Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/02/2026, 05:54
General
- Target doc30326-002000.scr.exe
- Size 1.2MB
- Sample260222-glz4eahw3a
- SHA256 5f4710bfecf96b1c4c9ef95b36543b698b2e89682f1a8524927ed860de826f8b
Malware Config
Extracted
-
remcos
-
GREEN
-
swgtcampus0101.duckdns.org:60497
-
amsholdings.ddns.net:60497
-
toleskiki.ddnsgeek.com:60497
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-69FS0L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc30326-002000.scr.exe"C:\Users\Admin\AppData\Local\Temp\doc30326-002000.scr.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rwnb.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c gugbqdhimr.docx bsoocomt.dll3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gugbqdhimr.docxgugbqdhimr.docx bsoocomt.dll4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
balwrsqkg.icm
dcaqj.mp3
eeduhso.mp3
ehsietncca.bmp
gugbqdhimr.docx
hrvwdmx.3gp
iljhlc.3gp
krjuk.mp2
llhpx.icm
ojnv.txt
oscjkl.mp2
pxegs.bin
pxegs.bin
qobmooulux.xl
qvxngv.3gp
rwnb.vbe
skcopew.das
tnrjkp.bmp
vgspkjxwg.bin
vldckdog.xls
vtkbjugr.xl
xapr.icm
xggnqwis.pgp
xvavvnronw.xls
RegSvcs.exe
memory/1040-187-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-170-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-149-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-169-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-203-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-156-0x00000000016F0000-0x0000000001754000-memory.dmp
memory/1040-161-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-162-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-143-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-145-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-150-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-177-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-178-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-186-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-146-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-194-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-195-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/1040-202-0x0000000001000000-0x00000000014B2000-memory.dmp
memory/2096-152-0x0000000000C40000-0x0000000000CA4000-memory.dmp