remcos | c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
Size 821KB
Sample260810-rylrna1bqe
SHA256 c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739
MD5 7f6646bd139d7c4290ea8b89052406ba
SHA1 c54e240884fcf8d22055a133dc8792827e1a0bf3
SHA512 164deae6525a8e1d8c75d726e83b5c8ce4b77900f5a3b4de88d9823fec087cdc3f0bfd2d6388854de8665566794740c702f3ef88f65221934682dd473a912b1a
SSDEEP 12288:E1afeGm/Og8CFhhjOP83pfVJJG6YuhmG36r2KJemxB0xVBeOeIfWvLH0y6slCVVl:dfej/Og3FpVBIcyHxineOeIf0Uy6F
TLSH
T1950512E563E9DB19C27087F018B1E0310B746C6EE830D36A9EE5ACDF7AB5B159850B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tax-eg discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

TAx-EG

87.120.244.219:17598

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
59
keylog_path
%AppData%
mouse_option
false
mutex
ecg_acqwkvncxt
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe
5104	powershell.exe
2768	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3744	muSFNu.exe
4600	muSFNu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\muSFNu = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\p4aoer1pstg.ps1\""	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2096-6-0x00000000056D0000-0x00000000056E0000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 3744 set thread context of 4600	3744	muSFNu.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	muSFNu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
5104	powershell.exe
3612	powershell.exe
3612	powershell.exe
5104	powershell.exe
3612	powershell.exe
3744	muSFNu.exe
3744	muSFNu.exe
2768	powershell.exe
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeIncreaseQuotaPrivilege	5104	powershell.exe
Token: SeSecurityPrivilege	5104	powershell.exe
Token: SeTakeOwnershipPrivilege	5104	powershell.exe
Token: SeLoadDriverPrivilege	5104	powershell.exe
Token: SeSystemProfilePrivilege	5104	powershell.exe
Token: SeSystemtimePrivilege	5104	powershell.exe
Token: SeProfSingleProcessPrivilege	5104	powershell.exe
Token: SeIncBasePriorityPrivilege	5104	powershell.exe
Token: SeCreatePagefilePrivilege	5104	powershell.exe
Token: SeBackupPrivilege	5104	powershell.exe
Token: SeRestorePrivilege	5104	powershell.exe
Token: SeShutdownPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeSystemEnvironmentPrivilege	5104	powershell.exe
Token: SeRemoteShutdownPrivilege	5104	powershell.exe
Token: SeUndockPrivilege	5104	powershell.exe
Token: SeManageVolumePrivilege	5104	powershell.exe
Token: 33	5104	powershell.exe
Token: 34	5104	powershell.exe
Token: 35	5104	powershell.exe
Token: 36	5104	powershell.exe
Token: SeDebugPrivilege	3744	muSFNu.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe
Token: 35	2768	powershell.exe
Token: 36	2768	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2544	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 5104	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	89
PID 2096 wrote to memory of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 2096 wrote to memory of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 2096 wrote to memory of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 2096 wrote to memory of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 2096 wrote to memory of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 2096 wrote to memory of 2544	2096	c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe	91
PID 3612 wrote to memory of 3744	3612	powershell.exe	94
PID 3744 wrote to memory of 2768	3744	muSFNu.exe	96
PID 3744 wrote to memory of 4600	3744	muSFNu.exe	98
PID 3744 wrote to memory of 4600	3744	muSFNu.exe	98
PID 3744 wrote to memory of 4600	3744	muSFNu.exe	98
PID 3744 wrote to memory of 4600	3744	muSFNu.exe	98
PID 3744 wrote to memory of 4600	3744	muSFNu.exe	98
PID 3744 wrote to memory of 4600	3744	muSFNu.exe	98

C:\Users\Admin\AppData\Local\Temp\c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
"C:\Users\Admin\AppData\Local\Temp\c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe
  "C:\Users\Admin\AppData\Local\Temp\c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2544

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\p4aoer1pstg.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Roaming\muSFNu.exe
  "C:\Users\Admin\AppData\Roaming\muSFNu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\muSFNu.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Users\Admin\AppData\Roaming\muSFNu.exe
    "C:\Users\Admin\AppData\Roaming\muSFNu.exe"
    3⤵
    - Executes dropped EXE
    PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 c92db4c8cceedf2d2f7fcb0aca9a89cca47a1e8a70d0efa40546fb640a058006
MD5 d1ac453fabda65017ddf3e15ca570374
SHA1 20851ffbd27fae81a507d3bf863aad7b7522e712
SHA512 ec143daa9fcad1279e24a265f45b06ee4481a87ead8bae88121fb1ddf189b201e5ac6e275ebfe35f57292da2e25d943e00dd8a623398de722a04ebc105f61624
SSDEEP 384:T1eBaoT1iBGTGW14baR64/+w08F5ziT4Pn5IAXr4B+dWoVAzKwwvYbhNaPslRt/K:BexZ6G6Wi+R64/+w20xIAXrq+NQvbhNC
TLSH
T12DA2C578213F6DC7D8D216B010D20AA7FBE4D489DAB611D8BF1BDE2F4C90AB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2qi2bfgn.aw3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qi2bfgn.aw3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

p4aoer1pstg.ps1

Path C:\Users\Admin\AppData\Local\Temp\p4aoer1pstg.ps1
Size 1KB
SHA256 c56a65d97aa9973981aa360a18d02887ca8ea587acd0856979977d02d52405e0
MD5 72f45a6894f0cce4028811e456f327d4
SHA1 c5897d64eabc83f02be567cb497a368a7c7118c4
SHA512 9154f4be23226045a8242781dcd79f9391b4be98e437034d8c8edb8d8957f2a60e8f84aa36b7cfa4d566340a8a92d95ef485cfdbcaa5e1300f0ed59b7b22d343
TLSH
T1DD11915B8E8403C5506807F1451371CDB16D62CB27BF059058ADB4EEB32BE63787ADE5
MD5 SHA1 SHA512 TLSH

Submit Download

muSFNu.exe

Path C:\Users\Admin\AppData\Roaming\muSFNu.exe
Size 821KB
SHA256 c5e3d17805899e9fedc470a58989b20e8377af8a493e52023bc88665a80ed739
MD5 7f6646bd139d7c4290ea8b89052406ba
SHA1 c54e240884fcf8d22055a133dc8792827e1a0bf3
SHA512 164deae6525a8e1d8c75d726e83b5c8ce4b77900f5a3b4de88d9823fec087cdc3f0bfd2d6388854de8665566794740c702f3ef88f65221934682dd473a912b1a
SSDEEP 12288:E1afeGm/Og8CFhhjOP83pfVJJG6YuhmG36r2KJemxB0xVBeOeIfWvLH0y6slCVVl:dfej/Og3FpVBIcyHxineOeIf0Uy6F
TLSH
T1950512E563E9DB19C27087F018B1E0310B746C6EE830D36A9EE5ACDF7AB5B159850B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-4-0x0000000005500000-0x000000000550A000-memory.dmp

Download

memory/2096-5-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/2096-6-0x00000000056D0000-0x00000000056E0000-memory.dmp

Download

memory/2096-7-0x0000000074382000-0x0000000074383000-memory.dmp

Download

memory/2096-8-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/2096-9-0x00000000081E0000-0x000000000827C000-memory.dmp

Download

memory/2096-10-0x0000000008280000-0x0000000008336000-memory.dmp

Download

memory/2096-0-0x0000000074382000-0x0000000074383000-memory.dmp

Download

memory/2096-3-0x0000000005550000-0x00000000055E2000-memory.dmp

Download

memory/2096-2-0x0000000005A70000-0x000000000602A000-memory.dmp

Download

memory/2096-29-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/2096-1-0x0000000000900000-0x00000000009D4000-memory.dmp

Download

memory/2544-25-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2544-18-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2544-52-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2544-17-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2544-14-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2768-60-0x0000000006450000-0x000000000649C000-memory.dmp

Download

memory/2768-56-0x0000000005980000-0x0000000005CDB000-memory.dmp

Download

memory/2768-64-0x0000000007160000-0x0000000007203000-memory.dmp

Download

memory/2768-61-0x00000000712A0000-0x00000000712EC000-memory.dmp

Download

memory/3612-32-0x000002433DCD0000-0x000002433DCF2000-memory.dmp

Download

memory/5104-12-0x0000000002AE0000-0x0000000002B16000-memory.dmp

Download

memory/5104-33-0x0000000006330000-0x000000000634E000-memory.dmp

Download

memory/5104-34-0x0000000006710000-0x000000000675C000-memory.dmp

Download

memory/5104-38-0x00000000068E0000-0x0000000006916000-memory.dmp

Download

memory/5104-26-0x0000000005E00000-0x000000000615B000-memory.dmp

Download

memory/5104-39-0x0000000070AC0000-0x0000000070B0C000-memory.dmp

Download

memory/5104-43-0x0000000007520000-0x00000000075C3000-memory.dmp

Download

memory/5104-42-0x0000000006940000-0x0000000006960000-memory.dmp

Download

memory/5104-44-0x0000000007CC0000-0x000000000833C000-memory.dmp

Download

memory/5104-45-0x0000000007680000-0x000000000769A000-memory.dmp

Download

memory/5104-46-0x00000000076F0000-0x00000000076FA000-memory.dmp

Download

memory/5104-47-0x00000000078F0000-0x0000000007986000-memory.dmp

Download

memory/5104-22-0x0000000005530000-0x0000000005552000-memory.dmp

Download

memory/5104-50-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/5104-23-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/5104-24-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/5104-16-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/5104-21-0x00000000055F0000-0x0000000005C3A000-memory.dmp

Download

memory/5104-13-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download