remcos | 8253bb236e315f60240304ac4c749e59e813399968562deddd692523bcb10b08

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shipping Doccument_XLS.js
Size 170KB
Sample260804-k4rrjagf49
SHA256 8253bb236e315f60240304ac4c749e59e813399968562deddd692523bcb10b08
MD5 bcdf633c54f64e3634cfb10ed9324e13
SHA1 dc833d58f84c0c21747098a6c475a3527d063d39
SHA512 a993893b6ca446804a097469e7822cb6b304ace3f18ecc2972cf65b920b2b61128d0b6255b1f4d1aa338caffda7cc76a17a73ab84fbf2ea67ef113af66594d7a
SSDEEP 3072:h/YDYF3gnjXJQUYhDB3RiMHj2flwk9muUoMhItZi+XvFd:BwYF3XUK3N6u2muUoMhgw+Xvv
TLSH
T1EA04BF855B481BF8FB2C0744D1AF544A62F2A726FB21A74AFD7332E36E37640907949C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

error505 discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

Error505

161.248.179.182:37171

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
vvlc
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-76HB0K
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	676	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	remcos.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	remcos.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Environment\UserInitMprLogonScript = "\"C:\\Windows\\system32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\v9955\\v7904.js\""	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-76HB0K = "\"C:\\ProgramData\\vvlc\\remcos.exe\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-76HB0K = "\"C:\\ProgramData\\vvlc\\remcos.exe\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3672	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1764	wscript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
676	powershell.exe
676	powershell.exe
3048	remcos.exe
3048	remcos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	3048	remcos.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1900	1764	wscript.exe	86
PID 1900 wrote to memory of 412	1900	conhost.exe	87
PID 412 wrote to memory of 3672	412	conhost.exe	88
PID 3672 wrote to memory of 3416	3672	cmd.exe	89
PID 3672 wrote to memory of 676	3672	cmd.exe	90
PID 676 wrote to memory of 3048	676	powershell.exe	92

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Doccument_XLS.js"
1⤵
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless conhost.exe --headless cmd.exe /c "echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('CITCURRKdo0','Process'))| powershell.exe -w H -nOP -noNi -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\System32\conhost.exe
    conhost.exe --headless cmd.exe /c "echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('CITCURRKdo0','Process'))| powershell.exe -w H -nOP -noNi -"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\System32\cmd.exe
      cmd.exe /c "echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('CITCURRKdo0','Process'))| powershell.exe -w H -nOP -noNi -"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $ExecutionContext.InvokeCommand.InvokeScript([Environment]::GetEnvironmentVariable('CITCURRKdo0','Process'))"
        5⤵
        
        PID:3416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -w H -nOP -noNi -
        5⤵
        Badlisted process makes network request
        Registers new Windows logon scripts automatically executed at logon.
        Adds Run key to start application
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:676
      - C:\ProgramData\vvlc\remcos.exe
        
        "C:\ProgramData\vvlc\remcos.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\vvlc\remcos.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
TLSH
T134A45A976BD432D5D83AC435C83344520722BCB9DB919BDB99D8B23D0E712C09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ybejdr1s.q0o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybejdr1s.q0o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/676-5-0x00000294EE320000-0x00000294EE342000-memory.dmp

Download

memory/676-8-0x00000294F0790000-0x00000294F07E4000-memory.dmp

Download

memory/676-9-0x00000294EE390000-0x00000294EE3A2000-memory.dmp

Download

memory/676-12-0x00000294F0D80000-0x00000294F0E2B000-memory.dmp

Download

memory/676-74-0x00000294F0D80000-0x00000294F0E2B000-memory.dmp

Download

memory/676-75-0x00000294F0620000-0x00000294F076E000-memory.dmp

Download

memory/3048-83-0x000001D4BDEA0000-0x000001D4BDEE4000-memory.dmp

Download

memory/3048-84-0x000001D4C04E0000-0x000001D4C0556000-memory.dmp

Download

memory/3048-85-0x000001D4C01D0000-0x000001D4C031E000-memory.dmp

Download