remcos | 875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388

Analysis

max time kernel
60s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388.exe
Size 109KB
Sample260808-yzlllstfqe
SHA256 875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388
MD5 938aa0b19db38b74ce51c4bda526ab55
SHA1 46031fe0e7d310d8f86ba4e1cf53f2bde2db201c
SHA512 9d216ff7fb72fdb788111dd470a6c8b51ce616e8a755826e7d5494adce3ca515dac722082b8ea0a3b2d472657c862e16ab199be330f490b76c79ff1cb075a49b
SSDEEP 3072:pqReUeJHbdsDt2QYVKTRcRW/w9BY+zQMbd:prJHxsR1Rlw9W+zQMb
TLSH
T103B3F7077789C5B3E85516B01BC12F978BBC6C262AD5B857C388D0C11E7486AF329A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388.exe

C:\Users\Admin\AppData\Local\Temp\875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388.exe
"C:\Users\Admin\AppData\Local\Temp\875773234c8ba3063378bc9aea84ce4e0b82e563b5a53ef8dff4bb343e533388.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 b3cd4c064e46ef6c724b64ea9788de3610d7b98d2a1afb76025c44e99c6b0c47
MD5 76994c789dac3467cd27d23d6d96ecb1
SHA1 779f5211a9181c06f0c7a10ae4b350cbad0e01b9
SHA512 8aed18a3a889c666ec3aa87b28c6c97d83ad463a2907eb1aeea7ce737b910f276dd392d1df25abb235e9b72788967c3db516bd49664ab3847b420e804a06119c
TLSH
T167A0124582208E41011128F0B54C31C690050410356A091590014B0906480416A80231
MD5 SHA1 SHA512 TLSH

Submit Download