remcos | 1be60c0ee4391656d012b49effccebc93cab23473d48bd91e9249042b4115da7

Analysis

max time kernel
298s
max time network
283s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
262000734342.bat
Size 1.0MB
Sample260516-edkmmsax6x
SHA256 1be60c0ee4391656d012b49effccebc93cab23473d48bd91e9249042b4115da7
MD5 d0cffdf3ea3c5817ee6e647f645820f8
SHA1 064cd9eb40ca31696619067f8f290a8023d3f8f1
SHA512 0397fa1942c235bef9c25e4265b7fdfa47bd2d294f91254334d4b7d8f6a787d849704dc31a93bbff3d5415b88af47fab87c4e1453ba56475d74e469d57413cee
SSDEEP 24576:c36XkKXvym3I6amhfRhhhNLkUA4RTsW7qYzz:c3emsdPRT97qI
TLSH
T14B35237C85DD23DA0810B79EB58BA51431D923D50A87534303AE83F833BD6E9AA776F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery execution remcos rat suricata

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

RemoteHost

taivvans.ydns.eu:63921
taivvan.ydns.eu:63099

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TSLEW1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 12 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 14 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
2	5756	MSBuild.exe
3	5756	MSBuild.exe
3	5756	MSBuild.exe

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3188-92-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3188-95-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
572	powershell.exe
752	powershell.exe
5004	powershell.exe
4260	powershell.exe
3360	powershell.exe
5056	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key queried	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 752 set thread context of 5756	752	powershell.exe	102
PID 5756 set thread context of 2960	5756	MSBuild.exe	105
PID 5756 set thread context of 1552	5756	MSBuild.exe	106
PID 5756 set thread context of 3188	5756	MSBuild.exe	107

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	where.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5004	powershell.exe
5004	powershell.exe
3360	powershell.exe
3360	powershell.exe
5056	powershell.exe
5056	powershell.exe
572	powershell.exe
572	powershell.exe
4260	powershell.exe
4260	powershell.exe
752	powershell.exe
752	powershell.exe
2960	userinit.exe
2960	userinit.exe
3188	userinit.exe
3188	userinit.exe
2960	userinit.exe
2960	userinit.exe
2960	userinit.exe
2960	userinit.exe
2960	userinit.exe
2960	userinit.exe
2960	userinit.exe
2960	userinit.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	3188	userinit.exe
Token: SeImpersonatePrivilege	2960	userinit.exe
Token: SeImpersonatePrivilege	2960	userinit.exe
Token: SeImpersonatePrivilege	2960	userinit.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 5004	3656	cmd.exe	81
PID 5004 wrote to memory of 3212	5004	powershell.exe	82
PID 3212 wrote to memory of 3520	3212	cmd.exe	84
PID 3520 wrote to memory of 3804	3520	cmd.exe	85
PID 3212 wrote to memory of 5772	3212	cmd.exe	86
PID 5772 wrote to memory of 4608	5772	cmd.exe	87
PID 3212 wrote to memory of 3312	3212	cmd.exe	88
PID 3312 wrote to memory of 1536	3312	cmd.exe	89
PID 3212 wrote to memory of 3360	3212	cmd.exe	90
PID 3212 wrote to memory of 5056	3212	cmd.exe	91
PID 3212 wrote to memory of 572	3212	cmd.exe	92
PID 572 wrote to memory of 2416	572	powershell.exe	93
PID 2416 wrote to memory of 4304	2416	cmd.exe	95
PID 2416 wrote to memory of 1444	2416	cmd.exe	96
PID 1444 wrote to memory of 6060	1444	cmd.exe	97
PID 2416 wrote to memory of 2084	2416	cmd.exe	98
PID 2084 wrote to memory of 2036	2084	cmd.exe	99
PID 2416 wrote to memory of 4260	2416	cmd.exe	100
PID 2416 wrote to memory of 752	2416	cmd.exe	101
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 752 wrote to memory of 5756	752	powershell.exe	102
PID 5756 wrote to memory of 5308	5756	MSBuild.exe	103
PID 5756 wrote to memory of 5628	5756	MSBuild.exe	104
PID 5756 wrote to memory of 2960	5756	MSBuild.exe	105
PID 5756 wrote to memory of 1552	5756	MSBuild.exe	106
PID 5756 wrote to memory of 3188	5756	MSBuild.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NonInteractive -Command "$q=[char]34;$a='/c '+$q+$q+$env:_BSelf+$q+$q+' c25be92ac5d9';$i=New-Object System.Diagnostics.ProcessStartInfo('cmd',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\262000734342.bat"" c25be92ac5d9
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:3804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5772
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
        5⤵
        
        PID:4608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3312
    - - C:\Windows\system32\findstr.exe
        
        findstr /n /C:"---BEGIN_ENC---" "C:\Users\Admin\AppData\Local\Temp\262000734342.bat"
        5⤵
        
        PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\262000734342.bat' -Tail 13942 | Select-Object -First 25 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\2411327233.ps1' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\262000734342.bat' -Tail 13916 -Encoding UTF8 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\190518495.b64' -Encoding UTF8"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\2411327233.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\0jse3efvi03.bat" __hidden
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Windows\SysWOW64\where.exe
        
        where powershell.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c find /c /v "" < "C:\Users\Admin\AppData\Local\Temp\0jse3efvi03.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\find.exe
        
        find /c /v ""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\0jse3efvi03.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /n /C:"---BEGIN_PS---" "C:\Users\Admin\AppData\Local\Temp\0jse3efvi03.bat"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\Admin\AppData\Local\Temp\0jse3efvi03.bat' -Tail 57 -Encoding UTF8 | Set-Content 'C:\Users\Admin\AppData\Local\Temp\t_payload_2497264442898383517957.ps1' -Encoding UTF8"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t_payload_2497264442898383517957.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suricata alert: REMCOS RAT Malware Inbound C2 Communication
        Suricata alert: REMCOS RAT Malware Outbound C2 Communication
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\qavksfczbfhqapekzcxbirlbnblabq"
        8⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\qavksfczbfhqapekzcxbirlbnblabq"
        8⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\qavksfczbfhqapekzcxbirlbnblabq"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\auavtxntpnzvcdaoqmkvleykvqcjutadi"
        8⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        outlook_office_path
        
        PID:1552
        
        C:\Windows\SysWOW64\userinit.exe
        
        /stext "C:\Users\Admin\AppData\Local\Temp\dwgnu"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b14b48326a1201fc8b9667201c15392e52f7f5819c2aadafe19cbb72b08be51
MD5 04493ed4421328d5e40252891bfe515a
SHA1 ab8a4e3909ff849549ea989049ed30b490f274e7
SHA512 c8ca89143763a72f4ce8f10ffa2e161b59d41454bad0f71fcb4c7e9c8861a5d99bdc787907761bfb8439afad1f0557a1338bbb1054f5810de807633f515d5a76
TLSH
T1A551CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
TLSH
T13D4159303121B5D80D435F5608286EC9A2FF474ABFAC9F5CB669221DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 65KB
SHA256 a70f354b010f251949df429467e9d75079341b225ad641b8f866e71735fadb91
MD5 4e4bc10977c573e04763797bc26b2069
SHA1 60ccd9c197121df6142ca0a95141ff1ba1c58d9e
SHA512 5105f4032e80ec2a2ae10d8f442b3e3f925ff8b0ca9aad01e15c3c9e2793d98034f0a24fce8525e2e2eebab51155dfe202a7d97ffd45377680d04d2f0cf43fa4
SSDEEP 1536:QflJdvh4iUxTYkzvHgfKQaUpeE711kDa5ikNJ+jH0tNYMTYo3kV3CNBQkj2zMrxY:QflJdvqiUTYkzvHgfKQaUpeE711kDa5C
TLSH
T118639592E9204E75E1A65F3EF15622627C30394690F8113212DC25EFA987D970B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download