Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/02/2026, 15:31
General
- Target c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693.exe
- Size 1.0MB
- Sample260205-sye5jsax6b
- SHA256 c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693
Malware Config
Extracted
-
remcos
-
1.7 Pro
-
GooGle!
-
193.148.16.211:42830
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
gogs.dat
-
keylog_flag
false
-
keylog_folder
gg
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_zlcibijpmzfdsgsd44
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693.exe"C:\Users\Admin\AppData\Local\Temp\c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693.exe"C:\Users\Admin\AppData\Local\Temp\c287d9bdbeb5f8ef2e712e5dbf5df9753aeea692c8924a413b56708a2c55f693.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1zuyb0db.ozx.ps1
memory/1536-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1536-19-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1536-18-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1536-15-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1536-67-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3768-8-0x0000000006680000-0x000000000671C000-memory.dmp
memory/3768-7-0x0000000005EC0000-0x0000000005F8C000-memory.dmp
memory/3768-6-0x0000000005A00000-0x0000000005A10000-memory.dmp
memory/3768-5-0x0000000005D70000-0x0000000005D86000-memory.dmp
memory/3768-4-0x0000000005B20000-0x0000000005B2A000-memory.dmp
memory/3768-3-0x0000000005A00000-0x0000000005A10000-memory.dmp
memory/3768-2-0x0000000005A80000-0x0000000005B12000-memory.dmp
memory/3768-1-0x0000000006030000-0x00000000065D6000-memory.dmp
memory/3768-0-0x0000000000EB0000-0x0000000000FB6000-memory.dmp
memory/4052-44-0x00000292F1C30000-0x00000292F1C76000-memory.dmp
memory/4052-35-0x00000292EDB60000-0x00000292EDB82000-memory.dmp
memory/4528-28-0x0000000005E50000-0x0000000005EB6000-memory.dmp
memory/4528-53-0x0000000006AF0000-0x0000000006B0E000-memory.dmp
memory/4528-32-0x0000000005FB0000-0x0000000006016000-memory.dmp
memory/4528-24-0x00000000056B0000-0x0000000005CDA000-memory.dmp
memory/4528-34-0x0000000006020000-0x0000000006377000-memory.dmp
memory/4528-17-0x0000000002CD0000-0x0000000002CE0000-memory.dmp
memory/4528-43-0x0000000006500000-0x000000000654C000-memory.dmp
memory/4528-42-0x00000000064D0000-0x00000000064EE000-memory.dmp
memory/4528-14-0x0000000002CD0000-0x0000000002CE0000-memory.dmp
memory/4528-45-0x0000000006AB0000-0x0000000006AE4000-memory.dmp
memory/4528-46-0x00000000712A0000-0x00000000712EC000-memory.dmp
memory/4528-25-0x0000000005620000-0x0000000005642000-memory.dmp
memory/4528-54-0x00000000076D0000-0x0000000007774000-memory.dmp
memory/4528-55-0x0000000007E50000-0x00000000084CA000-memory.dmp
memory/4528-56-0x0000000007810000-0x000000000782A000-memory.dmp
memory/4528-57-0x0000000007890000-0x000000000789A000-memory.dmp
memory/4528-58-0x0000000007AA0000-0x0000000007B36000-memory.dmp
memory/4528-59-0x0000000007A20000-0x0000000007A31000-memory.dmp
memory/4528-60-0x0000000007A50000-0x0000000007A5E000-memory.dmp
memory/4528-61-0x0000000007A60000-0x0000000007A75000-memory.dmp
memory/4528-62-0x0000000007B60000-0x0000000007B7A000-memory.dmp
memory/4528-63-0x0000000007B50000-0x0000000007B58000-memory.dmp
memory/4528-13-0x0000000002CE0000-0x0000000002D16000-memory.dmp