remcos | cedcfe85d91b8e4cc835547efd2d7b761b4aad101f306435a925f708fbcf1037

Analysis

max time kernel
148s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20250905-en
resource tags

arch:x64arch:x86image:win11-20250905-enlocale:en-usos:windows11-21h2-x64system
submitted
11/09/2025, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
python310.dll
Size 3.3MB
Sample250911-nca69asvay
SHA256 cedcfe85d91b8e4cc835547efd2d7b761b4aad101f306435a925f708fbcf1037
MD5 8b7ba61afff780ae6d90dced1bc7773d
SHA1 3b4bba135b02fc671e424e516a1cab21d1ce5426
SHA512 9a0b05385e429e71e917905de79b067f3bf099c29004c652d8e88c7c57555f5bfb762be6fde0e5b86e62d1bf1e752c393308a78e8ef06e7288fad32ba4d325f9
SSDEEP 49152:BHQrhmbLcWmmRLFnRw9Nli/13kpO1ugrA0FWWdrD1HJSBGes/l:urQnRzwS1rdrHFWWd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gateway collection discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.0.2 Pro

Botnet

GATEWAY

178.16.52.250:1986

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BPKJUY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1856-4487-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3424-4488-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3336-4490-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3424-4488-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3336-4490-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Executes dropped EXE 1 IoCs

pid	Process
3760	rundll32.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2910617350-3280892089-2510284752-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rmclient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2910617350-3280892089-2510284752-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "cmd.exe /C start \"\" /D \"C:\\Users\\Admin\\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\" \"C:\\Users\\Admin\\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\\rundll32.exe\""	rundll32.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5160 set thread context of 484	5160	rundll32.exe	82
PID 484 set thread context of 3336	484	aspnet_wp.exe	86
PID 484 set thread context of 3424	484	aspnet_wp.exe	87
PID 484 set thread context of 1856	484	aspnet_wp.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3336	rmclient.exe
3336	rmclient.exe
1856	rmclient.exe
1856	rmclient.exe
3336	rmclient.exe
3336	rmclient.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	rmclient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
484	aspnet_wp.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2320	4728	cmd.exe	80
PID 4728 wrote to memory of 2320	4728	cmd.exe	80
PID 2320 wrote to memory of 3760	2320	cmd.exe	81
PID 2320 wrote to memory of 3760	2320	cmd.exe	81
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 5160 wrote to memory of 484	5160	rundll32.exe	82
PID 484 wrote to memory of 3336	484	aspnet_wp.exe	86
PID 484 wrote to memory of 3336	484	aspnet_wp.exe	86
PID 484 wrote to memory of 3336	484	aspnet_wp.exe	86
PID 484 wrote to memory of 3336	484	aspnet_wp.exe	86
PID 484 wrote to memory of 3424	484	aspnet_wp.exe	87
PID 484 wrote to memory of 3424	484	aspnet_wp.exe	87
PID 484 wrote to memory of 3424	484	aspnet_wp.exe	87
PID 484 wrote to memory of 3424	484	aspnet_wp.exe	87
PID 484 wrote to memory of 5572	484	aspnet_wp.exe	88
PID 484 wrote to memory of 5572	484	aspnet_wp.exe	88
PID 484 wrote to memory of 5572	484	aspnet_wp.exe	88
PID 484 wrote to memory of 1856	484	aspnet_wp.exe	89
PID 484 wrote to memory of 1856	484	aspnet_wp.exe	89
PID 484 wrote to memory of 1856	484	aspnet_wp.exe	89
PID 484 wrote to memory of 1856	484	aspnet_wp.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\python310.dll,#1
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\voptcwhlhpj"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\xiuedhrfvxcwly"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3424
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\ilzxdzcgjfubwegve"
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\rmclient.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\ilzxdzcgjfubwegve"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cmd.exe /C start "" /D "C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY" "C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\rundll32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\system32\cmd.exe
  cmd.exe /C start "" /D "C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY" "C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\rundll32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\rundll32.exe
    "C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\rundll32.exe"
    3⤵
    - Executes dropped EXE
    PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 c6bb0388160df23681ab06ddbb9d25b97c0e8f53d1dabef44308f3a44a35ae1c
MD5 66e78c1a9d67c652ebbd15ab49d9ed8c
SHA1 a117836a9776c7aaee1020a4b9fb91cfabce5717
SHA512 a40f9ede32b34fbc370e04c1072a4e2410e9a91c70e436a078e315d1ed8760963c8c988d8a946c34dde4571a875eb1891ec2405a0cc8d9e5fa87edd9c1e0b437
MD5 SHA1 SHA512

Submit Download

dpnhupnp.dll

Path C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\dpnhupnp.dll
Size 28KB
SHA256 5cf4a8d9233ae1033788efe8f1296ffe64a314e1c38ccca33fbcbad8f3db4a7f
MD5 e750ca03b67b1b50dace1875cff645d6
SHA1 bfcb9780a6357e53c414d96d56291c4eba67cd88
SHA512 e735db461bb583ef07f4a5c69c6b38cb4a6d5782cda587ba55ad3ccd49a048e29cf3dac53824db4c48ae95760b5fe8e841f5fb6430e5f6261d6a9ccf4bc6c318
SSDEEP 96:rel2VLEi2Q46yNk59Mv8mVsY7YazvZ5DsmMWr7b5GEWquWw:ryPyyNk5GzXYSvDxr75WquW
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32.exe

Path C:\Users\Admin\7v3wz7DHVZCfYAmZYergjbA6mqsBunY\rundll32.exe
Size 72KB
SHA256 60517f898bfac156cd298fd0a45f2e06cecee232a54667213458b99dc8d80de7
MD5 10f08638e7c04d15ba4b4a740087a826
SHA1 07888e33210b015c0a206c60826fd40d5c3b5508
SHA512 5c53d3ea3b622f2e1746411642966794e733be1859df085894c075d5bf77215aca6b707913b1d6dd6af76aa81860fa163cd847af215fb805e16ffaf2fc91836a
SSDEEP 1536:yRBHxEvtdRnnV2F35pCZCump2IknaAnHwfbEUCmUVR:6BRCrnipymcnQfLH4R
MD5 SHA1 SHA512 SSDEEP

Submit Download

voptcwhlhpj

Path C:\Users\Admin\AppData\Local\Temp\voptcwhlhpj
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/484-4493-0x0000000180000000-0x000000018001D000-memory.dmp

Download

memory/484-4462-0x000001D6E1FF0000-0x000001D6E1FF1000-memory.dmp

Download

memory/484-4466-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4470-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4469-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4471-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4473-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4472-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4474-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4475-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4476-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4528-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4529-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4520-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4521-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4512-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4464-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4495-0x0000000180000000-0x000000018001D000-memory.dmp

Download

memory/484-4496-0x0000000180000000-0x000000018001D000-memory.dmp

Download

memory/484-4497-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4463-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4499-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4465-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4504-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4505-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/484-4513-0x000001D6E1F50000-0x000001D6E1FEF000-memory.dmp

Download

memory/1856-4487-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3336-4490-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3424-4488-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3424-4480-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5572-4481-0x0000000000450000-0x0000000000474000-memory.dmp

Download