remcos | cbbb167762cfec157f3dc21333844ca83b16d84407ca96de991ea3d786a74017

Analysis

max time kernel
300s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
希腊 GR-VASSILIOS ALOUMANIS-22-5-2026.js
Size 38KB
Sample260604-erhefaay6p
SHA256 cbbb167762cfec157f3dc21333844ca83b16d84407ca96de991ea3d786a74017
MD5 4efeeed1b83e2d47ebcdd6508e1329de
SHA1 0355cbc74b8d0cebe10e611c28c29f7150ecc554
SHA512 71a8f5843495469106527705e42a632942608707339e52e561a5cf65a0b283cb8ed98c31e3b73ec8db640c1d104019d90152627a68d0a8696244348777b49e3c
SSDEEP 768:90MIJfv1AVw3jczn48pZ+tyOdmYk2ssG9qV3e1PzQssOpeyof7P0h0T/:90MufvqVsj8pOTMYCsG9qg1PGNfj0h0z
TLSH
T16A03A6C836CEB8E09616B2F73D77A0B6FA2E5C81B2C45104FBB5716DF864309D529724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

RemoteHost

www.highgradebastard.com:2404
www.highgradebastardbackup1.com:2404
www.highgradebastardbackup2.com:2404
www.highgradebastardbackup3.com:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-C2Z0XB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5184	wscript.exe
3	5184	wscript.exe
4	5184	wscript.exe
5	5184	wscript.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2272-24-0x0000026144310000-0x0000026144324000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 4392	2272	powershell.exe	88

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 2272	5184	wscript.exe	80
PID 2272 wrote to memory of 2100	2272	powershell.exe	82
PID 2272 wrote to memory of 4228	2272	powershell.exe	83
PID 2272 wrote to memory of 3944	2272	powershell.exe	84
PID 2272 wrote to memory of 5052	2272	powershell.exe	85
PID 2272 wrote to memory of 2204	2272	powershell.exe	86
PID 2272 wrote to memory of 2956	2272	powershell.exe	87
PID 2272 wrote to memory of 4392	2272	powershell.exe	88
PID 2272 wrote to memory of 4392	2272	powershell.exe	88
PID 2272 wrote to memory of 4392	2272	powershell.exe	88
PID 2272 wrote to memory of 4392	2272	powershell.exe	88
PID 2272 wrote to memory of 4392	2272	powershell.exe	88
PID 2272 wrote to memory of 4392	2272	powershell.exe	88
PID 2272 wrote to memory of 4392	2272	powershell.exe	88

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\希腊 GR-VASSILIOS ALOUMANIS-22-5-2026.js"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\HEH2J4YP.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2204
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2956
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HEH2J4YP.ps1

Path C:\Temp\HEH2J4YP.ps1
Size 3.5MB
SHA256 669b9fd45fad51b0e9710c1e981a766f7623c0d9bad1980b3d911341cc75b1c9
MD5 acd862436b355c3377bbc1458d14a09f
SHA1 3def0eccb3dbf1e48c1e8133ffc60778920df6a3
SHA512 da8b02554d69f9bd4668fbf24bba67fb9040e72866563e5db31a29f4014bdef9894550b9fb59b06c7b03f0ca559abab2d5662a36868bfe6a7d6875fbff80711a
SSDEEP 24576:ZppefneN8CQbbk464rWsbIzeqBrFM/Wh4mSBFyi5jKYd+NFhxcG+2HTf+MZ2YcvL:M
TLSH
T16006BFCAD16E44D29C053FC9A8142BC78B2546368A7400283A7F7D898F775FEC15EEE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lm134vny.dgm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lm134vny.dgm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2272-26-0x000002615E210000-0x000002615E220000-memory.dmp

Download

memory/2272-30-0x000002615E210000-0x000002615E220000-memory.dmp

Download

memory/2272-22-0x000002615E210000-0x000002615E220000-memory.dmp

Download

memory/2272-13-0x000002615E210000-0x000002615E220000-memory.dmp

Download

memory/2272-24-0x0000026144310000-0x0000026144324000-memory.dmp

Download

memory/2272-25-0x0000026144320000-0x0000026144326000-memory.dmp

Download

memory/2272-14-0x000002615E210000-0x000002615E220000-memory.dmp

Download

memory/2272-20-0x0000026160F40000-0x0000026160F62000-memory.dmp

Download

memory/4392-27-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/4392-29-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/4392-32-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/4392-31-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/4392-28-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/4392-34-0x0000000000400000-0x000000000048D000-memory.dmp

Download