Analysis
- user interaction
yes - max time kernel
84s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 06:27
General
- Target Remcos_v7.2.6_Light.7z
- Size 45.5MB
- Sample260809-g7t5aascpc
- SHA256 7e94844bcec5692d54c9b61ef2faf94726bfc08830b434c04b2b7cc16a712e4c
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Remcos_v7.2.6_Light.7z"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zOC853E619\Remcos v7.2.6 Light.exe"C:\Users\Admin\AppData\Local\Temp\7zOC853E619\Remcos v7.2.6 Light.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Remcos_v7.2.6_Light\Remcos v7.2.6 Light.exe"C:\Users\Admin\Desktop\Remcos_v7.2.6_Light\Remcos v7.2.6 Light.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Remcos v7.2.6 Light.exe
Remcos_Settings.ini
Remcos_Settings.ini
Remcos_Settings.ini
libeay32.dll
ssleay32.dll
memory/3508-14-0x0000000007FE0000-0x0000000007FE1000-memory.dmp
memory/3508-15-0x0000000007FF0000-0x0000000007FF1000-memory.dmp
memory/3508-16-0x0000000008000000-0x0000000008001000-memory.dmp
memory/3508-17-0x0000000000400000-0x0000000001400000-memory.dmp
memory/3508-13-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/3508-12-0x0000000007FC0000-0x0000000007FC1000-memory.dmp
memory/3508-11-0x0000000007F90000-0x0000000007F91000-memory.dmp
memory/3508-10-0x0000000007A20000-0x0000000007A21000-memory.dmp
memory/3508-9-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/5836-31-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/5836-35-0x0000000009650000-0x0000000009651000-memory.dmp
memory/5836-36-0x0000000009660000-0x0000000009661000-memory.dmp
memory/5836-37-0x0000000000400000-0x0000000001400000-memory.dmp
memory/5836-41-0x0000000010000000-0x0000000010072000-memory.dmp
memory/5836-34-0x0000000009640000-0x0000000009641000-memory.dmp
memory/5836-33-0x0000000009630000-0x0000000009631000-memory.dmp
memory/5836-32-0x0000000009620000-0x0000000009621000-memory.dmp
memory/5836-30-0x0000000007FC0000-0x0000000007FC1000-memory.dmp
memory/5836-29-0x0000000007A30000-0x0000000007A31000-memory.dmp