remcos | e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039.exe
Size 137KB
Sample260506-zktjcaat6y
SHA256 e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039
MD5 9e13f56a730beb65c58d1969d7a557ce
SHA1 02670152ef0b0fa68df1fbd723fafe47b918d647
SHA512 0427812345f93df0600a593f27d6fd2f6dd3c99561743433b053c52edc5a667d48c0a226f13c6319660d0580c4cdad0141c52b44a615d359799602b2a4f7ceb7
SSDEEP 1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKv:xPd4n/M+WLcilrpgGH/GwY87mVmIX4+
TLSH
T1B1D302007653C3B2E9D2663B441809599277F30176ABAB2F388C326CCE573D73B616E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

host discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
OfficeUpgrade.exe
copy_folder
OfficeUpgrade
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
Upgrader.dat
keylog_flag
false
keylog_folder
Upgrader
keylog_path
%AppData%
mouse_option
false
mutex
req_khauflaoyr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
OfficeUpgrade
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 3 IoCs

pid	Process
4548	wn2ra4ohzdr.exe
3388	wn2ra4ohzdr.exe
1336	wn2ra4ohzdr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe"	e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 1336	3388	wn2ra4ohzdr.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	wn2ra4ohzdr.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 3388	5784	e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039.exe	81
PID 4548 wrote to memory of 1992	4548	wn2ra4ohzdr.exe	82
PID 3388 wrote to memory of 1336	3388	wn2ra4ohzdr.exe	83
PID 3388 wrote to memory of 1336	3388	wn2ra4ohzdr.exe	83
PID 3388 wrote to memory of 1336	3388	wn2ra4ohzdr.exe	83
PID 3388 wrote to memory of 1336	3388	wn2ra4ohzdr.exe	83
PID 3388 wrote to memory of 1336	3388	wn2ra4ohzdr.exe	83
PID 3388 wrote to memory of 1336	3388	wn2ra4ohzdr.exe	83

C:\Users\Admin\AppData\Local\Temp\e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039.exe
"C:\Users\Admin\AppData\Local\Temp\e279f9095614f4d0617c33fd41b8a02802e6b0001a9edf5fe16409a93bd2c039.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
  "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
    "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1336

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
  "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
  2⤵
  PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wn2ra4ohzdr.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wn2ra4ohzdr.exe.log
Size 1KB
SHA256 c9c03abe98c496376975747c9b617f5f6e1b50aec09aa8be31aa24e81254901f
MD5 ac45cc773216001c355992d869450b47
SHA1 1f19c3839b521e1bf1ec7928f32f45234f38ea40
SHA512 3d73620a59089bc05d60ae07f0811ddacd1661599eca096cd9927813f86dc9cebac1de221691373601c743250694de43e408a9e607e813fb28260b1509f84574
TLSH
T155216A303231B5D84D422F5308586AC526FF0745BAA8EF2CB599335EDD2A007AF222E3
MD5 SHA1 SHA512 TLSH

Submit Download

wn2ra4ohzdr.exe

Path C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
Size 137KB
SHA256 948c37fb5ac2da8bb73e86422a0a5c6700d7d5511ee4979ed1792496ae87587c
MD5 f9bef325ee892803e7d0ee4fc46e4990
SHA1 d7a56696240455580c547776bea84804306e6d48
SHA512 671ab368fddaa6e961600b4920ffb88cdae444474978171a5bd032379f2638044bbf41f05f2f327f7d485b712cc33b010f0094529efcb211c585f4d887767db7
SSDEEP 1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKY:xPd4n/M+WLcilrpgGH/GwY87mVmIX4h
TLSH
T144D302007653D3B2E9D2663B451809599277F30176ABAB2F388C326CCE573D73B616E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-16-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1336-30-0x0000000001710000-0x000000000199B000-memory.dmp

Download

memory/1336-21-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1336-15-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1336-20-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1336-14-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1336-17-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3388-29-0x0000000004DF0000-0x000000000507B000-memory.dmp

Download

memory/3388-25-0x0000000004DF0000-0x000000000507B000-memory.dmp

Download

memory/4548-24-0x0000000005330000-0x00000000055BB000-memory.dmp

Download

memory/4548-10-0x0000000005330000-0x00000000055BB000-memory.dmp

Download

memory/4548-27-0x0000000005330000-0x00000000055BB000-memory.dmp

Download

memory/5784-13-0x0000000005050000-0x00000000052DB000-memory.dmp

Download

memory/5784-5-0x0000000005F70000-0x0000000005F90000-memory.dmp

Download

memory/5784-0-0x00000000006A0000-0x00000000006C8000-memory.dmp

Download

memory/5784-4-0x00000000054C0000-0x00000000054CA000-memory.dmp

Download

memory/5784-3-0x0000000005560000-0x0000000005570000-memory.dmp

Download

memory/5784-2-0x0000000005410000-0x00000000054A2000-memory.dmp

Download

memory/5784-1-0x00000000059C0000-0x0000000005F66000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads