remcos | ce1285f6f87bfc3c2a7f51f1f9f4829d94fed5504f9b892f7e2a62b6b4acf4bc

Analysis

max time kernel
149s
max time network
120s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Juniorer.exe
Size 462KB
Sample260422-pva5msft7l
SHA256 ce1285f6f87bfc3c2a7f51f1f9f4829d94fed5504f9b892f7e2a62b6b4acf4bc
MD5 938db4df6a0e927f4f41b0a31217581c
SHA1 2f35709941e29f6f40605634b2fcfc54d3cc95f6
SHA512 c5b80505411125289e81a8b5aae25b59067916146e79c214b0774979361c5b2b33e4f29c924f8ef78179b781fcadb420d083d197d1f4125cc03aeba9f6652f3d
SSDEEP 12288:5TA+Q4NwA7qpMVZhWCxScT+6Vt0SGZNu49ezMgIz:5TAP4Nwvojx7T+kuu8eAgIz
TLSH
T1EBA4231023E6F852ED6306751B3B6AF766B978605179470F23957EAF39B0B80E02EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos rat

Malware Config

Extracted

Family

remcos

Version

7.2.3 Pro

Botnet

RemoteHost

192.3.45.9:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-H7HOFF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 2 IoCs

pid	Process
3280	Juniorer.exe
3280	Juniorer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4116	Juniorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3280	Juniorer.exe
4116	Juniorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\cablet\formlingen.ini	Juniorer.exe
File opened for modification	C:\Windows\resources\0409\Sleyed\bortelimeneres.htm	Juniorer.exe
File created	C:\Windows\resources\Feverously\cigarettnderens.lnk	Juniorer.exe
File opened for modification	C:\Windows\Fonts\klys\radiostationers.gif	Juniorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4280	4116	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Juniorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Juniorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3280	Juniorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4116	Juniorer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4116	Juniorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2320	3280	Juniorer.exe	79
PID 3280 wrote to memory of 4116	3280	Juniorer.exe	80
PID 3280 wrote to memory of 4116	3280	Juniorer.exe	80
PID 4116 wrote to memory of 2432	4116	Juniorer.exe	81

C:\Users\Admin\AppData\Local\Temp\Juniorer.exe
"C:\Users\Admin\AppData\Local\Temp\Juniorer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\Juniorer.exe
  "C:\Users\Admin\AppData\Local\Temp\Juniorer.exe"
  2⤵
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\Juniorer.exe
  "C:\Users\Admin\AppData\Local\Temp\Juniorer.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Juniorer.exe
    "C:\Users\Admin\AppData\Local\Temp\Juniorer.exe"
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1968
    3⤵
    - Program crash
    PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4116 -ip 4116
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd5A.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsi7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi7A.tmp
Size 60B
SHA256 a8131e5fa3f1e8a7e35a248fb3da529eb2885731ca6687bac3278f53a698850c
MD5 15b80dc3d729ab1abd2b7dd56f15dfbb
SHA1 38f2c2a96b7a3b7a2092956ba1cd28d93f7f44f4
SHA512 43cc514b05da8854292008e536e5860902847998f9d2cfce883aae0d3d5bedbe74db9a55ae1c33933af4f9cef40a103cac49a306f88550109397e96c7dc969fc
TLSH
T1E2A0025635814664FD82C4711B65700CE59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsi7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi7A.tmp
Size 66B
SHA256 cc1c32ae1abcb46fd4871832a8b7a51a440905d97709c53e66d16a0cd33276ee
MD5 3a055708070979e7bf5088d9471320ba
SHA1 cb4e803ae05765ee43787cbd3abb91166bbf8fd7
SHA512 3f3b5c9c1fdca9e76fda76ff601d11320b4866ee0b0358b014699e33be79252cb94390fb589fa5099b68d00491a207f3fe6223b955a5a4be6f1df1b389fd613e
TLSH
T17DA00256358156A4FEC2C4711F65700CE59D303600C544032A4D48889D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsi7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi7A.tmp
Size 13B
SHA256 bebca67508315817f99b0580d446f7c1e89f6ae4d56b362d2ebb446046104dcc
MD5 968d5ad691d2a0ccc23d4e410546d745
SHA1 cd5f5f16097f4ced99c2e11f75c3c3b4b891416a
SHA512 e1f2d970247ae1f749b6561855006748fc0c7d0b58949d58186e423324ef77f381485e9a6603027366d67454cf6b20d40fb03da385da56a5f5336c7847d0e6c6
MD5 SHA1 SHA512

Submit Download

nsi7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi7A.tmp
Size 26B
SHA256 0092de36b51381e4fe5e613bdbae906f0c6e8691fec4a93f82b876f1af826648
MD5 bc970bd8ec8acf8ac1ada9e444673a39
SHA1 6c03dfa1c2595129e8e0e2428fceb0f2df7f82a7
SHA512 c3fc2d8b396b6753759b532bb9e91d015a039476ec2cf8abcd4c6d4d32b9305146752743692486bd4e3984325a7e9c6db0ff4d902c2879993789573f9cdca3b0
MD5 SHA1 SHA512

Submit Download

nst156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst156.tmp
Size 4B
SHA256 65e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
MD5 cde63b34c142af0a38cbe83791c964f8
SHA1 ece2b194b486118b40ad12c1f0e9425dd0672424
SHA512 0559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
MD5 SHA1 SHA512

Submit Download

nst156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst156.tmp
Size 8B
SHA256 1c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
MD5 c3cb69218b85c3260387fb582cb518dd
SHA1 961c892ded09a4cbb5392097bb845ccba65902ad
SHA512 2402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
MD5 SHA1 SHA512

Submit Download

nst156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst156.tmp
Size 21B
SHA256 eab17e5beb38bc1247e1ead36f0e79f33d5270762274ed3448466a4ca8c73781
MD5 0521eadb06f132deee2ee228f5727dff
SHA1 9e0937d6e29af1825d50cdca0d79a6daaa9892af
SHA512 2ed2ad97d29cdb5e63095ea933f582bda96190a8b7ac47772b68240a338d4bb8b22301f537c5391a2b8e981cb4f4d8f3de1958634e44a78d1f4946680b669fc5
MD5 SHA1 SHA512

Submit Download

nst156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst156.tmp
Size 32B
SHA256 05ec837bf0f57ead1b3fae5bec24f103831be6946eda1fe4cec3700ae019b117
MD5 749841d5d4f33aa61da2072ca8c75d85
SHA1 ed779369af6004bb662353a1a1688de21c9d5964
SHA512 07884f39b2b1646dbad182d39167df36cb86fd3751b5c125b84ab3b3594dd0f6884d73f7f65d099e2874a0a73f8a76d7610b3ab30e174945a70073176e07b886
MD5 SHA1 SHA512

Submit Download

nst156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst156.tmp
Size 38B
SHA256 1feb2f5544655440d6bdf724776f3fc7b9c9dfb226fe96385423579e03954626
MD5 874eecec3fc35024420ce6005d6991bf
SHA1 743f31a53191481b4d1e95cc5d4330c123e69a0a
SHA512 b5b5ecceeb820a519b3bd277265ed874def5a0a16d1a13af5d60e709cc7e8c8fdfd7a7b7ba694943d00e7a30fb9c267258fd1ed57418c5187acb42177bbe6c6c
MD5 SHA1 SHA512

Submit Download

nst1F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1F3.tmp
Size 1B
SHA256 8254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
MD5 8ce4b16b22b58894aa86c421e8759df3
SHA1 13fbd79c3d390e5d6585a21e11ff5ec1970cff0c
SHA512 2af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25
MD5 SHA1 SHA512

Submit Download

nst1F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1F3.tmp
Size 5B
SHA256 ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
MD5 e2fecc970546c3418917879fe354826c
SHA1 63f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA512 3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
MD5 SHA1 SHA512

Submit Download

nst1F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1F3.tmp
Size 27B
SHA256 92bbc71aa04b34f3d6666861e615244db3d3be6f1287b3947115ea9d0e98a5d7
MD5 a4fef08db3bf7402436db287f01bb2fc
SHA1 66c9356fcc83fdda2e04821fa06ab8bee4f26720
SHA512 3da695803076c9b338d9fac3d9da91ac8e0f8b4fb28665ad175325684a5688e83f56bff62766d99583ea9b2a0e394ad64f4fff3fc45b3fe154e6b4026ef7a44a
MD5 SHA1 SHA512

Submit Download

nsz2B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz2B0.tmp
Size 2B
SHA256 8e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc
MD5 25bc6654798eb508fa0b6343212a74fe
SHA1 15d5e1d3b948fd5986aaff7d9419b5e52c75fc93
SHA512 5868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898
MD5 SHA1 SHA512

Submit Download

nsz2B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz2B0.tmp
Size 6B
SHA256 6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
MD5 50484c19f1afdaf3841a0d821ed393d2
SHA1 c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA512 d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
MD5 SHA1 SHA512

Submit Download

nsz2B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz2B0.tmp
Size 9B
SHA256 ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
MD5 2b3884fe02299c565e1c37ee7ef99293
SHA1 d8e2ef2a52083f6df210109fea53860ea227af9c
SHA512 aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
MD5 SHA1 SHA512

Submit Download

nsz2B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz2B0.tmp
Size 10B
SHA256 a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
MD5 9a53fc1d7126c5e7c81bb5c15b15537b
SHA1 e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA512 b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
MD5 SHA1 SHA512

Submit Download

memory/3280-564-0x0000000074395000-0x0000000074396000-memory.dmp

Download

memory/4116-565-0x0000000077688000-0x0000000077689000-memory.dmp

Download

memory/4116-566-0x000000007771B000-0x000000007771C000-memory.dmp

Download

memory/4116-567-0x000000007769B000-0x000000007769C000-memory.dmp

Download

memory/4116-569-0x0000000036C20000-0x0000000036C84000-memory.dmp

Download

memory/4116-568-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/4116-570-0x000000007771B000-0x000000007771C000-memory.dmp

Download

memory/4116-594-0x0000000036C20000-0x0000000036C84000-memory.dmp

Download

memory/4116-593-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/4116-595-0x00000000775F1000-0x0000000077713000-memory.dmp

Download

memory/4116-589-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/4116-596-0x0000000037FA0000-0x0000000038092000-memory.dmp

Download

memory/4116-599-0x0000000037FA0000-0x0000000038092000-memory.dmp

Download

memory/4116-601-0x0000000036C20000-0x0000000036C84000-memory.dmp

Download

memory/4116-600-0x0000000000480000-0x0000000001797000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads