remcos | e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7

Analysis

max time kernel
60s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
Size 515KB
Sample260720-y4mdpsfx9x
SHA256 e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7
MD5 fa6403e1deb01f89b4d3a318902478a2
SHA1 89f759f67ad7e8a70894c1031f1e179de0e3a02f
SHA512 9533cf15bb44965f210f0056b7af7bfc6efbbb6131b3f6ad1a3f706aa35da610938c7f50601ce91aac26ad6119d3883f0e63f3a06e8f0a95b5162569a50d1bdd
SSDEEP 6144:bXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBce9:rENlHV9FGeDWv3jADnyYiCNrsPZ0r
TLSH
T144B4BF01B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 5 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 7 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
2	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
3	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
3	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4176-7-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4116 set thread context of 4760	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	90
PID 4116 set thread context of 4860	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	91
PID 4116 set thread context of 4176	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4760	userinit.exe
4760	userinit.exe
4176	userinit.exe
4176	userinit.exe
4760	userinit.exe
4760	userinit.exe
4760	userinit.exe
4760	userinit.exe
4760	userinit.exe
4760	userinit.exe
4760	userinit.exe
4760	userinit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	userinit.exe
Token: SeImpersonatePrivilege	4760	userinit.exe
Token: SeImpersonatePrivilege	4760	userinit.exe
Token: SeImpersonatePrivilege	4760	userinit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 5284	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	89
PID 4116 wrote to memory of 4760	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	90
PID 4116 wrote to memory of 4860	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	91
PID 4116 wrote to memory of 2760	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	92
PID 4116 wrote to memory of 4176	4116	e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Users\Admin\AppData\Local\Temp\e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe
"C:\Users\Admin\AppData\Local\Temp\e86fda4b24a8a1e4f9348b00aa40f471bd6a3be7e3cd7233da46248a223b69f7.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\ioxlppanffynptgfdrnygliofiypecq"
  2⤵
  PID:5284
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\ioxlppanffynptgfdrnygliofiypecq"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\tjkwqilptnqsraujucizrqdxgwqyfngbfm"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - outlook_office_path
  PID:4860
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\vlqpqa"
  2⤵
  PID:2760
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\vlqpqa"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 93be4dbc6c26a10b0b35d8276eee4b14ef2a527282dedd935ba2b7256bfa4f13
MD5 d6576a6a0c661ffbecd714fb625b9bf9
SHA1 11a453598da7fe9088f8ac7ac6272e81d4608a81
SHA512 3f2afce3773e72fb15e9e3f9a9173e525c475fa61be1319a2e3707b7cfaf8c32c0f56a9d401a6d5ff22cb8e6030e0547dbf38b42d44fb0203d5b3d32a9adeadc
TLSH
T1E6C048AA27F21029B8B2A2AA94B200362A62BE660438C80D21D6038C0AF1A0031847D3
MD5 SHA1 SHA512 TLSH

Submit Download

ioxlppanffynptgfdrnygliofiypecq

Path C:\Users\Admin\AppData\Local\Temp\ioxlppanffynptgfdrnygliofiypecq
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2760-3-0x0000000000370000-0x0000000000394000-memory.dmp

Download

memory/4116-13-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4116-17-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4116-16-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4176-7-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4760-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4860-2-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4860-8-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5284-0-0x0000000000600000-0x000000000067E000-memory.dmp

Download