Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
08/01/2026, 04:03
General
- Target 2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
- Size 1.8MB
- Sample260108-emn2esvlcm
- SHA256 9794f1982d73c0ad8ecf5fdfa85c95a991a8a954c3efb6c5744e858b31b74ded
Malware Config
Extracted
-
remcos
-
7.1.0 Pro
-
chatx
-
n.gochatx.mov:10333
-
audio_folder
Âó¿Ë·ç³ªÆ¬
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
åe×_.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Cmc-ZWNBHC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
½Øͼ
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4716-0-0x000001F112040000-0x000001F1120D4000-memory.dmp
memory/4716-2-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-3-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-6-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-4-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-7-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-8-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-9-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-10-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-11-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-12-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-13-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-14-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-15-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-16-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-17-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-18-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-19-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-20-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-21-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-22-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-23-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-24-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-25-0x000001F1120E0000-0x000001F11217C000-memory.dmp
memory/4716-26-0x000001F1120E0000-0x000001F11217C000-memory.dmp