Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
26/08/2026, 03:19
General
- Target 2026-08-25_ee083dfc36dfb029686c1a4a3701fd77_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
- Size 627KB
- Sample260826-dvackaytdv
- SHA256 2a9f871fe819ade38f97899e7a9550f33deabfcd0bff7cbf55325eac28ba17f8
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
qq88 RemoteHost
-
admin.pafkasiino.top:25
-
api.pafkasiino.top:443
-
pafkasiino.top:8082
-
c2.pafkasiino.top:8080
-
exfil.pafkasiino.top:8888
-
login.pafkasiino.top:2223
-
panel.pafkasiino.top:9999
-
phishing.pafkasiino.top:3460
-
update.pafkasiino.top:1604
-
www.pafkasiino.top:2967
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
WinService.exe
-
copy_folder
service
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
c2
-
keylog_path
%WinDir%
-
mouse_option
false
-
mutex
Rmc-W6JUK1
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%WinDir%\System32
-
screenshot_time
5
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 15 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_ee083dfc36dfb029686c1a4a3701fd77_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ee083dfc36dfb029686c1a4a3701fd77_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service\WinService.exe"C:\Users\Admin\AppData\Roaming\service\WinService.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\program files (x86)\microsoft\edge\application\msedge.exe"c:\program files (x86)\microsoft\edge\application\msedge.exe"3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000005001⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WinService.exe
logs.dat
memory/3780-21-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-24-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-10-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-13-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-16-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-19-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-4-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-7-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-27-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-31-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-34-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-37-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-40-0x0000000140000000-0x00000001400AB000-memory.dmp
memory/3780-43-0x0000000140000000-0x00000001400AB000-memory.dmp