remcos | 97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/03/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe
Size 4.8MB
Sample260327-rbl4xaev21
SHA256 97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26
MD5 1653098906cf5db0f430363e4c78d291
SHA1 425f578681ad2a85920afbb64c04859b31c8b08b
SHA512 c96b963a7943f1ae15cd213b5420c84a267284b29ed04001b0a67b340de0a5e15b255a5344e529b80f399d171fec833057477aa180723dad37990a63cae35b15
SSDEEP 49152:OXYkfU9jE0ZmeZlL1wrejrYoD1Qxh+gEskXj15EtHMQTD8z1QeHFb:c+ZN1aSQx0gWErDIQO
TLSH
T1B2363B57FC9545E8C0AEE23089629252BE717C485B3523D32B60F7782F73BD4AAB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remember defense_evasion discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

remember

remccccs.fartit.com:2405

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
winsvc.exe
copy_folder
Remcs
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%Temp%
keylog_crypt
false
keylog_file
lgs.dat
keylog_flag
false
keylog_folder
remcs
mouse_option
false
mutex
Rmc-Z07M0X
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Scrs
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Looks for VMWare drivers on disk 2 TTPs 2 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\windows\system32\drivers\vmmouse.sys	x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe
File opened (read-only)	C:\windows\system32\drivers\vmhgfs.sys	x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe

Executes dropped EXE 3 IoCs

pid	Process
4792	winsvc.exe
1356	winsvc.exe
4780	winsvc.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-Z07M0X = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Remcs\\winsvc.exe\""	winsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Z07M0X = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Remcs\\winsvc.exe\""	winsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-Z07M0X = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Remcs\\winsvc.exe\""	winsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Z07M0X = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Remcs\\winsvc.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-Z07M0X = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Remcs\\winsvc.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Z07M0X = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Remcs\\winsvc.exe\""	winsvc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1328	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 3048	1356	winsvc.exe	85
PID 3048 set thread context of 1676	3048	svchost.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3048	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1328	4588	x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe	79
PID 4588 wrote to memory of 4792	4588	x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe	82
PID 1356 wrote to memory of 3048	1356	winsvc.exe	85
PID 3048 wrote to memory of 1676	3048	svchost.exe	86
PID 4792 wrote to memory of 4780	4792	winsvc.exe	87

C:\Users\Admin\AppData\Local\Temp\x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe
"C:\Users\Admin\AppData\Local\Temp\x97a735c3554f9984a4e2720795b139afad5c506fe85651f836ce7ebe3aad6b26.exe"
1⤵
- Looks for VMWare drivers on disk
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\ProgramData\winsvc.exe
  C:\ProgramData\winsvc.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Remcs\winsvc.exe
    "C:\Users\Admin\AppData\Local\Temp\Remcs\winsvc.exe"
    3⤵
    - Executes dropped EXE
    PID:4780

C:\Users\Admin\AppData\Local\Temp\Remcs\winsvc.exe
"C:\Users\Admin\AppData\Local\Temp\Remcs\winsvc.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lgs.dat

Path C:\ProgramData\remcs\lgs.dat
Size 144B
SHA256 51f244a34b7f299cc0949bf42c157211ffcb79e849300781941b145832250289
MD5 eb8e5acddfa129a97d7b64473b463e5e
SHA1 01c1659406a04481e6fe3d1c48ef6c08f0b34b91
SHA512 6e02dad2bf6d50ba97468bd500c08a8cf10cdd041056326614eaede8c4addbbb5ad298ce3bfc2c76bcebdfdf04f63a87d0a333baf3ade33ecac97e096fb09d54
TLSH
T1F8C092AA77E1201E7C73F2AA98B704367BB2FD69003CC80E21D1038D0AF1A0021C07D7
MD5 SHA1 SHA512 TLSH

Submit Download

winsvc.exe

Path C:\ProgramData\winsvc.exe
Size 516KB
SHA256 afd4485cacce19a7316fc500c3d6e2250466380d066f14aa36df75272540c44b
MD5 0a2baa8fd1e9c61313d746cb8102534f
SHA1 d6613bf26d65ee350cb68e49c7a5e78e81f9c17c
SHA512 2c5ef625bef5b5add72898ecad6f802c6e61c041d5b00bd8d23825b395e5ae4ce5890464c1929538d0c99ff27298be337d0cc8837179ff273982260e9b923133
SSDEEP 6144:dXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBceY:ZENlHV9FGeDWv3jADnyYiCNrsPZ0u
TLSH
T175B4B001B6F2C172D976A4300935E774DEBCBD201835997BA3D61D9BFD30190AB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-0-0x00000229088E0000-0x0000022908911000-memory.dmp

Download

memory/1676-42-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-54-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-60-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-40-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-100-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-45-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-49-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-95-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-41-0x00000000039E0000-0x00000000039E7000-memory.dmp

Download

memory/3048-65-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-70-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-75-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-80-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-85-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3048-90-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4588-4-0x000002A956DB0000-0x000002A956DE1000-memory.dmp

Download

memory/4792-35-0x0000000002340000-0x00000000023C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads