Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 15:17
General
- Target 3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb.exe
- Size 1.2MB
- Sample260810-spa48sha69
- SHA256 3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
RemoteHost
-
oceanking.noip.at:57834
-
dunday.mytunnel.org:51723
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AFJ0CJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb.exe"C:\Users\Admin\AppData\Local\Temp\3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\flqfv3cqy2b.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smWExChwt.exe"C:\Users\Admin\AppData\Roaming\smWExChwt.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\smWExChwt.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_5fync22m.gio.ps1
flqfv3cqy2b.ps1
smWExChwt.exe
memory/1680-5-0x0000000004CE0000-0x0000000004CEA000-memory.dmp
memory/1680-3-0x0000000005070000-0x0000000005102000-memory.dmp
memory/1680-7-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1680-8-0x0000000006580000-0x000000000661C000-memory.dmp
memory/1680-9-0x0000000006620000-0x0000000006746000-memory.dmp
memory/1680-6-0x0000000005320000-0x000000000532C000-memory.dmp
memory/1680-1-0x0000000004D10000-0x0000000005064000-memory.dmp
memory/1680-4-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1680-2-0x0000000005800000-0x0000000005DA4000-memory.dmp
memory/1680-0-0x0000000000160000-0x000000000029E000-memory.dmp
memory/2692-101-0x00000000077E0000-0x00000000077F4000-memory.dmp
memory/2692-91-0x0000000070CA0000-0x0000000070CEC000-memory.dmp
memory/2692-99-0x0000000007430000-0x00000000074D3000-memory.dmp
memory/2692-100-0x00000000077A0000-0x00000000077B1000-memory.dmp
memory/2692-90-0x0000000006500000-0x000000000654C000-memory.dmp
memory/2692-87-0x0000000005C20000-0x0000000005F74000-memory.dmp
memory/3164-78-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3340-45-0x000001EA39E00000-0x000001EA39E22000-memory.dmp
memory/3896-15-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-104-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-103-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-105-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-106-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-107-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-108-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-109-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-24-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-110-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-19-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-21-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-17-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-14-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-76-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-75-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3896-74-0x0000000000400000-0x000000000048D000-memory.dmp
memory/3960-20-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/3960-69-0x0000000007C20000-0x0000000007C3A000-memory.dmp
memory/3960-70-0x0000000007C00000-0x0000000007C08000-memory.dmp
memory/3960-68-0x0000000007B20000-0x0000000007B34000-memory.dmp
memory/3960-67-0x0000000007B10000-0x0000000007B1E000-memory.dmp
memory/3960-66-0x0000000007AE0000-0x0000000007AF1000-memory.dmp
memory/3960-65-0x0000000007B60000-0x0000000007BF6000-memory.dmp
memory/3960-64-0x0000000007950000-0x000000000795A000-memory.dmp
memory/3960-63-0x00000000078E0000-0x00000000078FA000-memory.dmp
memory/3960-62-0x0000000007F20000-0x000000000859A000-memory.dmp
memory/3960-61-0x00000000077A0000-0x0000000007843000-memory.dmp
memory/3960-60-0x0000000006B70000-0x0000000006B8E000-memory.dmp
memory/3960-52-0x0000000071DC0000-0x0000000071E0C000-memory.dmp
memory/3960-51-0x0000000007760000-0x0000000007792000-memory.dmp
memory/3960-37-0x0000000006630000-0x000000000667C000-memory.dmp
memory/3960-36-0x00000000065A0000-0x00000000065BE000-memory.dmp
memory/3960-16-0x0000000002C10000-0x0000000002C46000-memory.dmp
memory/3960-25-0x0000000005490000-0x00000000054B2000-memory.dmp
memory/3960-33-0x0000000005EE0000-0x0000000006234000-memory.dmp
memory/3960-27-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/3960-26-0x0000000005530000-0x0000000005596000-memory.dmp
memory/3960-18-0x00000000050C0000-0x00000000050D0000-memory.dmp
memory/3960-23-0x0000000005700000-0x0000000005D28000-memory.dmp