remcos | c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
Size 795KB
Sample260810-rdjfsszgkc
SHA256 c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011
MD5 d55a52a7b51f7cc1ad1980f543bc1dbd
SHA1 56cb902024fcb77c61688fef112de3da3dfe6ae4
SHA512 89fc31ca12496444fd4cf5ad119e9947b8dabcf58cc8dc0fde74ed66bb7a09d949db943956bfc640dc7f5bc50d0f2ff4f010ca3c11893bbd82482b06345c2f6c
SSDEEP 24576:v3IgyCnoEiKa928H+BNuBXkyUQr6wRD4UbYl:v4CnoH9QyVhUQ+WD4U8l
TLSH
T1390512A0560ADE03E4960BB508B1F37A52B09D9DE500D71BDAFDDEDB7C1DA093D18AC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rtgs-neft discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

RTGS-NEFT

86.106.84.151:37393

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
nefty_ezvmhsvnzh
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3736	powershell.exe
4120	powershell.exe
240	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2396	yeiFWEYxOdvwe.exe
3908	yeiFWEYxOdvwe.exe
4380	yeiFWEYxOdvwe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeiFWEYxOdvwe = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\zbzaas2tv1c.ps1\""	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2552-6-0x0000000005850000-0x0000000005866000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 2396 set thread context of 4380	2396	yeiFWEYxOdvwe.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yeiFWEYxOdvwe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
4120	powershell.exe
4120	powershell.exe
240	powershell.exe
240	powershell.exe
2396	yeiFWEYxOdvwe.exe
2396	yeiFWEYxOdvwe.exe
2396	yeiFWEYxOdvwe.exe
2396	yeiFWEYxOdvwe.exe
3736	powershell.exe
3736	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe
Token: SeDebugPrivilege	2396	yeiFWEYxOdvwe.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeIncreaseQuotaPrivilege	3736	powershell.exe
Token: SeSecurityPrivilege	3736	powershell.exe
Token: SeTakeOwnershipPrivilege	3736	powershell.exe
Token: SeLoadDriverPrivilege	3736	powershell.exe
Token: SeSystemProfilePrivilege	3736	powershell.exe
Token: SeSystemtimePrivilege	3736	powershell.exe
Token: SeProfSingleProcessPrivilege	3736	powershell.exe
Token: SeIncBasePriorityPrivilege	3736	powershell.exe
Token: SeCreatePagefilePrivilege	3736	powershell.exe
Token: SeBackupPrivilege	3736	powershell.exe
Token: SeRestorePrivilege	3736	powershell.exe
Token: SeShutdownPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeSystemEnvironmentPrivilege	3736	powershell.exe
Token: SeRemoteShutdownPrivilege	3736	powershell.exe
Token: SeUndockPrivilege	3736	powershell.exe
Token: SeManageVolumePrivilege	3736	powershell.exe
Token: 33	3736	powershell.exe
Token: 34	3736	powershell.exe
Token: 35	3736	powershell.exe
Token: 36	3736	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4120	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	90
PID 2552 wrote to memory of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 2552 wrote to memory of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 2552 wrote to memory of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 2552 wrote to memory of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 2552 wrote to memory of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 2552 wrote to memory of 1072	2552	c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe	92
PID 240 wrote to memory of 2396	240	powershell.exe	95
PID 2396 wrote to memory of 3736	2396	yeiFWEYxOdvwe.exe	97
PID 2396 wrote to memory of 3908	2396	yeiFWEYxOdvwe.exe	99
PID 2396 wrote to memory of 4380	2396	yeiFWEYxOdvwe.exe	100
PID 2396 wrote to memory of 4380	2396	yeiFWEYxOdvwe.exe	100
PID 2396 wrote to memory of 4380	2396	yeiFWEYxOdvwe.exe	100
PID 2396 wrote to memory of 4380	2396	yeiFWEYxOdvwe.exe	100
PID 2396 wrote to memory of 4380	2396	yeiFWEYxOdvwe.exe	100
PID 2396 wrote to memory of 4380	2396	yeiFWEYxOdvwe.exe	100

C:\Users\Admin\AppData\Local\Temp\c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
"C:\Users\Admin\AppData\Local\Temp\c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe
  "C:\Users\Admin\AppData\Local\Temp\c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1072

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\zbzaas2tv1c.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe
  "C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- - C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe
    "C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe"
    3⤵
    - Executes dropped EXE
    PID:3908
- - C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe
    "C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe"
    3⤵
    - Executes dropped EXE
    PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 a67406d406bf8a2cb00fe975c49372dd9ff51bc877d61ea90cbd529f1f992761
MD5 989544a26c1c74fb99a4d7c9c028201b
SHA1 ad5999a2a24744a21fb83bdf77ca02d02ea6c453
SHA512 579e45dbabde29b9f403865d578ee8107d7b3d6ea1bfb56feef3ae6253eaeea8cd358bb543c84f0671d96116e0717972001a10ac6e88ccb0686d570adf359972
SSDEEP 384:/1eBaoT1iBGuOW14bAO68iAi+gejrr2PnZIAXr4B+BWIvyzKwYvYbhNaPMlRtXZM:dexZ6GRWiUO68Pi+B6RIAXrq+Lu3bhNa
TLSH
T117A2B478213F6DC7D8D226B410D10AF7FBE4D489DAB61194BF2BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_525z52bt.x5x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_525z52bt.x5x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zbzaas2tv1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\zbzaas2tv1c.ps1
Size 1KB
SHA256 f28c6b8a1f5544efde4830886ec87c87e2117f5c7d1a397f7ba3ca7bb904ee37
MD5 c1e6a5f20248703f77fec3d60a9aa071
SHA1 17e053e3d9fdaceed29a90df688e232450fc8dee
SHA512 6d6ad9a957ab88123b3ae785436fdcefde8b5d9d45e7236d80fab8286eee6e8ad7185e923f3f163dbbde4fd211c29838d28edbed7d43a003cf684f0591a3f626
TLSH
T15521234B8E4A47C504684BF58A1335CDB55DA0CF176F058094ACA4EEB32BD733869CE8
MD5 SHA1 SHA512 TLSH

Submit Download

yeiFWEYxOdvwe.exe

Path C:\Users\Admin\AppData\Roaming\yeiFWEYxOdvwe.exe
Size 795KB
SHA256 c961a6099fe726be83ed564f937b3f259cf6023451f09d6f22536ed4fba18011
MD5 d55a52a7b51f7cc1ad1980f543bc1dbd
SHA1 56cb902024fcb77c61688fef112de3da3dfe6ae4
SHA512 89fc31ca12496444fd4cf5ad119e9947b8dabcf58cc8dc0fde74ed66bb7a09d949db943956bfc640dc7f5bc50d0f2ff4f010ca3c11893bbd82482b06345c2f6c
SSDEEP 24576:v3IgyCnoEiKa928H+BNuBXkyUQr6wRD4UbYl:v4CnoH9QyVhUQ+WD4U8l
TLSH
T1390512A0560ADE03E4960BB508B1F37A52B09D9DE500D71BDAFDDEDB7C1DA093D18AC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-39-0x00000193D3D30000-0x00000193D3DAC000-memory.dmp

Download

memory/240-35-0x00000193D38C0000-0x00000193D38E2000-memory.dmp

Download

memory/1072-16-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1072-53-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1072-23-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1072-18-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2552-6-0x0000000005850000-0x0000000005866000-memory.dmp

Download

memory/2552-8-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/2552-1-0x0000000000680000-0x000000000074E000-memory.dmp

Download

memory/2552-2-0x0000000005870000-0x0000000005E2A000-memory.dmp

Download

memory/2552-10-0x0000000007620000-0x00000000076BC000-memory.dmp

Download

memory/2552-30-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/2552-9-0x0000000007950000-0x0000000007A06000-memory.dmp

Download

memory/2552-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

Download

memory/2552-7-0x00000000750C2000-0x00000000750C3000-memory.dmp

Download

memory/2552-5-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/2552-4-0x0000000005120000-0x000000000512A000-memory.dmp

Download

memory/2552-3-0x0000000005150000-0x00000000051E2000-memory.dmp

Download

memory/3736-66-0x0000000007660000-0x0000000007703000-memory.dmp

Download

memory/3736-60-0x0000000005F50000-0x00000000062AB000-memory.dmp

Download

memory/3736-62-0x00000000067D0000-0x000000000681C000-memory.dmp

Download

memory/3736-63-0x00000000717F0000-0x000000007183C000-memory.dmp

Download

memory/4120-29-0x0000000006520000-0x000000000687B000-memory.dmp

Download

memory/4120-32-0x0000000006930000-0x000000000697C000-memory.dmp

Download

memory/4120-31-0x00000000068D0000-0x00000000068EE000-memory.dmp

Download

memory/4120-24-0x0000000005B20000-0x0000000005B42000-memory.dmp

Download

memory/4120-40-0x0000000007A90000-0x0000000007AC6000-memory.dmp

Download

memory/4120-44-0x0000000007AF0000-0x0000000007B10000-memory.dmp

Download

memory/4120-25-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/4120-45-0x0000000007B10000-0x0000000007BB3000-memory.dmp

Download

memory/4120-41-0x0000000075970000-0x00000000759BC000-memory.dmp

Download

memory/4120-47-0x0000000007C50000-0x0000000007C6A000-memory.dmp

Download

memory/4120-46-0x0000000008290000-0x000000000890C000-memory.dmp

Download

memory/4120-48-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

Download

memory/4120-49-0x0000000007EC0000-0x0000000007F56000-memory.dmp

Download

memory/4120-26-0x0000000006330000-0x0000000006396000-memory.dmp

Download

memory/4120-52-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/4120-22-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/4120-13-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/4120-15-0x00000000750B0000-0x000000007586C000-memory.dmp

Download

memory/4120-14-0x0000000005CE0000-0x000000000632A000-memory.dmp

Download

memory/4120-12-0x0000000003090000-0x00000000030C6000-memory.dmp

Download