remcos | 743280fe2baa5e5aed11227bea476ec869fc141f32ed17363283e6ccf8f84bdd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp6c9_k8i4.exe
Size 482KB
Sample260601-13skfaf19x
SHA256 743280fe2baa5e5aed11227bea476ec869fc141f32ed17363283e6ccf8f84bdd
MD5 43f9edb2245346e81110a2a33c71123a
SHA1 81575ff81a7d160366a8219699958a8dccb5bd5a
SHA512 adbebc635a24547792c58961eabc2620224373a485b4d3b9093e072be3c73387fd3fff1e0dfc1cc7d184ac5332840bf5891ba99dee00dd9948a8c3104a6c1d2b
SSDEEP 12288:fV138TlWU/Gw/lv+4W0HdDIoZ1Y5svZoSS:N13+lWU/l/hyoZ1YQZV
TLSH
T17DA4AE01B6C2C0B2D57634340835E7F6CEBCBD1028B59D7BA3D61EA7FE311909635AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
5	1892	tmp6c9_k8i4.exe
5	1892	tmp6c9_k8i4.exe
3	1892	tmp6c9_k8i4.exe
3	1892	tmp6c9_k8i4.exe
10	1892	tmp6c9_k8i4.exe
10	1892	tmp6c9_k8i4.exe
8	1892	tmp6c9_k8i4.exe
8	1892	tmp6c9_k8i4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6c9_k8i4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1892	tmp6c9_k8i4.exe

C:\Users\Admin\AppData\Local\Temp\tmp6c9_k8i4.exe
"C:\Users\Admin\AppData\Local\Temp\tmp6c9_k8i4.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\color\logs.dat
Size 144B
SHA256 52f3aedfd8a7adb4ade90eb32876dbc5eeaac3b8ac479965325475550b96f784
MD5 2e096231f176b02e5f3fc41f69b242cd
SHA1 fff5ad88447af3989b43f548b18088424ead61f0
SHA512 9861067c23f3feb77129c960f5b89aaa9e31882aa4b2749210abf52d2baac696e0d96b93739cacc4709da06b6bf7ffcba459ce55640cddd3323bf4ad4172dd2e
TLSH
T18EC092AE33E5589A7877B3AA94B300363A72FD95113CD80D61D2038D0AF5A0621817DB
MD5 SHA1 SHA512 TLSH

Submit Download