remcos | b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa

Analysis

max time kernel
59s
max time network
38s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe
Size 1.5MB
Sample260604-zmd7faev5y
SHA256 b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa
MD5 ff34de2d91224cd7b08f2c8da7c6d432
SHA1 c259cdf0438444e0a55b7129f6573db4cf87b19b
SHA512 7105371eff790ec6cbae265712b739f1198004a7831f055f3315bf7f230a1bd785cc0ecdf189c76ba50a278cc3665e6506eebe2d43403be1a5b201cc2f04ef0c
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fi:+Tg3ZOcuUL3xAx/8b2S7Z0M
TLSH
T1277523FA8E706892D5BD463205AF0F6D75F54FF37A14AC4311713D2A6F3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
5952	AboutSettingsHandlers.exe
4340	AboutSettingsHandlers.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1580-16-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1580-21-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5952-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5952-38-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 3148	1580	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe	80
PID 5952 set thread context of 4340	5952	AboutSettingsHandlers.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1316	schtasks.exe
2496	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3148	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3148	1580	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe	80
PID 1580 wrote to memory of 3148	1580	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe	80
PID 1580 wrote to memory of 1316	1580	b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe	81
PID 5952 wrote to memory of 4340	5952	AboutSettingsHandlers.exe	85
PID 5952 wrote to memory of 4340	5952	AboutSettingsHandlers.exe	85
PID 5952 wrote to memory of 2496	5952	AboutSettingsHandlers.exe	86

C:\Users\Admin\AppData\Local\Temp\b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe
"C:\Users\Admin\AppData\Local\Temp\b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe
  "C:\Users\Admin\AppData\Local\Temp\b01216c7e94c236ed43b38989fb0f65d731f4ff8a738b8ed6568e344a2088baa.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3148
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1316

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 5722f0e25124f6d4b81bc91415be1509be38555d888c1a624be53b8e16a96371
MD5 db80169524aea8dd18498e9b40a53dfe
SHA1 df32de18fcb8f85db14d74fe0d24720ab4b7a463
SHA512 aa2efb335e29d8c90061c0565e20c360c5c16b1ff16b9fdf52ae6bd256646f52e6f1b4c589fa383cb3aee303824451734e5aa2edccbedb05dc6d1652896d9aea
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0FC:+Tg3ZOcuUL3xAx/8b2S7Z0c
TLSH
T1477523FA8E706892D5BD463205AF0F6D75F54FF37A14AC4311713D2A6F3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 5ddc59d8ded8a7ae4bcaac99a9dd83bed35253fe79b4cce7caff61962a0c0179
MD5 da94bd0d464f9ffa2d53b167c655aa05
SHA1 519d1e3ec5076e44f5eca81bd07422ce8532dce3
SHA512 412ac689e5bd2efe745de6dc4988afd5b85b11442cedc7abee262ade41f148507a222753d686bcf677cacc76ddd3ebc4226ddb8922e1af58a11321a17862988f
TLSH
T119A01245D2219F90001225F164483096900301143166052692065B0843880017580151
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1580-16-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1580-1-0x0000000000910000-0x0000000000913000-memory.dmp

Download

memory/1580-2-0x0000000001810000-0x0000000001811000-memory.dmp

Download

memory/1580-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1580-21-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1580-15-0x0000000000910000-0x0000000000913000-memory.dmp

Download

memory/3148-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3148-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3148-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3148-4-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/5952-24-0x0000000000D60000-0x0000000000D63000-memory.dmp

Download

memory/5952-35-0x0000000000D60000-0x0000000000D63000-memory.dmp

Download

memory/5952-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5952-38-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads