remcos | 96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846

Analysis

max time kernel
60s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe
Size 1.5MB
Sample260808-zb56sathpc
SHA256 96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846
MD5 3c9ce40c0c2c57409635dc63ff1bb759
SHA1 ab300679ac05d66cfa1ccbba6e9a94b11d10f947
SHA512 ab2068d5774dd848e3edcfbdc928c13568d94c0959894e76aac79048af80ba967eb4c1b26ab03c2d51405db3a769c74deec12ff99c2caaca24ad6ddbb0989d59
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0FP:+Tg3ZOcuUL3xAx/8b2S7Z0F
TLSH
T1BB7523FA8E706892D5BD563205AF0F6D35F54FF37A14AC4311713D2A2F3A267A920A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1516	AboutSettingsHandlers.exe
5456	AboutSettingsHandlers.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/924-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/924-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/924-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1516-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1516-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/1516-38-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 924 set thread context of 4280	924	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe	90
PID 1516 set thread context of 5456	1516	AboutSettingsHandlers.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2364	schtasks.exe
1444	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4280	924	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe	90
PID 924 wrote to memory of 4280	924	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe	90
PID 924 wrote to memory of 2364	924	96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe	91
PID 1516 wrote to memory of 5456	1516	AboutSettingsHandlers.exe	95
PID 1516 wrote to memory of 5456	1516	AboutSettingsHandlers.exe	95
PID 1516 wrote to memory of 1444	1516	AboutSettingsHandlers.exe	97

C:\Users\Admin\AppData\Local\Temp\96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe
"C:\Users\Admin\AppData\Local\Temp\96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe
  "C:\Users\Admin\AppData\Local\Temp\96ba8c4445f498bfa431b1bdeadb4bbbe36ed9423c77f1025f7c4cd138359846.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4280
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2364

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 589c8cfb19963c535dcfd38c16bd88db3ff2b4342b09519af7869b2337931d4a
MD5 c1df3cf99201d8560e40017443c86969
SHA1 11c9a2ec2ccbb939e8b5c13ccc5880ee3877ee7a
SHA512 add961228511786dd159f64aef4bd55c98bb8a48a08a77e00e3716a556b341108ac3956ef151fad83be73d6f5d36725f25ca62f12e17cc9e57a491951ea9c2e3
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fa:+Tg3ZOcuUL3xAx/8b2S7Z0U
TLSH
T1A87523FA8E706892D5BD563205AF0F6D35F54FF37A14AC4311713D2A2F3A267A920A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 204b0947677bf3d6963663615aee6508894e9e47ee51041d5a556d12c3cc7857
MD5 8698740666aed8567838e58af95434b0
SHA1 7099d89de88582c9c35843ce6b63180bf90f3fe1
SHA512 a820a1517e34361aa99748114072994531f1ade299a3096ac459779c926130448c8649240e16dcd8980819d7d8cecef04dd2ab464b2d01f2dd1da9f606ba2a88
TLSH
T10BA0124582218D40001028F0754E30C6904900283A6A091A50514B0802481416584111
MD5 SHA1 SHA512 TLSH

Submit Download

memory/924-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/924-1-0x0000000000DD0000-0x0000000000DD3000-memory.dmp

Download

memory/924-2-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/924-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/924-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/924-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1516-33-0x0000000000980000-0x0000000000983000-memory.dmp

Download

memory/1516-23-0x0000000000980000-0x0000000000983000-memory.dmp

Download

memory/1516-34-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1516-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/1516-38-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4280-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4280-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4280-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4280-3-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads