remcos | eddc76033cea510a91a36ba5a6bfbc545986e51cbbb2a47e9601f777e4b951d8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Advice_id_103555_ref_21503033.js
Size 520KB
Sample260815-phackswbrb
SHA256 eddc76033cea510a91a36ba5a6bfbc545986e51cbbb2a47e9601f777e4b951d8
MD5 7112234ca030f72009f72945a486afad
SHA1 f677cc2faa0ce7df37409a75d271fd19d673de93
SHA512 21d74ad80772f8d9b4ba5bb6ef79b8b7d5cb196bcc0950cca6d5dd6a21a1d6c97433e2f06ebe62158f2c8405ef2035c72b9ae390aab3817d15649fb331452b43
SSDEEP 6144:2kU9tEuG+WjmICE+PHMDEP8b1l62kSaR/hVNKNrE2B:2k2EuOmAWHMDx42kSg/hVNKNoM
TLSH
T117B4538D4539F51514241E509FC18CD12B2D8E8F4F5E8D4FBD4E8BFCAAE61E800A7AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost execution remcos persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

7.2.5 Pro

Botnet

RemoteHost

mainhold.duckdns.org:6040
winnerscorner.gleeze.com:6040

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LRZOMJ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 7 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe
11	5016	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4656 created 3304	4656	powershell.exe	55

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4656	powershell.exe
9	4656	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4656	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	4656	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
9	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1588	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4656	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4656	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1588	4356	wscript.exe	87
PID 1588 wrote to memory of 4656	1588	wscript.exe	88
PID 4656 wrote to memory of 5016	4656	powershell.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3304
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\Temp\Advice_id_103555_ref_21503033.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\17rdmsucf3fy\17rdmsucf3fy.vbs
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\17rdmsucf3fy\17rdmsucf3fy.ps1"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4656
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  PID:5016

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17rdmsucf3fy.ps1

Path C:\Users\Admin\AppData\Local\Temp\17rdmsucf3fy\17rdmsucf3fy.ps1
Size 1KB
SHA256 b727f5fbc10e87e2138629779048fa98da520993ad9f2f103aefc67d96000f38
MD5 71ddb5f2bee40fb5ed45cd3ce4168d46
SHA1 fc224031b63d61fbbab2a98ae2c5ca48fa9c0e9a
SHA512 73833556d3557eac0993c558373f5b3426a459dbabf1146a6257330598f121c78a34adf832b2e22835cd8a128acc8662c95c39f502de688bec3eb43f7bdc6c1b
TLSH
T1C93124319287D79841405163B6635AC880B5894C6BCB7FCEB277DC6C138F08DD5E6286
MD5 SHA1 SHA512 TLSH

Submit Download

17rdmsucf3fy.vbs

Path C:\Users\Admin\AppData\Local\Temp\17rdmsucf3fy\17rdmsucf3fy.vbs
Size 230B
SHA256 fb4a5c7d6787a5c1f84f24d597380d59801bb4245e1dfaace1220730adeeb34c
MD5 6b7e9b6e2c591dee9ab202a75743b5cc
SHA1 3ad3171ea8e7da03333c0e288d6fe6c42a1ed58b
SHA512 35ddaa5c1531cdfd885b2c630ad39e6a353f99550c8c813582546d600126c51e67b88c1acde12bd76315744caf6597ab94ed4318da57191cedeca5fa38472b43
TLSH
T11FD0A725753AD21CCC25C46A0063863C85D354D825445B5267B19D18B68A17DCE9A249
MD5 SHA1 SHA512 TLSH

Submit Download

17rdmsucf3fya

Path C:\Users\Admin\AppData\Local\Temp\17rdmsucf3fy\17rdmsucf3fya
Size 64KB
SHA256 2a4b879ee58ee0849817837563aee53322fe33dd669f78f74f21455c27ac1743
MD5 a4daee9849fe389fa193990622c2010e
SHA1 d4ce2ccc2ff46bb78dc8eca69fc42a3bfcbda374
SHA512 ea95071f2e4c5e891a9e308ae3c06208eef69edde14a948de5d883f0ee8044133a6f08e2128ab47a884b5ad127952846666c880ad8d94078a5ec2780fdfbb60f
SSDEEP 1536:IRzO38oAJC+XLydbROH24o9pn9AGcPCLI4nMoZ5m98K:Il2IJHWdNOP+pnWx4MG5Wz
TLSH
T18F5312502D66AFEB56885E10A9231F6F3F90D22149CF6AF4FFF2316344508499D2749F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17rdmsucf3fyb

Path C:\Users\Admin\AppData\Local\Temp\17rdmsucf3fy\17rdmsucf3fyb
Size 64KB
SHA256 9344d0c417d1567f95d0f15c435de8a7be5142cce3952dc20c4467e817ee977f
MD5 af241a2e56f00e4ef108a1cae7158d17
SHA1 241d1b784e646e4bfe6c3c862ec130a22ad0bb4f
SHA512 3448e13f6d8ea109315e30d2f25ab61b672ba1c6a829c199d12da9195c5b76ef2eb87ea9d531c7fa282ba05a18039395a7acfaebb4248041886b1fe2f3f51d58
SSDEEP 1536:HQB6Oy9BGCkXmqIcnUZDjGrubevtLfPogT/uYKq3ElxymR:H8Ly9HJqIrZPGrsEfge2YKdlxymR
TLSH
T15B5302EAC743420F6E3939EFAF86070A557814C788BFEC15085C59F2B85F709BD9A824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4tot0oxl.sok.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4tot0oxl.sok.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4656-12-0x0000015FFEAB0000-0x0000015FFEAD2000-memory.dmp

Download

memory/4656-18-0x0000015FFED20000-0x0000015FFED6E000-memory.dmp

Download

memory/4656-19-0x0000015FFC520000-0x0000015FFC532000-memory.dmp

Download

memory/5016-20-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-21-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-23-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-25-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-26-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-27-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-28-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-29-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-30-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-31-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5016-33-0x0000000140000000-0x00000001400AB000-memory.dmp

Download