remcos | 5376f3fdc59befa0e3af575beb1ca43180a9edceae0a26eba338aa2b1ca37953

Analysis

max time kernel
148s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
03/10/2025, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RH98766789000000802.exe
Size 820KB
Sample251003-selszsssdx
SHA256 5376f3fdc59befa0e3af575beb1ca43180a9edceae0a26eba338aa2b1ca37953
MD5 d72666dbb09fc973c2648a1f3699382f
SHA1 d93475096b39569d5721719ae4dea75f25de9e28
SHA512 31809bd8116bf1fa93ad8b60f62f2ba0cc32c4c34cafba29fb4a27b4f3f3ad5f53a83f9a8ece468e031887684246bfd6b74509728a477eca48b82d2c2fafe524
SSDEEP 24576:Qf+iN57Gtene3NNlVyg/yExHo7ZFHzRYO/X7p:2LXKtene3NDVNlxHo7ZFHz77
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remotehost discovery remcos rat upx

Malware Config

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

RemoteHost

198.12.126.169:8787

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5X6CY5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Countee.vbs	Countee.exe

Executes dropped EXE 2 IoCs

pid	Process
3912	Countee.exe
5396	Countee.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4704-27-0x0000000000F80000-0x0000000001146000-memory.dmp	autoit_exe
behavioral2/memory/3912-39-0x0000000000AE0000-0x0000000000CA6000-memory.dmp	autoit_exe
behavioral2/memory/5396-54-0x00000000015F0000-0x00000000019F0000-memory.dmp	autoit_exe
behavioral2/memory/5396-68-0x0000000000AE0000-0x0000000000CA6000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5396 set thread context of 5740	5396	Countee.exe	82

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4704-0-0x0000000000F80000-0x0000000001146000-memory.dmp	upx
behavioral2/files/0x001900000002b141-16.dat	upx
behavioral2/memory/3912-17-0x0000000000AE0000-0x0000000000CA6000-memory.dmp	upx
behavioral2/memory/4704-27-0x0000000000F80000-0x0000000001146000-memory.dmp	upx
behavioral2/memory/3912-39-0x0000000000AE0000-0x0000000000CA6000-memory.dmp	upx
behavioral2/memory/5396-68-0x0000000000AE0000-0x0000000000CA6000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	5396	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RH98766789000000802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Countee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Countee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3912	Countee.exe
5396	Countee.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4704	RH98766789000000802.exe
4704	RH98766789000000802.exe
3912	Countee.exe
3912	Countee.exe
5396	Countee.exe
5396	Countee.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4704	RH98766789000000802.exe
4704	RH98766789000000802.exe
3912	Countee.exe
3912	Countee.exe
5396	Countee.exe
5396	Countee.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5740	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3912	4704	RH98766789000000802.exe	79
PID 4704 wrote to memory of 3912	4704	RH98766789000000802.exe	79
PID 4704 wrote to memory of 3912	4704	RH98766789000000802.exe	79
PID 3912 wrote to memory of 6060	3912	Countee.exe	80
PID 3912 wrote to memory of 6060	3912	Countee.exe	80
PID 3912 wrote to memory of 6060	3912	Countee.exe	80
PID 3912 wrote to memory of 5396	3912	Countee.exe	81
PID 3912 wrote to memory of 5396	3912	Countee.exe	81
PID 3912 wrote to memory of 5396	3912	Countee.exe	81
PID 5396 wrote to memory of 5740	5396	Countee.exe	82
PID 5396 wrote to memory of 5740	5396	Countee.exe	82
PID 5396 wrote to memory of 5740	5396	Countee.exe	82
PID 5396 wrote to memory of 5740	5396	Countee.exe	82

C:\Users\Admin\AppData\Local\Temp\RH98766789000000802.exe
"C:\Users\Admin\AppData\Local\Temp\RH98766789000000802.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\adstipulator\Countee.exe
  "C:\Users\Admin\AppData\Local\Temp\RH98766789000000802.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\RH98766789000000802.exe"
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\adstipulator\Countee.exe
    "C:\Users\Admin\AppData\Local\adstipulator\Countee.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\adstipulator\Countee.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 740
      4⤵
      Program crash
      PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5396 -ip 5396
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 d49979fa52b264ae7ff46676d08da9ef09743fd9f1521f72c49d335e71286df0
MD5 6991c349ec90d4729b522530b26e6066
SHA1 56827e5d2ed52b4ab85110355fb3a3995ece8fac
SHA512 95b6e714e9503bc58d9daaaff315ee23dc60573b37bce671c4d4b32deccb4192c22fb6ed0a5036534bdecb67f4a6af23326d9242a929b8ff4dabf19aa52e391f
MD5 SHA1 SHA512

Submit Download

Zama

Path C:\Users\Admin\AppData\Local\Temp\Zama
Size 39KB
SHA256 71f594354960458c09bb8531fc274e41f59c58a087bff1013c0c81c5246d2858
MD5 5d1d117e1322dc68a01f9735fddee639
SHA1 889aadeae0dacb5370758be139dd14fee5692653
SHA512 4927978827e9c932145759b59faca17615bf4c5be1ae4fb7219854280f7e28dde98bb9abb69901a435e6c984e1bf768d0ef9507d7343029e6d80b761b17c8f4d
SSDEEP 384:5j+nEvLbwqezGRckirwZ3yy7yKx9E7Sa6Ovj9ypmB0qqffj1s9kM:5Kme2e3yENymBea
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut6F44.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut6F44.tmp
Size 10KB
SHA256 d8be467fbb0aac5083cafdf0927ce19f36fe2f0c5618f8b6929352d8ca5c9707
MD5 eed5fae6e971f247c127596f6d8d81b8
SHA1 7c7dc3cbaaa69b6d3fa76e012cc289be39e2fb46
SHA512 c0c5b4a34b8af54eb04a64179057d3c32bd2e3910a1494ce47222427b53019e07826c8dee129d1884646756d7c4ecd4b934c89822eed09baa6928f07f4f81add
SSDEEP 192:XJ+u9GPTUvgLMl3HVo2nxYd4GX9DI+1ILtSc1/DAdGNo5LfzachbipfQ77ZP+kGk:5+mGLUvRllo2U1ILAr1z0WZP+xg
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut705E.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut705E.tmp
Size 389KB
SHA256 f53af91d277e005bb7026a6473ef26fcad230224ce32f51b952421b5e02381bd
MD5 95daa05d9089f29ceee0b2b50cdf2a84
SHA1 037ec2dee3c989b7ef7d0e6a759ccc7ac5f260f1
SHA512 d9ffef5cd060ab1941d8e747de165f8561e4234246e077721562778ed7655e410518fd293a22f8932e32cb1a8835517867fab04a932e2288f766726051379711
SSDEEP 12288:QZYz8tl/p6e9Nv1O0/jXQa7YqiR4Lpk9K:kYzYFpp7vNLFYqIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

horrify

Path C:\Users\Admin\AppData\Local\Temp\horrify
Size 192KB
SHA256 b5f9a6f72fcb99e35132c603b7ec8abd141efa750a285fe170fb105f3221cc92
MD5 9f6e7536b06f12114c84717f5559ef9d
SHA1 a7e1a5a47bcf770bfe3225f63a5b89365e3688c5
SHA512 da96736abce2d7f4617698b0907e615b9af98db98c74cc850460d08a45d6775f9f577d86fed002c3666658e69ac73799a0539d2fb2b9585f615368f4b0b59977
SSDEEP 3072:UKkef7K6VJHrNw7f9m+z8R0pZuHSI4ZVx914UumeqXD4mSHa5XpSIk:hku9JpGmziLuyIEVFcsM655Fk
MD5 SHA1 SHA512 SSDEEP

Submit Download

horrify

Path C:\Users\Admin\AppData\Local\Temp\horrify
Size 469KB
SHA256 e656add231f52ca1dfc75b7965b847f9d5197570f122ef5bd6dbc6e3bb347500
MD5 fe258aea63a2e3e00807d00b38ed427e
SHA1 a15d620f783acf91938283630f719682812ae2b7
SHA512 af49303903c1f136960749ec621db51ee88557a3dc798b769b32c9d0aaa7ae41877a0ae3944797f198df71fbe9e21d89cf008681b2454e9a6f056c5c3bf889f3
SSDEEP 12288:hkIJpGmzIuZsb57G8F64Z5pDNDKUFW/uFab0gvwTQ/mZHH:yI6luZK64Z5pDN2UU2o09Hd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Countee.exe

Path C:\Users\Admin\AppData\Local\adstipulator\Countee.exe
Size 820KB
SHA256 5376f3fdc59befa0e3af575beb1ca43180a9edceae0a26eba338aa2b1ca37953
MD5 d72666dbb09fc973c2648a1f3699382f
SHA1 d93475096b39569d5721719ae4dea75f25de9e28
SHA512 31809bd8116bf1fa93ad8b60f62f2ba0cc32c4c34cafba29fb4a27b4f3f3ad5f53a83f9a8ece468e031887684246bfd6b74509728a477eca48b82d2c2fafe524
SSDEEP 24576:Qf+iN57Gtene3NNlVyg/yExHo7ZFHzRYO/X7p:2LXKtene3NDVNlxHo7ZFHz77
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3912-35-0x0000000001660000-0x0000000001A60000-memory.dmp

Download

memory/3912-39-0x0000000000AE0000-0x0000000000CA6000-memory.dmp

Download

memory/3912-17-0x0000000000AE0000-0x0000000000CA6000-memory.dmp

Download

memory/4704-27-0x0000000000F80000-0x0000000001146000-memory.dmp

Download

memory/4704-0-0x0000000000F80000-0x0000000001146000-memory.dmp

Download

memory/4704-13-0x00000000008F0000-0x0000000000CF0000-memory.dmp

Download

memory/5396-54-0x00000000015F0000-0x00000000019F0000-memory.dmp

Download

memory/5396-68-0x0000000000AE0000-0x0000000000CA6000-memory.dmp

Download

memory/5740-57-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-71-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-63-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-61-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-64-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-65-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-66-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-56-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-69-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-62-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-55-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-78-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-77-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-85-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-86-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-93-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-94-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-101-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5740-102-0x0000000000400000-0x000000000047F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads