remus_stealer | ee1b8b223bae3fc83a05a10d533916173d8bf135191d75a73d545ed7548670c1

Analysis

max time kernel
149s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ee1b8b223bae3fc83a05a10d533916173d8bf135191d75a73d545ed7548670c1.ps1
Size 1.7MB
Sample260704-j9e49ahs2k
SHA256 ee1b8b223bae3fc83a05a10d533916173d8bf135191d75a73d545ed7548670c1
MD5 b5e17102fbf39157f54a5416edb0dd0a
SHA1 a4728afbb2ed8c993c99cc91c1174baf729a6119
SHA512 af808d1a991d7690ad7813bd64db4483d57000ea81c0dbdb09ba6749eb9ef2bfb2eb55972010be50637f37cbe4d8cea5191c4015bbe3d95d620db927dfd9d0ac
SSDEEP 24576:X2Pj2qje9MM/PGSz/cNDw5k8TKTfqpC5o3W9FE5AoYjY9e:cjnIpY9FmVe
TLSH
T1DA85AE01B9B990406DAD7B1A1032F7A761DED466C2FC8E6013787633A4CE9C9DCE98F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution remus_stealer stealer

Malware Config

Extracted

Family

remus_stealer

http://voihxd.xyz:7528
http://myrtler.biz:9549
http://carogra.biz:4219

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	5924	PowerShell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5924 set thread context of 2296	5924	PowerShell.exe	89
PID 5924 set thread context of 5100	5924	PowerShell.exe	90

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5924	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5924	PowerShell.exe
5924	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5924	PowerShell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 2296	5924	PowerShell.exe	89
PID 5924 wrote to memory of 2296	5924	PowerShell.exe	89
PID 5924 wrote to memory of 2296	5924	PowerShell.exe	89
PID 5924 wrote to memory of 2296	5924	PowerShell.exe	89
PID 5924 wrote to memory of 2296	5924	PowerShell.exe	89
PID 5924 wrote to memory of 2296	5924	PowerShell.exe	89
PID 5924 wrote to memory of 5100	5924	PowerShell.exe	90
PID 5924 wrote to memory of 5100	5924	PowerShell.exe	90
PID 5924 wrote to memory of 5100	5924	PowerShell.exe	90
PID 5924 wrote to memory of 5100	5924	PowerShell.exe	90
PID 5924 wrote to memory of 5100	5924	PowerShell.exe	90
PID 5924 wrote to memory of 5100	5924	PowerShell.exe	90

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_ee1b8b223bae3fc83a05a10d533916173d8bf135191d75a73d545ed7548670c1.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\system32\calc.exe
  "C:\Windows\system32\calc.exe"
  2⤵
  PID:2296
- C:\Windows\system32\calc.exe
  "C:\Windows\system32\calc.exe"
  2⤵
  PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-19-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/5100-22-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/5924-12-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-13-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-6-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-7-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-8-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-9-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-10-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-11-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-0-0x00007FFADF1BF000-0x00007FFADF1C0000-memory.dmp

Download

memory/5924-5-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-15-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-16-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-14-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-17-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-18-0x0000027151580000-0x0000027151692000-memory.dmp

Download

memory/5924-4-0x0000027138F90000-0x0000027138FB2000-memory.dmp

Download

memory/5924-21-0x00000271516A0000-0x00000271516E2000-memory.dmp

Download

memory/5924-3-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download

memory/5924-24-0x00007FFADF030000-0x00007FFADF9D4000-memory.dmp

Download