remcos | 8d4c7010417f203f7d85abc0fc5f7e6e3e56c2dd38fb242b1b2eb9ac729673de

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
goodthingsarebestperofrmanceoneforme.hta
Size 24KB
Sample260720-pdbd3sby2v
SHA256 8d4c7010417f203f7d85abc0fc5f7e6e3e56c2dd38fb242b1b2eb9ac729673de
MD5 f524edcbd0bbe8f15e44aabba0c41c32
SHA1 ed53b4d32732b55593ae11f2df3eb70bc8b9d5cf
SHA512 8f744f6ba3fef5f0466756a2413e2fbce50c87919a19ab4d90e6b86503271e3a0fd775228ffcfd6f4eb26d0440e06f439fbd30c5c6f8769188ed495952afed11
SSDEEP 192:OEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEy:IMOla
TLSH
T1A6B2B41A89B25F778ADBD0015C04E473F86BD048F81955FDB4E8C0BF421E6DE89B9DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

goldeneye collection discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

6.0.0 Pro

Botnet

GoldenEye

141.98.10.150:14642

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JPCPJB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	600	powershell.exe	88

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1176-37-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3416-40-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/428-34-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1176-37-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/428-34-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2756	powershell.exe
3	2756	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Caspol.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2860	2756	powershell.exe	92
PID 2860 set thread context of 428	2860	Caspol.exe	93
PID 2860 set thread context of 1176	2860	Caspol.exe	94
PID 2860 set thread context of 3416	2860	Caspol.exe	96
PID 2860 set thread context of 6100	2860	Caspol.exe	101
PID 2860 set thread context of 4356	2860	Caspol.exe	103
PID 2860 set thread context of 4068	2860	Caspol.exe	106

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3560	428	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe
428	Caspol.exe
428	Caspol.exe
3416	Caspol.exe
3416	Caspol.exe
6100	Caspol.exe
6100	Caspol.exe
4068	Caspol.exe
4068	Caspol.exe
6100	Caspol.exe
6100	Caspol.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe
2860	Caspol.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	3416	Caspol.exe
Token: SeDebugPrivilege	4068	Caspol.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1152	2756	powershell.exe	91
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2756 wrote to memory of 2860	2756	powershell.exe	92
PID 2860 wrote to memory of 428	2860	Caspol.exe	93
PID 2860 wrote to memory of 1176	2860	Caspol.exe	94
PID 2860 wrote to memory of 5508	2860	Caspol.exe	95
PID 2860 wrote to memory of 3416	2860	Caspol.exe	96
PID 2860 wrote to memory of 6100	2860	Caspol.exe	101
PID 2860 wrote to memory of 1440	2860	Caspol.exe	102
PID 2860 wrote to memory of 4356	2860	Caspol.exe	103
PID 2860 wrote to memory of 5696	2860	Caspol.exe	104
PID 2860 wrote to memory of 1696	2860	Caspol.exe	105
PID 2860 wrote to memory of 4068	2860	Caspol.exe	106

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\goodthingsarebestperofrmanceoneforme.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:2392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:guldens"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:1152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ejbxibqvdunjfqttfkfjwb"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 584
      4⤵
      Program crash
      PID:3560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\pdopitbxrdfohepfovzdhgzgf"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    PID:1176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\zftajlmqflxtskdjggmektuwfbea"
    3⤵
    PID:5508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\zftajlmqflxtskdjggmektuwfbea"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\tmprgkgcshcmelipz"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\wpvkgdrdopuzgretqvnz"
    3⤵
    PID:1440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\wpvkgdrdopuzgretqvnz"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - outlook_office_path
    PID:4356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\gjachvbxcxmeqgsxafzsnlm"
    3⤵
    PID:5696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\gjachvbxcxmeqgsxafzsnlm"
    3⤵
    PID:1696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\gjachvbxcxmeqgsxafzsnlm"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 428 -ip 428
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmprgkgcshcmelipz

Path C:\Users\Admin\AppData\Local\Temp\tmprgkgcshcmelipz
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/428-33-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/428-31-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/428-34-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1176-32-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1176-37-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1176-35-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2756-14-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-9-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-11-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-12-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-13-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-0-0x00007FFC7966F000-0x00007FFC79670000-memory.dmp

Download

memory/2756-15-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-16-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-18-0x000001B03B450000-0x000001B03B45A000-memory.dmp

Download

memory/2756-17-0x000001B053980000-0x000001B053A34000-memory.dmp

Download

memory/2756-3-0x000001B053590000-0x000001B0535B2000-memory.dmp

Download

memory/2756-10-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-4-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-5-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-24-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-6-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-7-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2756-8-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp

Download

memory/2860-21-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-63-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-27-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-28-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-69-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-25-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-68-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-67-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-26-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-22-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-23-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-19-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-54-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2860-59-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-58-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2860-57-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2860-60-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-62-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-61-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-29-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-64-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2860-66-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/3416-39-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3416-40-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3416-38-0x0000000000400000-0x0000000000424000-memory.dmp

Download