remcos | d550de93da7329aec21aeb9cb81edf335dc42507d53d0367445c15180737089f

Analysis

max time kernel
149s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/05/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpbz1q1p0l.exe
Size 515KB
Sample260524-2t82hagy6k
SHA256 d550de93da7329aec21aeb9cb81edf335dc42507d53d0367445c15180737089f
MD5 88c33ee177ba69de067e7eea4156fef3
SHA1 bad02adb549bc4aabb8a998c73e1f8462e18871f
SHA512 868020462fff001826070a1b938e42c0f444e913bc6c2cdc7c4b06fcbcdd330fb2857a26f3a455b205aec2b9e019efeb7f2bef2a2779afab051e711a6cb56f6c
SSDEEP 6144:bXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBcew:rENlHV9FGeDWv3jADnyYiCNrsPZ0S
TLSH
T163B4BF01B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 10 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
4	5092	tmpbz1q1p0l.exe
6	5092	tmpbz1q1p0l.exe
6	5092	tmpbz1q1p0l.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/4892-4-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key opened	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 3748	5092	tmpbz1q1p0l.exe	82
PID 5092 set thread context of 2268	5092	tmpbz1q1p0l.exe	84
PID 5092 set thread context of 4892	5092	tmpbz1q1p0l.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpbz1q1p0l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3748	userinit.exe
3748	userinit.exe
4892	userinit.exe
4892	userinit.exe
3748	userinit.exe
3748	userinit.exe
3748	userinit.exe
3748	userinit.exe
3748	userinit.exe
3748	userinit.exe
3748	userinit.exe
3748	userinit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	userinit.exe
Token: SeImpersonatePrivilege	3748	userinit.exe
Token: SeImpersonatePrivilege	3748	userinit.exe
Token: SeImpersonatePrivilege	3748	userinit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5092	tmpbz1q1p0l.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3748	5092	tmpbz1q1p0l.exe	82
PID 5092 wrote to memory of 2740	5092	tmpbz1q1p0l.exe	83
PID 5092 wrote to memory of 2268	5092	tmpbz1q1p0l.exe	84
PID 5092 wrote to memory of 4892	5092	tmpbz1q1p0l.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Users\Admin\AppData\Local\Temp\tmpbz1q1p0l.exe
"C:\Users\Admin\AppData\Local\Temp\tmpbz1q1p0l.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\osainwjqyxhnnwctdvsytm"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\zmfsooujlfzsqcqwugeswqkyy"
  2⤵
  PID:2740
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\zmfsooujlfzsqcqwugeswqkyy"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - outlook_office_path
  PID:2268
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\joslohflznrxaqnadirthdxphclui"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

osainwjqyxhnnwctdvsytm

Path C:\Users\Admin\AppData\Local\Temp\osainwjqyxhnnwctdvsytm
Size 4KB
SHA256 d75ca667f85ae6603921f231f2ed0e69130088c771f19ecba53eab3cefc48945
MD5 77a56ed5b8f4b626d431b4da50bf8220
SHA1 53b92e1e95b6e31171fc907cb91355d98a21e05b
SHA512 c19d951a8b7bb1672746a8abd0bc1785fbb0e2c37cd59fa55a5a595ad3d820a99608111726792c5f14e06007bfa67374d516ef2d7e6c4613811ec8c8d47f1530
SSDEEP 48:wvvv0exfvvcexfdvv0exBvv0exakvv0e7:mvjxvLp1vjPvjbvj7
TLSH
T149914A4712F90448F0B2BA46D97725B65B7338189CBC815C61ECA3E80BE3914DAE37D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-8-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2740-1-0x0000000000470000-0x00000000004CE000-memory.dmp

Download

memory/3748-0-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3748-10-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4892-3-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4892-4-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5092-12-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5092-15-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5092-16-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5092-17-0x00007FFCAE870000-0x00007FFCAEA68000-memory.dmp

Download