/memory/4188-10-0x00000000005E0000-0x00000000008C7000-memory.dmp	autoit_exe
behavioral2/memory/4668-59-0x00000000005E0000-0x00000000008C7000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 3984	4668	Milburr.exe	84
PID 4668 set thread context of 3648	4668	Milburr.exe	85
PID 4668 set thread context of 3132	4668	Milburr.exe	86

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4188-0-0x00000000005E0000-0x00000000008C7000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-6.dat	upx
behavioral2/memory/4668-7-0x00000000005E0000-0x00000000008C7000-memory.dmp	upx
behavioral2/memory/4188-10-0x00000000005E0000-0x00000000008C7000-memory.dmp	upx
behavioral2/memory/4668-14-0x0000000003AE0000-0x0000000003BE0000-memory.dmp	upx
behavioral2/memory/4668-59-0x00000000005E0000-0x00000000008C7000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Milburr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Milburr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOGHCV09800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Milburr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Milburr.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3984	Milburr.exe
3984	Milburr.exe
3132	Milburr.exe
3132	Milburr.exe
3984	Milburr.exe
3984	Milburr.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4668	Milburr.exe
4668	Milburr.exe
4668	Milburr.exe
4668	Milburr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	Milburr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4188	NOGHCV09800.exe
4188	NOGHCV09800.exe
4668	Milburr.exe
4668	Milburr.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4188	NOGHCV09800.exe
4188	NOGHCV09800.exe
4668	Milburr.exe
4668	Milburr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4668	4188	NOGHCV09800.exe	82
PID 4188 wrote to memory of 4668	4188	NOGHCV09800.exe	82
PID 4188 wrote to memory of 4668	4188	NOGHCV09800.exe	82
PID 4668 wrote to memory of 3708	4668	Milburr.exe	83
PID 4668 wrote to memory of 3708	4668	Milburr.exe	83
PID 4668 wrote to memory of 3708	4668	Milburr.exe	83
PID 4668 wrote to memory of 3984	4668	Milburr.exe	84
PID 4668 wrote to memory of 3984	4668	Milburr.exe	84
PID 4668 wrote to memory of 3984	4668	Milburr.exe	84
PID 4668 wrote to memory of 3984	4668	Milburr.exe	84
PID 4668 wrote to memory of 3648	4668	Milburr.exe	85
PID 4668 wrote to memory of 3648	4668	Milburr.exe	85
PID 4668 wrote to memory of 3648	4668	Milburr.exe	85
PID 4668 wrote to memory of 3648	4668	Milburr.exe	85
PID 4668 wrote to memory of 3132	4668	Milburr.exe	86
PID 4668 wrote to memory of 3132	4668	Milburr.exe	86
PID 4668 wrote to memory of 3132	4668	Milburr.exe	86
PID 4668 wrote to memory of 3132	4668	Milburr.exe	86

C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe
"C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\tilthead\Milburr.exe
  "C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\AppData\Local\tilthead\Milburr.exe
    C:\Users\Admin\AppData\Local\tilthead\Milburr.exe /stext "C:\Users\Admin\AppData\Local\Temp\wyquklrghjwmv"
    3⤵
    - Executes dropped EXE
    PID:3708
- - C:\Users\Admin\AppData\Local\tilthead\Milburr.exe
    C:\Users\Admin\AppData\Local\tilthead\Milburr.exe /stext "C:\Users\Admin\AppData\Local\Temp\wyquklrghjwmv"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3984
- - C:\Users\Admin\AppData\Local\tilthead\Milburr.exe
    C:\Users\Admin\AppData\Local\tilthead\Milburr.exe /stext "C:\Users\Admin\AppData\Local\Temp\havmldcavrorxuqvb"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3648
- - C:\Users\Admin\AppData\Local\tilthead\Milburr.exe
    C:\Users\Admin\AppData\Local\tilthead\Milburr.exe /stext "C:\Users\Admin\AppData\Local\Temp\jujfdwvcjzgwibezlezw"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
a2eb063ff792755f80cf028c77fa77e4

SHA1
50c42b0f895d6d86ffa1d944d71cc006961002d8

SHA256
535c0875fa89ccf39b521b614d1a73f6244408011bcd7bea2794a5383b50b21a

SHA512
52ec2c616a37c109fce703f69e640ffb4444cb08bb7cd6e152eed388464aa93e95291f1d083eee8831526d5b22b15d1b46c1b51c0b309d7d6f67061c552f3336

Download Submit
C:\Users\Admin\AppData\Local\Temp\wyquklrghjwmv

Filesize
4KB

MD5
57509a6a6267f17bef5e5da8b1df8829

SHA1
0886741be12c4e6dd24688df7b9568e91b2fc2aa

SHA256
4d50e4b2ee7b25d6a88dea6a28503975ca95f98e6e72fcd1ee754d016df3ed3d

SHA512
019c20a2354ef20ff3870ea4d544ae4e7ec21729bfbeb19d2dd2f8b087fcb6b83f259ab2f35e0f3c7f044ebb7c5bbfdfc63f23b811d458a15f5ad35aa9175228

Download Submit
C:\Users\Admin\AppData\Local\tilthead\Milburr.exe

Filesize
1.4MB

MD5
52213367d8528d5da7e3ed356d80ddc3

SHA1
f99fa064f78f516f7b4e6a0167fc54a193cd642d

SHA256
17a545082a45c4c219bd09093349cb12cafef84e37a8dd989b6382a434b89544

SHA512
a1d4fadf5dbfb32bdc6939b12d0f11c09be991fb1a397d4bfe97db880baf0d8803103be5166993038b79b8ec3f03122c4e44703d7485a6b77bc97c17a777472e

Download Submit
memory/3132-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3132-47-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3132-41-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3648-34-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3648-39-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3648-48-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3648-37-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3984-33-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3984-30-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3984-40-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3984-38-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3984-50-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4188-10-0x00000000005E0000-0x00000000008C7000-memory.dmp

Filesize
2.9MB

Download
memory/4188-0-0x00000000005E0000-0x00000000008C7000-memory.dmp

Filesize
2.9MB

Download
memory/4188-3-0x0000000003F40000-0x0000000004040000-memory.dmp

Filesize
1024KB

Download
memory/4668-24-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-59-0x00000000005E0000-0x00000000008C7000-memory.dmp

Filesize
2.9MB

Download
memory/4668-26-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-25-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-23-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-22-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-16-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-21-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-20-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-19-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-14-0x0000000003AE0000-0x0000000003BE0000-memory.dmp

Filesize
1024KB

Download
memory/4668-52-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4668-55-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4668-56-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4668-57-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-28-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-60-0x0000000003AE0000-0x0000000003BE0000-memory.dmp

Filesize
1024KB

Download
memory/4668-61-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-62-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-63-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-7-0x00000000005E0000-0x00000000008C7000-memory.dmp

Filesize
2.9MB

Download
memory/4668-73-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-74-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-85-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-95-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-96-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-106-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-107-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-117-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-129-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-130-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download