remcos | a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe
Size 1.5MB
Sample260628-y2ynysd16l
SHA256 a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f
MD5 b3c96bd6857ca0a360f7c4b3a2f993ac
SHA1 0d9a2ff2b3c9217b790dd62cbe1cf6c1fab97d41
SHA512 29f94a0e37f6c5c1a472b6510c355710c60a99b3af8a4e5fd95b8b8c294a628f5a9aa00cc01e184f2d3c967d10ec3454325d2fe4ba730c79327991c1e569cd72
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fj:+Tg3ZOcuUL3xAx/8b2S7Z0Z
TLSH
T1BE7523FA8E706892D5BD463205AF0F6D75F54FB37A14AC4311713D2A3E3A267A920A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 7 IoCs

pid	Process
6028	AboutSettingsHandlers.exe
3424	AboutSettingsHandlers.exe
1940	AboutSettingsHandlers.exe
1344	AboutSettingsHandlers.exe
1508	AboutSettingsHandlers.exe
600	AboutSettingsHandlers.exe
3152	AboutSettingsHandlers.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3928-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3928-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3928-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3424-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/6028-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/6028-37-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/6028-38-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1344-54-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1344-56-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1344-57-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 2584	3928	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe	90
PID 6028 set thread context of 1940	6028	AboutSettingsHandlers.exe	96
PID 1344 set thread context of 1508	1344	AboutSettingsHandlers.exe	101
PID 600 set thread context of 3152	600	AboutSettingsHandlers.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8	schtasks.exe
4316	schtasks.exe
2808	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2584	3928	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe	90
PID 3928 wrote to memory of 2584	3928	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe	90
PID 3928 wrote to memory of 8	3928	a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe	91
PID 6028 wrote to memory of 1940	6028	AboutSettingsHandlers.exe	96
PID 6028 wrote to memory of 1940	6028	AboutSettingsHandlers.exe	96
PID 6028 wrote to memory of 4316	6028	AboutSettingsHandlers.exe	98
PID 1344 wrote to memory of 1508	1344	AboutSettingsHandlers.exe	101
PID 1344 wrote to memory of 1508	1344	AboutSettingsHandlers.exe	101
PID 1344 wrote to memory of 2808	1344	AboutSettingsHandlers.exe	102
PID 600 wrote to memory of 3152	600	AboutSettingsHandlers.exe	105
PID 600 wrote to memory of 3152	600	AboutSettingsHandlers.exe	105

C:\Users\Admin\AppData\Local\Temp\a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe
"C:\Users\Admin\AppData\Local\Temp\a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe
  "C:\Users\Admin\AppData\Local\Temp\a6f454fb07b16d4831378945c8d6d5b5d9cfea0c3dd956fa5482eb41fd94238f.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:8

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4316

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
"C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
"C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2808

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
"C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:600
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 33e3893c92195382b42852023f26e9d5918ae5318d40f0f15af6ea83117471fb
MD5 c9d67d2ac3b28a97e6580a54d238c840
SHA1 ff3fda6c63bbd607348b12ce1e18b174b6f8240d
SHA512 82057d2c44f9a95497040343f88920246218e2a4e197809e2dfb5343ad986143f23df77ea3a62bebe1a31b4e19e864191a57446c76e0e2439c7e6ad89c475345
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0F1:+Tg3ZOcuUL3xAx/8b2S7Z0r
TLSH
T15B7523FA8E706892D5BD463205AF0F6D75F54FB37A14AC4311713D2A3F3A267A920A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 48dfaaf1207138b8c3eb2d7f06d328adf9a6578b872a70ada45f3d2ac407095d
MD5 d1adcdcd1cf6803379a7048df969943e
SHA1 01531f3c0cba270d3278cbebf12b1dc83a888401
SHA512 61517573bd17ae5e7519a000da30e618be09fd7f1737291a4d2782d1b09de972aa0b398ea519a25568b98ed9ce36663e2a9d0e6a6d7148ffec3fc5e86e610e63
TLSH
T18DA02444D331DF4400113CF0744C33D750030114377F051551C54F0C435C40075C0351
MD5 SHA1 SHA512 TLSH

Submit Download

memory/600-62-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1344-57-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1344-56-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1344-54-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2584-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/2584-3-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/2584-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/2584-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3424-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3928-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3928-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3928-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3928-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3928-2-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/3928-1-0x0000000000970000-0x0000000000973000-memory.dmp

Download

memory/6028-23-0x0000000000980000-0x0000000000983000-memory.dmp

Download

memory/6028-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/6028-37-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/6028-38-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads