remcos | d550de93da7329aec21aeb9cb81edf335dc42507d53d0367445c15180737089f

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpbz1q1p0l.exe
Size 515KB
Sample260524-2t82hagy6k
SHA256 d550de93da7329aec21aeb9cb81edf335dc42507d53d0367445c15180737089f
MD5 88c33ee177ba69de067e7eea4156fef3
SHA1 bad02adb549bc4aabb8a998c73e1f8462e18871f
SHA512 868020462fff001826070a1b938e42c0f444e913bc6c2cdc7c4b06fcbcdd330fb2857a26f3a455b205aec2b9e019efeb7f2bef2a2779afab051e711a6cb56f6c
SSDEEP 6144:bXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBcew:rENlHV9FGeDWv3jADnyYiCNrsPZ0S
TLSH
T163B4BF01B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 10 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
4	2644	tmpbz1q1p0l.exe
7	2644	tmpbz1q1p0l.exe
7	2644	tmpbz1q1p0l.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1900-5-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 4644	2644	tmpbz1q1p0l.exe	88
PID 2644 set thread context of 5068	2644	tmpbz1q1p0l.exe	89
PID 2644 set thread context of 1900	2644	tmpbz1q1p0l.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpbz1q1p0l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4644	userinit.exe
4644	userinit.exe
1900	userinit.exe
1900	userinit.exe
4644	userinit.exe
4644	userinit.exe
4644	userinit.exe
4644	userinit.exe
4644	userinit.exe
4644	userinit.exe
4644	userinit.exe
4644	userinit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	userinit.exe
Token: SeImpersonatePrivilege	4644	userinit.exe
Token: SeImpersonatePrivilege	4644	userinit.exe
Token: SeImpersonatePrivilege	4644	userinit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2644	tmpbz1q1p0l.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4644	2644	tmpbz1q1p0l.exe	88
PID 2644 wrote to memory of 5068	2644	tmpbz1q1p0l.exe	89
PID 2644 wrote to memory of 1900	2644	tmpbz1q1p0l.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Users\Admin\AppData\Local\Temp\tmpbz1q1p0l.exe
"C:\Users\Admin\AppData\Local\Temp\tmpbz1q1p0l.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\vsskgaehxlbdpoqvdkdkpzodik"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\guxchspilttiruezmvqlaeimrqmlp"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - outlook_office_path
  PID:5068
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\qocvilaczclncjaldgkndrvdsfeurltsx"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vsskgaehxlbdpoqvdkdkpzodik

Path C:\Users\Admin\AppData\Local\Temp\vsskgaehxlbdpoqvdkdkpzodik
Size 4KB
SHA256 b5c20538b491064821c2122b3fa0e0a1f083bbccd3ad5836ca8f3685ae8ef32d
MD5 49c1239cc43e540b5b1b3b1e455ee2e0
SHA1 3ac9b27b0d5ee072581c6f5d71ae01360b36fbc9
SHA512 60520de386282eef62a5b8d00418823fd29466677ce7dd19b764804e3bf5e9969b927fec29a7e2300b5b657b42691b35398af047168cd8777a65073f8cbf9a03
SSDEEP 48:wvvv02xfvvc2xfdvv02xBvv02xakvv027:mvrxvDp1vrPvrbvr7
TLSH
T1BC916A0712E90448F0B2BA46D97721B65BB338199CBC815C61ECA3D90BE7910DAE37D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-2-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1900-5-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2644-11-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2644-16-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2644-15-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2644-14-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2644-19-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4644-9-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/5068-1-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5068-7-0x0000000000400000-0x000000000045E000-memory.dmp

Download