remcos | 605cc5f93c3a7ec39fe690cb72c107748d1a9fc7323f1a75c73c8fb91a0d8d4c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpx18zki_f.exe
Size 4.6MB
Sample260601-2qecqagw2x
SHA256 605cc5f93c3a7ec39fe690cb72c107748d1a9fc7323f1a75c73c8fb91a0d8d4c
MD5 08c0af10a16f9060abba8f5b55a3fd84
SHA1 eb50c59b57197f36bf4f0049ca4a685cfeb64c2b
SHA512 40f5f629969493429887f67ffa1e658d4c67a47bed835164c3bf0d3f2900692de8afd4b63aac740ed45ec7fb274ffc31aa04694b0e5c06efdb805c519ba16c26
SSDEEP 98304:quADeXoI2ibAJjo6xpKfdwFyF8gB+oXigMl/bwG:qVYOjHUfdwYF5i9sG
TLSH
T14326F102637B5A6AA4467FF464845CF299DFA0AC8A3C44C42FD631EDDE3E75813B8193
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

giga discovery remcos rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

GIGA

3xe94lqhph0janx.ru:4404
399i6fi7voahk2g.xyz:4404
zl5uyooepo2sqez.info:4404
5ow86mh1sf1l1mr.ru:4404
dcws2kksik85f288.xyz:4404
gd92nof7quuu2l.ru:4404
vdbto19wogzzu.info:4404
xvhjuqq1skbs0bo.info:4404
jqni1my7489jkmb.ru:4404
cteu48n17qjpwv4.ru:4404
wv5hvbijspasvvi.info:4404
5bwfdr9ipmxb0qq.ru:4404
n8hoie32bkdpfd7.info:4404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
kkYMs
keylog_path
%AppData%
mouse_option
false
mutex
-6HHM6H
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FilePrK.url	tmpx18zki_f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 2180	3308	tmpx18zki_f.exe	100

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpx18zki_f.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3308	tmpx18zki_f.exe
3308	tmpx18zki_f.exe
3308	tmpx18zki_f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	RegAsm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3840	3308	tmpx18zki_f.exe	98
PID 3308 wrote to memory of 776	3308	tmpx18zki_f.exe	99
PID 3308 wrote to memory of 2180	3308	tmpx18zki_f.exe	100

C:\Users\Admin\AppData\Local\Temp\tmpx18zki_f.exe
"C:\Users\Admin\AppData\Local\Temp\tmpx18zki_f.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\kkYMs\logs.dat
Size 74B
SHA256 d4cd2f7748c42612f892a48204e0a78167d2e4fe711f12ea7acf8b2431506a59
MD5 e3d36f3390ebcdf5c7749e7ac95d0beb
SHA1 c2db462aee3e5456503cb8458fac2262c78df3be
SHA512 a7bd77f5edcbed52ef2bcef73eb8a6175c30c56ce402fae733809c00ef62d9477f196842cdacef61cd297c0deb5ba72d62bad1c83c71b12d25b8a18573b718c1
TLSH
T13CA0240347CC45D1350D01D7D4C0C3405341D0C7400D04CC55D3140F0010C7D013F0CC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2180-14-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2180-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2180-10-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2180-12-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2180-13-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2180-17-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2180-19-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3308-2-0x0000000005BB0000-0x0000000005BDE000-memory.dmp

Download

memory/3308-5-0x0000000005D70000-0x0000000005D80000-memory.dmp

Download

memory/3308-6-0x00000000036A0000-0x00000000036A3000-memory.dmp

Download

memory/3308-0-0x0000000000E20000-0x00000000012BA000-memory.dmp

Download

memory/3308-1-0x0000000005D70000-0x0000000005D80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads