Analysis
- max time kernel
60s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 20:04
Behavioral task
behavioral1
Sample
b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
60 seconds
Behavioral task
behavioral2
Sample
b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
60 seconds
General
- Target b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe
- Size 626KB
- Sample260821-ytmlqa1sg1
- SHA256 b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593
- MD5 19161f213a3e922c91d28c41ce19a59f
- SHA1 62814c9758380dce5b366b42c6f8aaf38cff6e13
- SHA512 eea214d76c8dfc574dfaaf984af2488ced1d27998b31c5dc5f6430a45548e49580d7b891a986a808ad4d771b87a9941cba4c36e8059eedce2c484e5d3dca63fa
- SSDEEP 12288:cZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:qQKjlZQuaVWoqVpqsuJt6YcJYY05
- TLSH T1CDD47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.6 Pro
Botnet
-
RemcosRemoteHost
C2
-
backdoor.ditscol.co:8080
-
www.ditscol.co:8080
-
c2.ditscol.co:8080
-
malware.ditscol.co:8080
-
admin.ditscol.co:8080
-
api.ditscol.co:8080
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
winservice.exe
-
copy_folder
service
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y54L7F
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%WinDir%\System32
-
screenshot_time
15
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 15 3768 winservice.exe 15 3768 winservice.exe 31 3768 winservice.exe 31 3768 winservice.exe 17 3768 winservice.exe 17 3768 winservice.exe 14 3768 winservice.exe 14 3768 winservice.exe 35 3768 winservice.exe 35 3768 winservice.exe 51 3768 winservice.exe 51 3768 winservice.exe 6 3768 winservice.exe 6 3768 winservice.exe 8 3768 winservice.exe 8 3768 winservice.exe 9 3768 winservice.exe 9 3768 winservice.exe 5 3768 winservice.exe 5 3768 winservice.exe 18 3768 winservice.exe 18 3768 winservice.exe 43 3768 winservice.exe 43 3768 winservice.exe 38 3768 winservice.exe 38 3768 winservice.exe 39 3768 winservice.exe 39 3768 winservice.exe 13 3768 winservice.exe 13 3768 winservice.exe 10 3768 winservice.exe 10 3768 winservice.exe 36 3768 winservice.exe 36 3768 winservice.exe 37 3768 winservice.exe 37 3768 winservice.exe 28 3768 winservice.exe 28 3768 winservice.exe 52 3768 winservice.exe 52 3768 winservice.exe 54 3768 winservice.exe 54 3768 winservice.exe 55 3768 winservice.exe 55 3768 winservice.exe 21 3768 winservice.exe 21 3768 winservice.exe 23 3768 winservice.exe 23 3768 winservice.exe 30 3768 winservice.exe 30 3768 winservice.exe 57 3768 winservice.exe 57 3768 winservice.exe 40 3768 winservice.exe 40 3768 winservice.exe 46 3768 winservice.exe 46 3768 winservice.exe 33 3768 winservice.exe 33 3768 winservice.exe 42 3768 winservice.exe 42 3768 winservice.exe 34 3768 winservice.exe 34 3768 winservice.exe 58 3768 winservice.exe 58 3768 winservice.exe - Executes dropped EXE 1 IoCs
pid Process 3768 winservice.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Y54L7F = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\winservice.exe\"" b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-Y54L7F = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\winservice.exe\"" b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Y54L7F = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\winservice.exe\"" winservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-Y54L7F = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\winservice.exe\"" winservice.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Screenshots\time_20260821_210448.jpg winservice.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3768 winservice.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3768 winservice.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3644 wrote to memory of 3768 3644 b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe"C:\Users\Admin\AppData\Local\Temp\b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Roaming\service\winservice.exe"C:\Users\Admin\AppData\Roaming\service\winservice.exe"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3768
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\service\winservice.exe
- Size 626KB
- SHA256 b9208911c04b24ae571271eef1ed35153d247acb218ff7343ca462f1999c5593
- MD5 19161f213a3e922c91d28c41ce19a59f
- SHA1 62814c9758380dce5b366b42c6f8aaf38cff6e13
- SHA512 eea214d76c8dfc574dfaaf984af2488ced1d27998b31c5dc5f6430a45548e49580d7b891a986a808ad4d771b87a9941cba4c36e8059eedce2c484e5d3dca63fa
- SSDEEP 12288:cZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:qQKjlZQuaVWoqVpqsuJt6YcJYY05
- TLSH T1CDD47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
- MD5 SHA1 SHA512 SSDEEP TLSH