remcos | 806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2

Analysis

max time kernel
60s
max time network
44s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
Size 513KB
Sample260727-yt533ada53
SHA256 806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2
MD5 2e6f649da45e7cc7e05c1710604d898a
SHA1 65c14662bcb25718d04d34765e165421f3368b31
SHA512 4323a5d9154bc31c11508c5b08f7e70c42a730eee6158dd911628ee7c35df1f389e926c2bf228cf95484d37efd74f9bdf4a19cf802905e2daf073cbf278896cf
SSDEEP 12288:NlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSruj/:Nl0GcNUJV8i4mHM9/DZII
TLSH
T1E8B4AF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 4 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 5 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
2	1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1684	806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe

C:\Users\Admin\AppData\Local\Temp\806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe
"C:\Users\Admin\AppData\Local\Temp\806a36730c39b3991b23cf3108929b2a83955f7821f54a10b7c9ed653977c5e2.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 3be64c4c49dca7dacc544efab6d5dc8639d0c9991b4f00888618431cb852f926
MD5 0a7888b3644540a65b151a60888df5ef
SHA1 03da42b8269044d669e79ec311d96c3f59ede402
SHA512 2178656e08c115aae7b265dbee74bb1d66ac23cb26256b46a1feeb068e691a74b3993258385f0214f5590e39ce756ced6fe16d970dca712d12e81027172bd6ff
TLSH
T1C8C09B6A37D1102A78B2F156547700357B71FD64043CC44D11D7034C09F150031C47D7
MD5 SHA1 SHA512 TLSH

Submit Download