remus_stealer | 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
298s
max time network
186s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260822-akxtbstyby
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://kupzovo.shop:7567/posts
http://vexdico.shop:8539/webhooks
http://mrlketo.shop:8932/orders

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 1 IoCs

pid	Process
3252	526993537.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe:Zone.Identifier	Setup.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2656	cmd.exe
4812	cmd.exe
1196	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6108	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3252	526993537.exe
3252	526993537.exe
3252	526993537.exe
3252	526993537.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4812	4816	Setup.exe	83
PID 4816 wrote to memory of 1196	4816	Setup.exe	86
PID 4816 wrote to memory of 2656	4816	Setup.exe	88
PID 4816 wrote to memory of 3252	4816	Setup.exe	90
PID 4816 wrote to memory of 6108	4816	Setup.exe	92

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2656
- C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe
  C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Windows\SYSTEM32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

526993537.exe

Path C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe
Size 5.1MB
SHA256 6a406376be3f0dc3c700a8c637b5c4a111c8e013b49f2100dace21520aeec4b8
MD5 3e32d60a5fb71b7a658d69b31402934f
SHA1 03340851d47839d344cfb8c1880aff5b164de902
SHA512 9221a899e073f21388584c482bfb26b0402d1b4a017c647fc83a5da3df096b3ee6201c4098f64a9e5838b55144f0036895ea64988098bcabfbca9d382a70c135
SSDEEP 49152:S+Ux99IDm1FYHvHW5pbEvBDFT1FUrg7TmXi:pQ9kci/0uJFFXb
TLSH
T131365A07BCA545A9C0AAA734C9A787127B75BC88873233D72E50BA383F76BD05E75740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\data\saves\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/3252-273-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3252-274-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3252-275-0x0000000140000000-0x000000014003B000-memory.dmp

Download