remcos | 5640665b796ba1f43fa3813006910c8fa01e3f0ab82c16da4534432add7777a9

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SA Ordine Ref00145 1208026_docx .js
Size 2.1MB
Sample260813-nn8a5axthw
SHA256 5640665b796ba1f43fa3813006910c8fa01e3f0ab82c16da4534432add7777a9
MD5 a53e69d7cb7b7364ffe85377d387ea26
SHA1 80ef673f69ecd44d8f22e711894382c9d71e7bea
SHA512 64d8346d0da6d3a93f5c5d0fe032f876b73c74ce3be5f91b3b847d9a00f15f5d9ee0fa68c675e45dc12fee20b7f46799bb810d9773517007fc1847beb04ca254
SSDEEP 24576:vE0LIZgG2Vhc/FgEp6Ae35M5Uxainhx5H5HAM4:g
TLSH
T1C5A5E77279EE38E0636FD527A395ED6F2B2357F05697A168004AA3C203A33D2DFD1461
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

x64 collection defense_evasion execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

dentalux202.ydns.eu:58268
dentalux202bk.ydns.eu:58798

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7B2KOZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5032 created 1096	5032	powershell.exe	82

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gpupdate.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gpupdate.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 248	5032	powershell.exe	100

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5032	powershell.exe
4984	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3048	cmd.exe
2100	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4984	powershell.exe
4984	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeIncreaseQuotaPrivilege	5032	powershell.exe
Token: SeSecurityPrivilege	5032	powershell.exe
Token: SeTakeOwnershipPrivilege	5032	powershell.exe
Token: SeLoadDriverPrivilege	5032	powershell.exe
Token: SeSystemProfilePrivilege	5032	powershell.exe
Token: SeSystemtimePrivilege	5032	powershell.exe
Token: SeProfSingleProcessPrivilege	5032	powershell.exe
Token: SeIncBasePriorityPrivilege	5032	powershell.exe
Token: SeCreatePagefilePrivilege	5032	powershell.exe
Token: SeBackupPrivilege	5032	powershell.exe
Token: SeRestorePrivilege	5032	powershell.exe
Token: SeShutdownPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeSystemEnvironmentPrivilege	5032	powershell.exe
Token: SeRemoteShutdownPrivilege	5032	powershell.exe
Token: SeUndockPrivilege	5032	powershell.exe
Token: SeManageVolumePrivilege	5032	powershell.exe
Token: 33	5032	powershell.exe
Token: 34	5032	powershell.exe
Token: 35	5032	powershell.exe
Token: 36	5032	powershell.exe
Token: SeIncreaseQuotaPrivilege	5032	powershell.exe
Token: SeSecurityPrivilege	5032	powershell.exe
Token: SeTakeOwnershipPrivilege	5032	powershell.exe
Token: SeLoadDriverPrivilege	5032	powershell.exe
Token: SeSystemProfilePrivilege	5032	powershell.exe
Token: SeSystemtimePrivilege	5032	powershell.exe
Token: SeProfSingleProcessPrivilege	5032	powershell.exe
Token: SeIncBasePriorityPrivilege	5032	powershell.exe
Token: SeCreatePagefilePrivilege	5032	powershell.exe
Token: SeBackupPrivilege	5032	powershell.exe
Token: SeRestorePrivilege	5032	powershell.exe
Token: SeShutdownPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeSystemEnvironmentPrivilege	5032	powershell.exe
Token: SeRemoteShutdownPrivilege	5032	powershell.exe
Token: SeUndockPrivilege	5032	powershell.exe
Token: SeManageVolumePrivilege	5032	powershell.exe
Token: 33	5032	powershell.exe
Token: 34	5032	powershell.exe
Token: 35	5032	powershell.exe
Token: 36	5032	powershell.exe
Token: SeIncreaseQuotaPrivilege	5032	powershell.exe
Token: SeSecurityPrivilege	5032	powershell.exe
Token: SeTakeOwnershipPrivilege	5032	powershell.exe
Token: SeLoadDriverPrivilege	5032	powershell.exe
Token: SeSystemProfilePrivilege	5032	powershell.exe
Token: SeSystemtimePrivilege	5032	powershell.exe
Token: SeProfSingleProcessPrivilege	5032	powershell.exe
Token: SeIncBasePriorityPrivilege	5032	powershell.exe
Token: SeCreatePagefilePrivilege	5032	powershell.exe
Token: SeBackupPrivilege	5032	powershell.exe
Token: SeRestorePrivilege	5032	powershell.exe
Token: SeShutdownPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeSystemEnvironmentPrivilege	5032	powershell.exe
Token: SeRemoteShutdownPrivilege	5032	powershell.exe
Token: SeUndockPrivilege	5032	powershell.exe
Token: SeManageVolumePrivilege	5032	powershell.exe
Token: 33	5032	powershell.exe
Token: 34	5032	powershell.exe
Token: 35	5032	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3048	4856	wscript.exe	89
PID 3048 wrote to memory of 4984	3048	cmd.exe	91
PID 4984 wrote to memory of 2100	4984	powershell.exe	92
PID 2100 wrote to memory of 2848	2100	cmd.exe	94
PID 2100 wrote to memory of 3696	2100	cmd.exe	95
PID 2100 wrote to memory of 4140	2100	cmd.exe	96
PID 2100 wrote to memory of 4868	2100	cmd.exe	97
PID 2100 wrote to memory of 5032	2100	cmd.exe	98
PID 5032 wrote to memory of 248	5032	powershell.exe	100
PID 5032 wrote to memory of 248	5032	powershell.exe	100

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2848	attrib.exe
4140	attrib.exe
4868	attrib.exe
3696	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gpupdate.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1096
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\SA Ordine Ref00145 1208026_docx .js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SecurityHealthSystray.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:BYNMVXXWSXRQ))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SecurityHealthSystray.cmd" NKSLEZRWS"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\power_plan_c\power_plan_c.dat"
        6⤵
        Views/modifies file attributes
        
        PID:2848
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\power_plan_c\power_plan_c_TYTMOVOC.cmd"
        6⤵
        Views/modifies file attributes
        
        PID:3696
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\power_plan_c\power_plan_c.dat"
        6⤵
        Views/modifies file attributes
        
        PID:4140
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\power_plan_c\power_plan_c_TYTMOVOC.cmd"
        6⤵
        Views/modifies file attributes
        
        PID:4868
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XXTQSQTAKDL))"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious use of SetThreadContext
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthSystray.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\SecurityHealthSystray.cmd
Size 1.0MB
SHA256 e7d19d2e835e7dcc67479034d6f3fc179e9792bf7c76a1221cb039795ba52a27
MD5 382f2fc9bc24a24bc91a853611c22285
SHA1 9f328a666103f9a3cd64689c150fdc19b01d7086
SHA512 2bd07592ecdbd1a9c718a54e3f42286a751fc4a30d65f1e87d558af829ea7b3d6cea0ad77256bc7f27113823b01421eb0dace8192dabd0db87e1d991b6bca4f6
SSDEEP 24576:yx/W0HuJxLAkVxclpg/7al2OsC7lyF5pqPc16Fn:Uoj8k8Pn
TLSH
T15235237B4C502D6829F6C22793039B952FADFFDA53BAC5CF311D35A50E0E907EA5A021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
MD5 18a431e2bf1c7189baadfb9c408f62eb
SHA1 fc8e72f7c9ebcd482cc8d2c04b8bc8f606123c2d
SHA512 92552b76e6c27c94d721cd140e671db8bd23fbfc1085e099225c52eb8279a4ba90325ec9406f077c13a187e296745d880aec5c42e4b894b7dddf6d64aced536a
TLSH
T175218933B3DC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5ul2vbmf.2ta.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ul2vbmf.2ta.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-675-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-652-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-684-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-685-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-681-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-680-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-678-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-653-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-666-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-655-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-667-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-668-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-669-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-670-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-671-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-660-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-672-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-673-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-674-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-661-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-662-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-663-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-36-0x0000021A27E20000-0x0000021A27E21000-memory.dmp

Download

memory/248-38-0x0000021A27E00000-0x0000021A27E01000-memory.dmp

Download

memory/248-646-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-651-0x0000021A2D480000-0x0000021A2D481000-memory.dmp

Download

memory/248-665-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-679-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-664-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/248-654-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-656-0x0000000140000000-0x00000001400B0000-memory.dmp

Download

memory/248-657-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/4984-6-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-13-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-7-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-8-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-9-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-10-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-11-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-2-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp

Download

memory/4984-12-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-15-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-14-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-5-0x000002A6770E0000-0x000002A677102000-memory.dmp

Download

memory/4984-17-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-19-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/4984-16-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/5032-25-0x000001DD98CB0000-0x000001DD98CCE000-memory.dmp

Download

memory/5032-26-0x000001DD98CE0000-0x000001DD98D92000-memory.dmp

Download

memory/5032-27-0x000001DDFF2A0000-0x000001DDFF2AA000-memory.dmp

Download

memory/5032-28-0x000001DDFF330000-0x000001DDFF35A000-memory.dmp

Download

memory/5032-29-0x000001DDFF330000-0x000001DDFF354000-memory.dmp

Download

memory/5032-30-0x000001DD98850000-0x000001DD98858000-memory.dmp

Download

memory/5032-31-0x0000000180000000-0x0000000180040000-memory.dmp

Download