remcos | 972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe
Size 1.5MB
Sample260711-yywp7act71
SHA256 972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309
MD5 91613ab64180d9d05bc751abd5edbf70
SHA1 48c0856faf577cabd8371927ae21c6086dd79ae4
SHA512 2d0ab0cd69119f5a7daa502ec0c18d07de55bfeea71ef0bfc2c5ee311c28f9a40bb9b7c1c6f66bf731054197564c7d46a66d04a2c04f8336a2f26b1f36369940
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0F5:+Tg3ZOcuUL3xAx/8b2S7Z0z
TLSH
T1B67523FA8E706892D5BD463205AF0F6D75F54FF37A14AC4311713D2A2E3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 6 IoCs

pid	Process
2428	AboutSettingsHandlers.exe
3240	AboutSettingsHandlers.exe
2400	AboutSettingsHandlers.exe
4732	AboutSettingsHandlers.exe
5432	AboutSettingsHandlers.exe
3880	AboutSettingsHandlers.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3292-16-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3292-19-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3292-21-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/2428-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/2428-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/2428-37-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/2400-49-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/2400-51-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/2400-52-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5432-67-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5432-69-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5432-70-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3292 set thread context of 5152	3292	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe	87
PID 2428 set thread context of 3240	2428	AboutSettingsHandlers.exe	92
PID 2400 set thread context of 4732	2400	AboutSettingsHandlers.exe	97
PID 5432 set thread context of 3880	5432	AboutSettingsHandlers.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2816	schtasks.exe
2940	schtasks.exe
3392	schtasks.exe
1588	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5152	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 5152	3292	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe	87
PID 3292 wrote to memory of 5152	3292	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe	87
PID 3292 wrote to memory of 2816	3292	972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe	88
PID 2428 wrote to memory of 3240	2428	AboutSettingsHandlers.exe	92
PID 2428 wrote to memory of 3240	2428	AboutSettingsHandlers.exe	92
PID 2428 wrote to memory of 2940	2428	AboutSettingsHandlers.exe	94
PID 2400 wrote to memory of 4732	2400	AboutSettingsHandlers.exe	97
PID 2400 wrote to memory of 4732	2400	AboutSettingsHandlers.exe	97
PID 2400 wrote to memory of 3392	2400	AboutSettingsHandlers.exe	98
PID 5432 wrote to memory of 3880	5432	AboutSettingsHandlers.exe	101
PID 5432 wrote to memory of 3880	5432	AboutSettingsHandlers.exe	101
PID 5432 wrote to memory of 1588	5432	AboutSettingsHandlers.exe	102

C:\Users\Admin\AppData\Local\Temp\972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe
"C:\Users\Admin\AppData\Local\Temp\972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe
  "C:\Users\Admin\AppData\Local\Temp\972de0fa09170e8b4873a89cda2d6c3332449d4d1f56cd2204499ec12dff3309.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5152
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2816

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2940

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
"C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3392

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
"C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 d8ecd93209ce3550f14c8ad7228732790a276d7df1be7c82b4eeb92298a6c6dc
MD5 29ff4e6e486c500f62a82d47c8cc2de2
SHA1 b0a116b4dfef0c10ef14513c0a97e5c40dd6bacc
SHA512 86a750def32c8c4a9b04d0fe5321ef3f17f981fcef3c8d6363de99c036c2170d5fd5c18298d56f7968624e8475288349c3c1cdb24cda1487cb9a68ca18d3328f
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0FT:+Tg3ZOcuUL3xAx/8b2S7Z0l
TLSH
T16A7523FA8E706892D5BD463205AF0F6D75F54FF37A14AC4311713D6A3E3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 fde76f39b99b30e4e5d1c3b510c9efca94eb41efa2f3f52fbb4731883483c936
MD5 6cab5da01a26fe50f0fb75bfd9677d2b
SHA1 6a1aa7de391b7782f40554e01431e7274e8a80cb
SHA512 d06723a2531a9edad58e2e8306205f39039bb7fcd47ce0d689301ff0cde3c2d962bf74fad3773d73f9e13432efb39396b36a1296884188458a712c4e33b48dc5
TLSH
T1F3A012448221A955002128E4644831875045051032A7262594018F08038A1406980611
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2400-52-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2400-51-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2400-49-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2428-37-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2428-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2428-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/2428-24-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Download

memory/3292-21-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3292-1-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Download

memory/3292-19-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3292-16-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3292-15-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Download

memory/3292-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3292-2-0x0000000003140000-0x0000000003141000-memory.dmp

Download

memory/5152-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/5152-3-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/5152-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/5152-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/5432-67-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5432-69-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5432-70-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads