remotex | 26cba7929124eb13801a4e32c7071a2b3ab10896048bb25ca900e04edfa34795

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 15.7MB
Sample260729-3e2vbaxydw
SHA256 26cba7929124eb13801a4e32c7071a2b3ab10896048bb25ca900e04edfa34795
MD5 70167040a63143a7130cb17e6d3c50ec
SHA1 04225100608ee8c6edbc417ab3d5321a88f4ef9f
SHA512 4df1937a6214ecb94e5b7d31378ff0c73f81a1720fd487313ceb27d99dd564cbe5f607e1fe70e96cebae5b3cde4eab66bfb31ad3442cf6e1ae98ca5381a2deaa
SSDEEP 196608:upy44hK8zWJrtmM7oqUJB0HXZ97MU8J1Vq:uY44hK80rseoqSu7MU8o
TLSH
T1DEF65A47E8A545E5C0AED175C6269212BB717C884F3063D72F90FB282F72BE0AE79744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution remotex persistence privilege_escalation stealer

Malware Config

Signatures

Family: RemoteX
Remotex is a stealer written in Golang.
stealer remotex

Detects RemoteX payload 20 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001b8ae-1.dat	family_remotex
behavioral2/memory/5296-2-0x00007FF735540000-0x00007FF736554000-memory.dmp	family_remotex
behavioral2/memory/3224-23-0x00007FF735540000-0x00007FF736554000-memory.dmp	family_remotex
behavioral2/memory/1228-27-0x00007FF6DB160000-0x00007FF6DC174000-memory.dmp	family_remotex
behavioral2/memory/5956-30-0x00007FF6DB160000-0x00007FF6DC174000-memory.dmp	family_remotex
behavioral2/memory/2028-31-0x00007FF6DB160000-0x00007FF6DC174000-memory.dmp	family_remotex
behavioral2/memory/5600-32-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-33-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-34-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-35-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-36-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-37-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-38-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-39-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-40-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-41-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-42-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-43-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-44-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex
behavioral2/memory/5600-45-0x00007FF778190000-0x00007FF7791A4000-memory.dmp	family_remotex

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4196	powershell.exe
4324	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2560	netsh.exe
1148	netsh.exe
2876	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5296	file.exe
3224	file.exe
1228	file.exe
5956	file.exe
2028	file.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\file.exe"	file.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\file.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\ProgramData\\Microsoft\\Windows\\file.exe"	file.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3136	schtasks.exe
5500	schtasks.exe
1548	schtasks.exe
5544	schtasks.exe
4352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5600	file.exe
4196	powershell.exe
4196	powershell.exe
4324	powershell.exe
4324	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5600	file.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5600 wrote to memory of 4196	5600	file.exe	90
PID 5600 wrote to memory of 3136	5600	file.exe	92
PID 5600 wrote to memory of 4352	5600	file.exe	94
PID 5600 wrote to memory of 5544	5600	file.exe	96
PID 5600 wrote to memory of 2560	5600	file.exe	98
PID 5600 wrote to memory of 4324	5600	file.exe	99
PID 5600 wrote to memory of 1148	5600	file.exe	105
PID 5600 wrote to memory of 5500	5600	file.exe	108
PID 5600 wrote to memory of 1548	5600	file.exe	110
PID 5600 wrote to memory of 2876	5600	file.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe';$s.WindowStyle=7;$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe\" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3136
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe\" /sc ONSTART /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4352
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5544
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule "name=RemoteX Client"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\file.exe';$s.WindowStyle=7;$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1148
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\file.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5500
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\file.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1548
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\file.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2876

C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe"
1⤵
- Executes dropped EXE
PID:3224

C:\ProgramData\Microsoft\Windows\file.exe
C:\ProgramData\Microsoft\Windows\file.exe
1⤵
- Executes dropped EXE
PID:1228

C:\ProgramData\Microsoft\Windows\file.exe
"C:\ProgramData\Microsoft\Windows\file.exe"
1⤵
- Executes dropped EXE
PID:5956

C:\PROGRA~3\MICROS~1\Windows\file.exe
C:\PROGRA~3\MICROS~1\Windows\file.exe
1⤵
- Executes dropped EXE
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 032c3ee4f332faf5a590feb9d42724cf5d0c21426a090268dc674c64ccec493d
MD5 83a9208fa94c274efbd05f6eb5c77485
SHA1 c2471e16d599fb3152ee053c789cf45d419e6873
SHA512 ea0e0ecabe4a853ba0c551e270bee192ef44c7a46f08b9803fe4de71d8ba0aedaf89bc19a40d605d1f89f910cf4dfb7fe4c080a0ea64c5d95ffd168cefbc6266
TLSH
T15B117A33F3CC8664DC9A413650CEEC1036B6C7DB409EDE9BBB84D549B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\file.exe
Size 15.7MB
SHA256 26cba7929124eb13801a4e32c7071a2b3ab10896048bb25ca900e04edfa34795
MD5 70167040a63143a7130cb17e6d3c50ec
SHA1 04225100608ee8c6edbc417ab3d5321a88f4ef9f
SHA512 4df1937a6214ecb94e5b7d31378ff0c73f81a1720fd487313ceb27d99dd564cbe5f607e1fe70e96cebae5b3cde4eab66bfb31ad3442cf6e1ae98ca5381a2deaa
SSDEEP 196608:upy44hK8zWJrtmM7oqUJB0HXZ97MU8J1Vq:uY44hK80rseoqSu7MU8o
TLSH
T1DEF65A47E8A545E5C0AED175C6269212BB717C884F3063D72F90FB282F72BE0AE79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-27-0x00007FF6DB160000-0x00007FF6DC174000-memory.dmp

Download

memory/2028-31-0x00007FF6DB160000-0x00007FF6DC174000-memory.dmp

Download

memory/3224-23-0x00007FF735540000-0x00007FF736554000-memory.dmp

Download

memory/4196-9-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-8-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-10-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-11-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-16-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-13-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-7-0x00007FFF1D370000-0x00007FFF1DD14000-memory.dmp

Download

memory/4196-4-0x000002137EFB0000-0x000002137EFD2000-memory.dmp

Download

memory/4196-3-0x00007FFF1D4FF000-0x00007FFF1D500000-memory.dmp

Download

memory/5296-2-0x00007FF735540000-0x00007FF736554000-memory.dmp

Download

memory/5600-37-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-38-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-33-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-34-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-35-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-36-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-45-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-32-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-39-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-40-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-41-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-42-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-43-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5600-44-0x00007FF778190000-0x00007FF7791A4000-memory.dmp

Download

memory/5956-30-0x00007FF6DB160000-0x00007FF6DC174000-memory.dmp

Download