remcos | 5668a1c07a30a7bef7ddce77b1a5e6dd3b3e267ab0b4a6c84ace7fb67d0fc3ea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
greatnesscomingforbestnetworking.hta
Size 24KB
Sample260716-k264facz2t
SHA256 5668a1c07a30a7bef7ddce77b1a5e6dd3b3e267ab0b4a6c84ace7fb67d0fc3ea
MD5 4759d51a9e751583c5dd19d3c7fd4f65
SHA1 434b36f6f589b5bace2a48882a472d7fdf44a3d7
SHA512 7cd02b7898747e43fb85cdbf10d080d1a21135c8ed6b095389fc13a3491b8bcdd1919352b063091cb8ad84d3f1695f31c76bdd0882f4d321081969ebb174e1fe
SSDEEP 768:4bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb1:Url
TLSH
T163B2D56D05E47B48FF04B714E4A6E786AC21C10642539FFBECACC24665360CDA269DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

goldensky collection discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

6.0.0 Pro

Botnet

Goldensky

gooddaystartinginyourlifewithbestthings.duckdns.org:14641

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-IEXKD2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	4088	powershell.exe	85

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/3016-28-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2040-31-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4644-27-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/4644-27-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/3016-28-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2828	powershell.exe
8	2828	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	CasPol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2828 set thread context of 1848	2828	powershell.exe	95
PID 1848 set thread context of 3016	1848	CasPol.exe	97
PID 1848 set thread context of 4644	1848	CasPol.exe	98
PID 1848 set thread context of 2040	1848	CasPol.exe	101

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2828	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe
3016	CasPol.exe
3016	CasPol.exe
2040	CasPol.exe
2040	CasPol.exe
3016	CasPol.exe
3016	CasPol.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1848	CasPol.exe
1848	CasPol.exe
1848	CasPol.exe
1848	CasPol.exe
1848	CasPol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2040	CasPol.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 2828 wrote to memory of 1848	2828	powershell.exe	95
PID 1848 wrote to memory of 3016	1848	CasPol.exe	97
PID 1848 wrote to memory of 4644	1848	CasPol.exe	98
PID 1848 wrote to memory of 5060	1848	CasPol.exe	99
PID 1848 wrote to memory of 2028	1848	CasPol.exe	100
PID 1848 wrote to memory of 2040	1848	CasPol.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\greatnesscomingforbestnetworking.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:2864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:glaciology"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\rjzdsoqvseksfd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\tdeolgbwgncxhrjjo"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - outlook_office_path
    PID:4644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\exkgmzlquvucryfnfcvl"
    3⤵
    PID:5060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\exkgmzlquvucryfnfcvl"
    3⤵
    PID:2028
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\exkgmzlquvucryfnfcvl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_jhyjlszg.mld.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhyjlszg.mld.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rjzdsoqvseksfd

Path C:\Users\Admin\AppData\Local\Temp\rjzdsoqvseksfd
Size 4KB
SHA256 70c3a9d919a0ea5700a8dbd165c97010d293ad320c29994f932f3221bb97d176
MD5 2eb16462659bf5691117a67b3f168b64
SHA1 bd7b0e0945bdac9c999fea6ed62bab44081a89cb
SHA512 8f611cb5ec9bea098ae4cf196071eaaa760dfe16b1da56984c4a6682e879fcc2dee04a2df8fd0cb829ad135ec47f1ca402900f5add595a6ae23143e41ce5f81a
SSDEEP 48:wvvv0RxfvvcRxfdvv0RxBvv0Rxakvv0R7:mvIxvAp1vIPvIbvI7
TLSH
T1F2914A4712E90448F0B2BA46D97715B65BB338199CBC815C61ECA3D80BF3910DAE37D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1848-20-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-21-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-50-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-49-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-12-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-15-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-17-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-47-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-18-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-22-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-51-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-52-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-19-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-46-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-45-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-44-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-42-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-43-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-41-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1848-39-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1848-40-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1848-36-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2040-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2040-29-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2040-30-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2828-16-0x00000262EE0F0000-0x00000262EE30C000-memory.dmp

Download

memory/2828-0-0x00000262D3E70000-0x00000262D3E80000-memory.dmp

Download

memory/2828-11-0x00000262D3E60000-0x00000262D3E6A000-memory.dmp

Download

memory/2828-10-0x00000262EE8F0000-0x00000262EE9A4000-memory.dmp

Download

memory/2828-2-0x00000262D3E80000-0x00000262D3EA2000-memory.dmp

Download

memory/2828-1-0x00000262D3E70000-0x00000262D3E80000-memory.dmp

Download

memory/3016-25-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3016-28-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3016-23-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4644-27-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4644-26-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4644-24-0x0000000000400000-0x0000000000462000-memory.dmp

Download