remcos | 1be60c0ee4391656d012b49effccebc93cab23473d48bd91e9249042b4115da7

Analysis

max time kernel
298s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
262000734342.bat
Size 1.0MB
Sample260516-edkmmsax6x
SHA256 1be60c0ee4391656d012b49effccebc93cab23473d48bd91e9249042b4115da7
MD5 d0cffdf3ea3c5817ee6e647f645820f8
SHA1 064cd9eb40ca31696619067f8f290a8023d3f8f1
SHA512 0397fa1942c235bef9c25e4265b7fdfa47bd2d294f91254334d4b7d8f6a787d849704dc31a93bbff3d5415b88af47fab87c4e1453ba56475d74e469d57413cee
SSDEEP 24576:c36XkKXvym3I6amhfRhhhNLkUA4RTsW7qYzz:c3emsdPRT97qI
TLSH
T14B35237C85DD23DA0810B79EB58BA51431D923D50A87534303AE83F833BD6E9AA776F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery execution remcos rat suricata

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

RemoteHost

taivvans.ydns.eu:63921
taivvan.ydns.eu:63099

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TSLEW1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 12 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 14 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
36	1928	MSBuild.exe
36	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe
35	1928	MSBuild.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/1240-97-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3528	powershell.exe
4424	powershell.exe
1520	powershell.exe
3212	powershell.exe
3032	powershell.exe
3476	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3528 set thread context of 1928	3528	powershell.exe	117
PID 1928 set thread context of 3216	1928	MSBuild.exe	119
PID 1928 set thread context of 2984	1928	MSBuild.exe	120
PID 1928 set thread context of 1240	1928	MSBuild.exe	121

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	where.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1520	powershell.exe
1520	powershell.exe
3212	powershell.exe
3212	powershell.exe
3032	powershell.exe
3032	powershell.exe
4424	powershell.exe
4424	powershell.exe
3476	powershell.exe
3476	powershell.exe
3528	powershell.exe
3528	powershell.exe
3216	userinit.exe
3216	userinit.exe
1240	userinit.exe
1240	userinit.exe
3216	userinit.exe
3216	userinit.exe
3216	userinit.exe
3216	userinit.exe
3216	userinit.exe
3216	userinit.exe
3216	userinit.exe
3216	userinit.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	1240	userinit.exe
Token: SeImpersonatePrivilege	3216	userinit.exe
Token: SeImpersonatePrivilege	3216	userinit.exe
Token: SeImpersonatePrivilege	3216	userinit.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1520	4744	cmd.exe	86
PID 1520 wrote to memory of 2912	1520	powershell.exe	88
PID 2912 wrote to memory of 1176	2912	cmd.exe	90
PID 1176 wrote to memory of 3184	1176	cmd.exe	91
PID 2912 wrote to memory of 1448	2912	cmd.exe	93
PID 1448 wrote to memory of 4940	1448	cmd.exe	94
PID 2912 wrote to memory of 2548	2912	cmd.exe	95
PID 2548 wrote to memory of 4164	2548	cmd.exe	96
PID 2912 wrote to memory of 3212	2912	cmd.exe	97
PID 2912 wrote to memory of 3032	2912	cmd.exe	98
PID 2912 wrote to memory of 4424	2912	cmd.exe	99
PID 4424 wrote to memory of 216	4424	powershell.exe	100
PID 216 wrote to memory of 2756	216	cmd.exe	102
PID 216 wrote to memory of 2256	216	cmd.exe	103
PID 2256 wrote to memory of 1376	2256	cmd.exe	104
PID 216 wrote to memory of 4448	216	cmd.exe	105
PID 4448 wrote to memory of 4188	4448	cmd.exe	106
PID 216 wrote to memory of 3476	216	cmd.exe	107
PID 216 wrote to memory of 3528	216	cmd.exe	116
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 3528 wrote to memory of 1928	3528	powershell.exe	117
PID 1928 wrote to memory of 3216	1928	MSBuild.exe	119
PID 1928 wrote to memory of 2984	1928	MSBuild.exe	120
PID 1928 wrote to memory of 1240	1928	MSBuild.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "$q=[char]34;$a='/c '+$q+$q+$env:_BSelf+$q+$q+' c25be92ac5d9';$i=New-Object System.Diagnostics.ProcessStartInfo('cmd',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\262000734342.bat"" c25be92ac5d9
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:3184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
        5⤵
        
        PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
        5⤵
        
        PID:4164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\262000734342.bat' -Tail 13942 | Select-Object -First 25 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\2399911486.ps1' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\262000734342.bat' -Tail 13916 -Encoding UTF8 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\1639718247.b64' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\2399911486.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ol4lftp4tea.bat" __hidden
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:216
      - C:\Windows\SysWOW64\where.exe
        
        where powershell.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\ol4lftp4tea.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\find.exe
        
        find /c /v ""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\ol4lftp4tea.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\ol4lftp4tea.bat"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\ol4lftp4tea.bat' -Tail 57 -Encoding UTF8 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\t_payload_44542490124789263124213.ps1' -Encoding UTF8"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t_payload_44542490124789263124213.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suricata alert: REMCOS RAT Malware Inbound C2 Communication
        Suricata alert: REMCOS RAT Malware Outbound C2 Communication
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\tevgu"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\dgbyuehpj"
        8⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        outlook_office_path
        
        PID:2984
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\fagrnwrjxjpo"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
TLSH
T1A7416A303125B5D84D435F5308286ED663EF8749ABA89F5CB969221DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download