remcos | df4c77e19109b83fff25175d0cffcaee8ce74306df86df5cdbe58e4cd8b95b3c

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LABOSERV_NB-0010214026_PDF.js
Size 16KB
Sample260415-jvsf2acs8w
SHA256 df4c77e19109b83fff25175d0cffcaee8ce74306df86df5cdbe58e4cd8b95b3c
MD5 ee518ca859a00f1f061cbc9a75326f8e
SHA1 bada5b55c9c2529fea7fa707464599b990b1944d
SHA512 d7db93bbc2bc8f074917acf2e4e129fb1989fe2841794217b7091935ba08463df210665ef569f19278d8e32511d5ebf88172b7589cded432057b0187fd85a75f
SSDEEP 192:p1ihqcev3No43G5AoGZ8rWoiDIej0saQHtlWsAB8vfBQ3fi5Egp2g:pKfi5Egp2g
TLSH
T1AB7258AFCC040A6E2D6C612786FB447BA67B71E2F0A36A41704C5477FA95D83F448B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mar ending collection defense_evasion discovery execution remcos persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

MAR Ending

dentalux202.ydns.eu:62582
dentalux202bk.ydns.eu:64636

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HQO1B7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4716	powershell.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	4716	powershell.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4716	powershell.exe	80

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	calc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	calc.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2852-35-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3948	powershell.exe
7	3256	powershell.exe
9	2844	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3256	powershell.exe
2844	powershell.exe
3948	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 3016	3948	powershell.exe	85
PID 3016 set thread context of 5048	3016	calc.exe	86
PID 3016 set thread context of 2140	3016	calc.exe	87
PID 3016 set thread context of 2852	3016	calc.exe	88
PID 3256 set thread context of 1956	3256	powershell.exe	93

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
5048	userinit.exe
5048	userinit.exe
2852	userinit.exe
2852	userinit.exe
5048	userinit.exe
5048	userinit.exe
5048	userinit.exe
5048	userinit.exe
5048	userinit.exe
5048	userinit.exe
5048	userinit.exe
5048	userinit.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	2852	userinit.exe
Token: SeImpersonatePrivilege	5048	userinit.exe
Token: SeImpersonatePrivilege	5048	userinit.exe
Token: SeImpersonatePrivilege	5048	userinit.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3948 wrote to memory of 3016	3948	powershell.exe	85
PID 3016 wrote to memory of 5048	3016	calc.exe	86
PID 3016 wrote to memory of 2140	3016	calc.exe	87
PID 3016 wrote to memory of 2852	3016	calc.exe	88
PID 3256 wrote to memory of 1756	3256	powershell.exe	92
PID 3256 wrote to memory of 1956	3256	powershell.exe	93
PID 3256 wrote to memory of 1956	3256	powershell.exe	93
PID 3256 wrote to memory of 1956	3256	powershell.exe	93
PID 3256 wrote to memory of 1956	3256	powershell.exe	93
PID 3256 wrote to memory of 1956	3256	powershell.exe	93
PID 3256 wrote to memory of 1956	3256	powershell.exe	93
PID 3256 wrote to memory of 1956	3256	powershell.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\LABOSERV_NB-0010214026_PDF.js
1⤵
PID:2148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  - UAC bypass
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\userinit.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\tfbldsyntejfkztogvz"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\SysWOW64\userinit.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\dagedkjpgmbkmfhapftgrc"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Windows\SysWOW64\userinit.exe
    /stext "C:\Users\Admin\AppData\Local\Temp\fclxedbicutowteegqgacpszl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2852

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:576

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\Downloads\Name_File.js
1⤵
PID:2464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  PID:1956

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\Downloads\Name_File.js
1⤵
PID:2984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 37b6b80af283174c508fcb8a5faa0854ba1ab2add391502bbd8e81c18df0ad4d
MD5 7f803908e5595ac7805479ffa4f4fc41
SHA1 42e1ba3a6f437dfcdaa03d714d56e807910fe69b
SHA512 a4aff0953c7827d879f94d9503963c04146c94fef8d4183ef1d1479a787339272db362349bdffc4f0235667a9c7daf8a962c8c641c12fd90277e0c4af8dbe04d
TLSH
T13761DF313375B1D889163F07192C19C463BF8756FA94AF4CB658624ED92704B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 517eb538d16da1be57be56ea12ddecc6997abd756d8b240c2f465e76116ded21
MD5 9b17b3d1820f14a9d55bece5a11fb515
SHA1 449377920eb9703b74cd13b76beee93d46cae63f
SHA512 ec86112ddfa5b03b474fa75043703dbf0921247b034f4f36a8b007aed5eab569d0a665188e503af814ca00d2242bdf08bc3845fd8a7ec47cde3a79e9d0cd84ce
TLSH
T16D21A833B39CC135C89A117A108DAD00B1B5C3CB009ECECB7A84C108D53F58ADB641E0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2t5jhx0v.d2u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2t5jhx0v.d2u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tfbldsyntejfkztogvz

Path C:\Users\Admin\AppData\Local\Temp\tfbldsyntejfkztogvz
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Name_File.js

Path C:\Users\Public\Downloads\Name_File.js
Size 16KB
SHA256 df4c77e19109b83fff25175d0cffcaee8ce74306df86df5cdbe58e4cd8b95b3c
MD5 ee518ca859a00f1f061cbc9a75326f8e
SHA1 bada5b55c9c2529fea7fa707464599b990b1944d
SHA512 d7db93bbc2bc8f074917acf2e4e129fb1989fe2841794217b7091935ba08463df210665ef569f19278d8e32511d5ebf88172b7589cded432057b0187fd85a75f
SSDEEP 192:p1ihqcev3No43G5AoGZ8rWoiDIej0saQHtlWsAB8vfBQ3fi5Egp2g:pKfi5Egp2g
TLSH
T1AB7258AFCC040A6E2D6C612786FB447BA67B71E2F0A36A41704C5477FA95D83F448B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1956-73-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2140-33-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2140-39-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2148-1-0x00000229FD760000-0x00000229FD76C000-memory.dmp

Download

memory/2464-62-0x000001841DC80000-0x000001841DC8C000-memory.dmp

Download

memory/2844-99-0x0000027DE5670000-0x0000027DE567C000-memory.dmp

Download

memory/2844-101-0x0000027DE7160000-0x0000027DE7172000-memory.dmp

Download

memory/2844-100-0x0000027DFF570000-0x0000027DFF65A000-memory.dmp

Download

memory/2852-35-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2852-34-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2984-88-0x000001BAAFB60000-0x000001BAAFB6C000-memory.dmp

Download

memory/3016-58-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-48-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3016-26-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-27-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-28-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-29-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-30-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-31-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-97-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-85-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-20-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-25-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-84-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-14-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-44-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3016-15-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-47-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3016-16-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-49-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-50-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-51-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-52-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-53-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-54-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-55-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-56-0x0000000003220000-0x00000000032FA000-memory.dmp

Download

memory/3016-21-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3016-59-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3256-76-0x0000029A7D060000-0x0000029A7D14A000-memory.dmp

Download

memory/3256-77-0x0000029A64A00000-0x0000029A64A12000-memory.dmp

Download

memory/3256-75-0x0000029A64950000-0x0000029A6495C000-memory.dmp

Download

memory/3948-23-0x000001654A900000-0x000001654A9EA000-memory.dmp

Download

memory/3948-12-0x000001654A8E0000-0x000001654A8EA000-memory.dmp

Download

memory/3948-13-0x000001654A8F0000-0x000001654A900000-memory.dmp

Download

memory/3948-22-0x00000165321F0000-0x00000165321FC000-memory.dmp

Download

memory/3948-24-0x00000165322C0000-0x00000165322D2000-memory.dmp

Download

memory/3948-11-0x000001654B030000-0x000001654B152000-memory.dmp

Download

memory/3948-19-0x000001654A8F0000-0x000001654A900000-memory.dmp

Download

memory/3948-10-0x000001654A8F0000-0x000001654A900000-memory.dmp

Download

memory/3948-8-0x000001654A860000-0x000001654A882000-memory.dmp

Download

memory/3948-2-0x000001654A8F0000-0x000001654A900000-memory.dmp

Download

memory/5048-42-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/5048-32-0x0000000000400000-0x000000000047E000-memory.dmp

Download