Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 19:18
General
- Target 0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a.dll
- Size 7.4MB
- Sample260818-x1bblaah63
- SHA256 0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a
Malware Config
Extracted
-
remcos
-
tee8/25
-
teebro1800.dynamic-dns.net:2195
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-NI6S7L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0db2854d288cd23225a48a4dcfc1288015b538059ffbf0f23aaff8a02779f44a.dll,#11⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5976-0-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-1-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-2-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-3-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-4-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-5-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-6-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-7-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-8-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-9-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-10-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-11-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-12-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-13-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-14-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-15-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-16-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-17-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-18-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-19-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-20-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-21-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-22-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-23-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-24-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-25-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-26-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-27-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-28-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-29-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-30-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-31-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-32-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-33-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-34-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-35-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-36-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-37-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-38-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-39-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-40-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-41-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-42-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-43-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-44-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-45-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-46-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-47-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-48-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-49-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-50-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-51-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-52-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-53-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-54-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-55-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-56-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-57-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-58-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-59-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-60-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-61-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-62-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-63-0x0000000001100000-0x000000000117F000-memory.dmp
memory/5976-64-0x0000000001100000-0x000000000117F000-memory.dmp