remus_stealer | c3797af4b5fddb4175fe232c8c737abd54771dc72b130e8f98ea63900fd5c961

Analysis

user interaction
yes
max time kernel
8s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 4.6MB
Sample260819-bcbrkatfmd
SHA256 c3797af4b5fddb4175fe232c8c737abd54771dc72b130e8f98ea63900fd5c961
MD5 f82c8cefbe4905f4260c2b2238411a20
SHA1 2347770ca04aa33eb77b224a460410594e125537
SHA512 44c3074ed105b0ffb625e0375264f6cdaeae074e8e1b333e47b4290f25ed0e54f068e6669929ed13418546e9906da7d077d592788254e61e5154bf5ccf2d4edd
SSDEEP 98304:rKAijPjGxi5Rr+J2fur6PeecceEPcQzhfovhN:rUCxi7a2qAHPcQzeZN
TLSH
T1C3261206E79430EDE166D8708846D701F7717C886760DAAB2BE8FE5B2F63190E82D735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution remus_stealer stealer

Malware Config

Extracted

Family

remus_stealer

http://glimqra.click:6534/files
http://vexdico.shop:8539/profiles
http://shkpiva.shop:5627/projects

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4524	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2280	file.exe
844	ae_mixtwo.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3752	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae_mixtwo.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1396	msedge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3484	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	Setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4524	powershell.exe
4524	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2280	3448	Setup.exe	86
PID 3448 wrote to memory of 3752	3448	Setup.exe	88
PID 3448 wrote to memory of 844	3448	Setup.exe	89
PID 3752 wrote to memory of 4524	3752	WScript.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RunSilent.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\OpenLink.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff9d159c188,0x7ff9d159c194,0x7ff9d159c1a0
        5⤵
        
        PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2020,i,2543364861034400461,11894898216583560824,524288 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,12819283582105698453,5444042707669551520,262144 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        5⤵
        
        PID:4520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2588,i,2908097502736560521,11086246410774088167,524288 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:8
        5⤵
        
        PID:5100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15495021571876149453,15157703864057395533,2097152 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,604420692052445185,12093794817344323280,2097152 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:3276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,11244794982461437144,15159432457817509247,2097152 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        
        PID:3372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,13386346197631184030,1964052472039821423,2097152 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
        5⤵
        
        PID:2188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3584,i,2999283017251957684,539801873711750957,524288 --field-trial-handle=2296,i,16757424703650080996,15932752813534003478,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
        5⤵
        
        PID:3784
- C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe
  "C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6226e964da8553d7488d5c609938a7424a05e32e915e0d0f45cf3b20f173f9c2
MD5 626454bc148f69b828416b03cb8dd12d
SHA1 3c4cb7bcfbab13eb5b07ed97411d09ed34fbddeb
SHA512 3187024ac2582b959349b79c79f15a528f854e1a06f27a2f94b697f5cfb16420e03048d3c64a234ae64aa2efb99db9647f0a0e4d6494b2c024b7fbe4f7415278
SSDEEP 192:pON26O7+3iQmiUyeButtb0sO2b/H5EXcNRqKjU6:pON26QFut9xOsHeEjU6
TLSH
T17A121835787CAC631EE2B545F9C7266B8FA410BBDC466F40D5E84E0C00DB69C274B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab44f52f-66f6-453b-bd49-37b4b87c9114.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab44f52f-66f6-453b-bd49-37b4b87c9114.tmp
Size 8KB
SHA256 34f79802c044ecf4ff7997ea6136fc3ae0cfa93116a8ae27108f8b30259dfde5
MD5 fbd3db4e6c70ff23b1d8bd89777368c2
SHA1 e17d0e4bc700331d30fb8f5081addde17c612ddc
SHA512 00ca24ac24e2f7a6c23432c8328d24bf82cff4d11ab6b51ebd7d1c9c40f83312b56959cf0b53b4f3a3aeeb8b5fe72bac741e787efdc3aca33789464f9310e0d6
SSDEEP 192:qONQ6O7+3hQmiUyfBGttb0sO2b/WgG6rU6:qONQ61yGt9xOsIoU6
TLSH
T16602F8357D782CA78EF2AD45F68727279FA5103BE9952F40DAE81E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenLink.ps1

Path C:\Users\Admin\AppData\Local\Temp\OpenLink.ps1
Size 208B
SHA256 09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42
MD5 9b3d5b2419f4d77a5828171e0b1c4707
SHA1 7e7a6081c35b68da1b736ddd46df618514eecc5b
SHA512 22d48ad71613f63e908e179e24ab2551b29f471157a582aab9941cb8c9aaa0e6b7480898390c4cf1beafe034f1864fa7bccc8f378ed3d0937cdf820d1684ee7a
TLSH
T176D02213882F04736F2000898330327BF9C2626C53878202EC90888D340033E3DF8308
MD5 SHA1 SHA512 TLSH

Submit Download

RunSilent.vbs

Path C:\Users\Admin\AppData\Local\Temp\RunSilent.vbs
Size 580B
SHA256 df325751b971983c74eec2d16afc4ab0bf159418074e75fc6362e2587473369c
MD5 fcb30558a79e52b635bc9a32ed1ea26f
SHA1 7d3de9653198336971acb1ad692e30e78b3cc69a
SHA512 e9aa271b49184388aaf5d972d11d01f7ba087a03f0d59b34820e2a289543f514f4d8098ef7c49fdf95ab5c17c2cfa9ed712a97b3c79e21cec3718a8a5d0e856c
TLSH
T1BBF08B82ED7BC255CD6B8A1E42ABC92CC7FBB3147230D2035E70AC0874096E4C66E586
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ushvndwk.tve.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ushvndwk.tve.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ae_mixtwo.exe

Path C:\Users\Admin\AppData\Local\Temp\ae_mixtwo.exe
Size 1.2MB
SHA256 45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b
MD5 17ad22af995ee858a4164452c2f80e4a
SHA1 e09da2824df6f1104b72c2b570be207ef3716f3d
SHA512 058efb3efb1b41c4c1e6db6b9fe9ce907ed24528a512c41f40e0e41555cd61c031c7516e1d8822446edbcd6edab39bc3517d328d139ec269c9c84e86b0eb9eb3
SSDEEP 24576:KSiSdl5VWDWg26xdFo9L0hlxoJc5+Zm7mWMH1VvxamJ/hk:KZSJVWDsMy9QhUK7Exaek
TLSH
T1E84525343AFA502AF1B3EF769AE474D6CA6FB7733B07645D1090038A4A13A41DED153A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-30-0x0000000003220000-0x000000000322A000-memory.dmp

Download

memory/844-29-0x0000000000C50000-0x0000000000D8A000-memory.dmp

Download

memory/844-76-0x0000000003250000-0x0000000003266000-memory.dmp

Download

memory/2280-24-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/2280-92-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/4524-31-0x000001DDED7E0000-0x000001DDED802000-memory.dmp

Download