remcos | 2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b

Analysis

max time kernel
60s
max time network
60s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe
Size 1.5MB
Sample260726-y4envs1vbv
SHA256 2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b
MD5 42bcd216cf1720d2aebd52d5309ed744
SHA1 e0b4b88f92c4c4f341af23a4e5c969e79fced7d1
SHA512 f6344a178166e01184af9b0ef0305cab819c3a948d877770a5e3e5b3e055a37552b8ecae42c6d88269634f1d2c8506c6271f343c5c6f2045ee6986ca56a863d9
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0FO:+Tg3ZOcuUL3xAx/8b2S7Z0k
TLSH
T18F7523FA8E706892D5BD463205AF0F6D35F54FF77A14AC4311713D2A6F3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 4 IoCs

pid	Process
4352	AboutSettingsHandlers.exe
4720	AboutSettingsHandlers.exe
1848	AboutSettingsHandlers.exe
2552	AboutSettingsHandlers.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5032-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5032-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5032-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4352-33-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4352-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4352-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 3340	5032	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe	89
PID 4352 set thread context of 4720	4352	AboutSettingsHandlers.exe	94
PID 1848 set thread context of 2552	1848	AboutSettingsHandlers.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
760	schtasks.exe
260	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3340	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3340	5032	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe	89
PID 5032 wrote to memory of 3340	5032	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe	89
PID 5032 wrote to memory of 760	5032	2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe	90
PID 4352 wrote to memory of 4720	4352	AboutSettingsHandlers.exe	94
PID 4352 wrote to memory of 4720	4352	AboutSettingsHandlers.exe	94
PID 4352 wrote to memory of 260	4352	AboutSettingsHandlers.exe	96
PID 1848 wrote to memory of 2552	1848	AboutSettingsHandlers.exe	99
PID 1848 wrote to memory of 2552	1848	AboutSettingsHandlers.exe	99

C:\Users\Admin\AppData\Local\Temp\2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe
"C:\Users\Admin\AppData\Local\Temp\2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe
  "C:\Users\Admin\AppData\Local\Temp\2527c8846a1a3f63a2394242dd696466e9cc655279f1271462696d0f5ef5c56b.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3340
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:760

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:260

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
"C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 c9c84f7bdb8ff2eb74f5954718acb1cee198cbe11ec300bfd97c45b39c7fe104
MD5 7c7f7f4771d4a843624962ac5fb81975
SHA1 f774ffe63e4b2ab8f0e2593487e359d38a3a8446
SHA512 34bddef01943718de145d1058ffb8d27f99a618c56e30f3fb7d45f74b05568909ed22d87b8ffe1d6d92169b8eb6a6515a58531685916d5d3f15a8847abfcf0a7
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fp:+Tg3ZOcuUL3xAx/8b2S7Z0D
TLSH
T1D07523FA8E706892D5BD463205AF0F6D35F54FF77A14AC4311713D2A6F3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 e945683020e6fdd0e3b2e728e70622e7f58e7b7952cfaf7cf826f25e4c76ae14
MD5 1a6da8001d1d89c1cd389dce1e62205f
SHA1 9a16f8330ee9a49711c8846745176d8bb4fb52f5
SHA512 e3e8b5d49d1b047c5fc31fae3b6b7262a01bbae87a02a72ccbd2e4f517c7e62eda33cad86acf590b0b0f5cd4ad090a96ac7a0f2c6056bef464eb959c5ba93537
TLSH
T1FFA0125CC621C94400106AE06488308A610605513BA6052560014B4D02491006580511
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3340-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3340-3-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3340-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/3340-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4352-33-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4352-23-0x0000000000980000-0x0000000000983000-memory.dmp

Download

memory/4352-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4352-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5032-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5032-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5032-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5032-2-0x0000000003020000-0x0000000003021000-memory.dmp

Download

memory/5032-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5032-1-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads