remcos | b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde

Analysis

max time kernel
60s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
Size 1.2MB
Sample260702-ys13qaaw8m
SHA256 b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde
MD5 fe8f882c7d0487fb929fb4c8a10c8b7d
SHA1 9d1f817ac425cdcb132f1826f02bea8a23a21d75
SHA512 e1d720f86f980492384e8576024e8f12531c240fbe20440b6c7efbce73fc58580757bd4656814b09f7f89b2c41271040f3f364e13128587db9d8c7857450c5c5
SSDEEP 24576:tQ4q4DPHwnvF9/S3ivLFTxEFtZaHamIQLvK+x5sW1iJey30l:tQ4FPHwDOg/Eb4HRxWpkl
TLSH
T1E04512C567D9C613D0B863F81AB2D33683F42C1A6426E2394EED5EEF3465F868A14743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemoteHost

kjdesss.ddns.net:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-D4XEKD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1824	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1932	remcos.exe
6776	mpkGSCGmNZkZg.exe
2172	remcos.exe
2972	mpkGSCGmNZkZg.exe
1056	mpkGSCGmNZkZg.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-D4XEKD = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-D4XEKD = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-D4XEKD = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-D4XEKD = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpkGSCGmNZkZg = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\32wwohdvkge.ps1\""	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/1412-7-0x0000000005CD0000-0x0000000005CE0000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1932 set thread context of 2172	1932	remcos.exe	94
PID 6776 set thread context of 1056	6776	mpkGSCGmNZkZg.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mpkGSCGmNZkZg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1824	powershell.exe
1824	powershell.exe
6776	mpkGSCGmNZkZg.exe
6776	mpkGSCGmNZkZg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	6776	mpkGSCGmNZkZg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	remcos.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 1412 wrote to memory of 6060	1412	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	89
PID 6060 wrote to memory of 1932	6060	b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe	90
PID 1824 wrote to memory of 6776	1824	powershell.exe	93
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 1932 wrote to memory of 2172	1932	remcos.exe	94
PID 6776 wrote to memory of 2972	6776	mpkGSCGmNZkZg.exe	95
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96
PID 6776 wrote to memory of 1056	6776	mpkGSCGmNZkZg.exe	96

C:\Users\Admin\AppData\Local\Temp\b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
"C:\Users\Admin\AppData\Local\Temp\b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe
  "C:\Users\Admin\AppData\Local\Temp\b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2172

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\32wwohdvkge.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Roaming\mpkGSCGmNZkZg.exe
  "C:\Users\Admin\AppData\Roaming\mpkGSCGmNZkZg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6776
- - C:\Users\Admin\AppData\Roaming\mpkGSCGmNZkZg.exe
    "C:\Users\Admin\AppData\Roaming\mpkGSCGmNZkZg.exe"
    3⤵
    - Executes dropped EXE
    PID:2972
- - C:\Users\Admin\AppData\Roaming\mpkGSCGmNZkZg.exe
    "C:\Users\Admin\AppData\Roaming\mpkGSCGmNZkZg.exe"
    3⤵
    - Executes dropped EXE
    PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 1.2MB
SHA256 b129cc12810af05a3b94640c829849820899ab7ea2adacdc128acc1a313d0fde
MD5 fe8f882c7d0487fb929fb4c8a10c8b7d
SHA1 9d1f817ac425cdcb132f1826f02bea8a23a21d75
SHA512 e1d720f86f980492384e8576024e8f12531c240fbe20440b6c7efbce73fc58580757bd4656814b09f7f89b2c41271040f3f364e13128587db9d8c7857450c5c5
SSDEEP 24576:tQ4q4DPHwnvF9/S3ivLFTxEFtZaHamIQLvK+x5sW1iJey30l:tQ4FPHwDOg/Eb4HRxWpkl
TLSH
T1E04512C567D9C613D0B863F81AB2D33683F42C1A6426E2394EED5EEF3465F868A14743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32wwohdvkge.ps1

Path C:\Users\Admin\AppData\Local\Temp\32wwohdvkge.ps1
Size 1KB
SHA256 a9b374d9a600273e250b52b48476b9a76165469951b3056c200ff9416ae54e3d
MD5 195e7cb45c3f712a19b03b0c0c5f2916
SHA1 d597e55d07d4ac361b849f71d0e588be557c5289
SHA512 cb51dfdaa6875012e3e2f9d4855fac4ebf32b42e5ea0530f9b90765469c034d6fc22f961e8685d52b64c5ed962147baa647a77575034f37e712a271bad8fce4a
TLSH
T1D621D01B9FA443C240A407E11217B1CC722E6297267F1150989DB6ADB72BD13353BDE4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0tura03k.pmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tura03k.pmp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1056-47-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/1412-8-0x00000000744F2000-0x00000000744F3000-memory.dmp

Download

memory/1412-5-0x0000000005CF0000-0x0000000005D8C000-memory.dmp

Download

memory/1412-6-0x00000000744E0000-0x0000000074C9C000-memory.dmp

Download

memory/1412-7-0x0000000005CD0000-0x0000000005CE0000-memory.dmp

Download

memory/1412-0-0x00000000744F2000-0x00000000744F3000-memory.dmp

Download

memory/1412-9-0x00000000744E0000-0x0000000074C9C000-memory.dmp

Download

memory/1412-10-0x0000000008470000-0x000000000858A000-memory.dmp

Download

memory/1412-1-0x0000000000EF0000-0x000000000102A000-memory.dmp

Download

memory/1412-3-0x0000000005BB0000-0x0000000005C42000-memory.dmp

Download

memory/1412-2-0x0000000006170000-0x000000000672A000-memory.dmp

Download

memory/1412-4-0x0000000005B40000-0x0000000005B4A000-memory.dmp

Download

memory/1412-16-0x00000000744E0000-0x0000000074C9C000-memory.dmp

Download

memory/1824-26-0x0000025F6CAD0000-0x0000025F6CAF2000-memory.dmp

Download

memory/1932-32-0x0000000074250000-0x0000000074A0C000-memory.dmp

Download

memory/1932-19-0x0000000074262000-0x0000000074263000-memory.dmp

Download

memory/1932-31-0x0000000074262000-0x0000000074263000-memory.dmp

Download

memory/1932-20-0x0000000074250000-0x0000000074A0C000-memory.dmp

Download

memory/1932-40-0x0000000074250000-0x0000000074A0C000-memory.dmp

Download

memory/2172-36-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-35-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-39-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-41-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-42-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-43-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-51-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/2172-52-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/6060-18-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/6060-15-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/6060-14-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/6060-13-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/6060-12-0x0000000000400000-0x000000000048D000-memory.dmp

Download