remcos | 05af0a9f4f8ac3e41af16dd40fd12c0b997860cf284c8e6d3ff344e79df13f3f

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice.js
Size 4.9MB
Sample260826-qqsdssel2x
SHA256 05af0a9f4f8ac3e41af16dd40fd12c0b997860cf284c8e6d3ff344e79df13f3f
MD5 2fced3460b70efdcc8437a3e78309823
SHA1 3e696ce3b397adce626ab4c5367a9956f116b642
SHA512 a05c52e427dafb989ee45f109bd69f222d75c19e7272b725652ae57d44b47b8687a1b49b31af346ae30f12c884343787f7e39be8c1a5ac294f6756104e7798cc
SSDEEP 24576:wnKP7deMHvfYEWquzrCkG+FI2pcxl1AMELF16YEXdAB2O7Tv6:RP7wSHYTzCYFI2pwl1VER16VXfO7T6
TLSH
T13836E8E1378A7299686BB21D844D2B1CCFCD94153F93F4AC7CCD1A84111BB8EA786D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost execution remcos persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Version

7.3.0 Pro

Botnet

RemoteHost

207.180.29.217:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JLGEWV
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5108	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUpdate_ps_dmr8wvNIrxKc_1787750904782.lnk	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_dmr8wvNIrxKc_1787750904782 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_dmr8wvNIrxKc_1787750904782.ps1\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_ps_dmr8wvNIrxKc_1787750904782 = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Temp\\ps_dmr8wvNIrxKc_1787750904782.ps1\""	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 4768	5108	powershell.exe	100

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5108	powershell.exe
5108	powershell.exe
5544	powershell.exe
5544	powershell.exe
5544	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5544	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 5108	2696	wscript.exe	89
PID 5108 wrote to memory of 248	5108	powershell.exe	94
PID 5108 wrote to memory of 4140	5108	powershell.exe	95
PID 5108 wrote to memory of 4544	5108	powershell.exe	96
PID 5108 wrote to memory of 4600	5108	powershell.exe	97
PID 5108 wrote to memory of 1140	5108	powershell.exe	98
PID 5108 wrote to memory of 2908	5108	powershell.exe	99
PID 5108 wrote to memory of 4768	5108	powershell.exe	100
PID 5108 wrote to memory of 4768	5108	powershell.exe	100
PID 5108 wrote to memory of 4768	5108	powershell.exe	100
PID 5108 wrote to memory of 4768	5108	powershell.exe	100
PID 5108 wrote to memory of 4768	5108	powershell.exe	100
PID 5108 wrote to memory of 4768	5108	powershell.exe	100
PID 5108 wrote to memory of 4768	5108	powershell.exe	100

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Invoice.js
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo -File "C:\Temp\ps_dmr8wvNIrxKc_1787750904782.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 ff15c5d89dc00f5d8f21dd0f85f0ec663329e981db4d1ecb71372f57368c2ec6
MD5 abbdfd0d0fbb111cc2ed9411c6220e8a
SHA1 ad5f5eac705e5ed2c9e0d1f9ae9c6a71150fab9b
SHA512 dd213def262881115d824e155e99d2d3b4908cabe3a9c3476e9c38c7514c3bcc3116907af664b901d75ff572493eaa4341d874c8d857d49658b642a8b1044d47
TLSH
T157B0128040853BF3461398F2118C457490A05174FDD636C1284B10340D0470C57FC016
MD5 SHA1 SHA512 TLSH

Submit Download

ps_dmr8wvNIrxKc_1787750904782.ps1

Path C:\Temp\ps_dmr8wvNIrxKc_1787750904782.ps1
Size 3.6MB
SHA256 8230da2f8078c055bcf4595b1a9405e78bdd4dc008fa9cc28970ac2b6b709d23
MD5 0cff0554241c3e17fdfeba8a919de463
SHA1 e7731794a04606291dc99da178daa9459553bbd4
SHA512 78f0526825d7ac28afdcd671e802fe878d8d66f4ce7986c8bd2997d15431b6725d521edfd6d10de5f8254ad36e06467361a4ced28f1006391505d37079ac8731
SSDEEP 12288:lpBzgv5iaLjzKcB71qaMaVJlggggg2N7hgfrKk1Gr+6+9vL674F9gDPQgIEBQKZT:GhAKi6MiQgdSn9s60ldR
TLSH
T1E006646136C42875E53EA8FA792B7B82612659E423C731D4CA2957F30CFBF9DBE02405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4768-57-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-39-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-56-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-49-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-48-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-72-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-40-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-25-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-73-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-35-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-34-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-31-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-30-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-27-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4768-26-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5108-13-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-17-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-23-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-22-0x000001B33E010000-0x000001B33E024000-memory.dmp

Download

memory/5108-6-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-20-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-33-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-19-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-18-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-24-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-16-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-2-0x00007FFFAD4BF000-0x00007FFFAD4C0000-memory.dmp

Download

memory/5108-12-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-47-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-11-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-10-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-9-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-7-0x00007FFFAD330000-0x00007FFFADCD4000-memory.dmp

Download

memory/5108-5-0x000001B33DF60000-0x000001B33DF82000-memory.dmp

Download

memory/5544-21-0x000001A6ED3E0000-0x000001A6ED428000-memory.dmp

Download