remus_stealer | e2bb18135f11abb5afa22fcd607183ff5cc5d2d499f8924a9a09dbe32ce7ecb9

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.5MB
Sample260831-shetvaxtax
SHA256 e2bb18135f11abb5afa22fcd607183ff5cc5d2d499f8924a9a09dbe32ce7ecb9
MD5 1fa3bdc81d4f4787ab95eb57ea88e9e8
SHA1 dcaa7cb175bb612d7fc01dd7a955e722c1c2ab25
SHA512 0661d96d45ede3612942b344ba068033e73f649d3bc4108f2b9c7eecc77a317df9ac00fb679a4f1619b3c0fd45d2e045b9e798c56558e9c0744ea463224528c9
SSDEEP 98304:tuSNHIdhytygmY6q9MK6JRcOEID1aFvI8c27UDeSCMmlUKfpyt95:tuSeuvxLWRXcOR4FvI8PDSz+YB
TLSH
T17646123BF28BA13EE46E5A3639729210853B7A2065164C1696ECF84CDF355B01E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer installer stealer

Malware Config

Extracted

Family

remus_stealer

http://cdire.shop:9048/tags
http://shhsift.click:7647/notifications
http://vexdico.shop:8539/documents

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 2 IoCs

pid	Process
5196	file.tmp
1164	core.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/460-0-0x0000000000D20000-0x0000000000E09000-memory.dmp	innosetup
behavioral2/memory/460-21-0x0000000000D20000-0x0000000000E09000-memory.dmp	innosetup

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5196	file.tmp
5196	file.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5196	file.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 5196	460	file.exe	90
PID 5196 wrote to memory of 1164	5196	file.tmp	91

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460
- C:\Users\Admin\AppData\Local\Temp\is-4G5SKNLF16.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4G5SKNLF16.tmp\file.tmp" /SL5="$400A4,4547326,890880,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Users\Admin\AppData\Roaming\MyApp\core.exe
    "C:\Users\Admin\AppData\Roaming\MyApp\core.exe"
    3⤵
    - Executes dropped EXE
    PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4G5SKNLF16.tmp\file.tmp
Size 4.2MB
SHA256 47c31a401cf832751309c6f9c29d9922315c2eeb99aec5aa692b364118f2fbbb
MD5 5b465b7b7e0661b667cbb456bda22c2c
SHA1 1ff01e4ee258774b6e180b559c08481826abc4d1
SHA512 fc77552dcb8a32b21d929fe01fe137a29e3fb94c14e8a60c66a378ec89d4b5b4622584916fb64e7a1fd90ba8ff85af83965f40470dd943988d9d81a10b61fb64
SSDEEP 98304:KiDj+6GqBH6KwsvcHJ4c91usxgkod1sc+333P/:XjpG5ucZus5Qn8/
TLSH
T1A7267D13F784653EE46B1A3A4837A254993B7E303A16CC477BFC298C4F396406D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.exe

Path C:\Users\Admin\AppData\Roaming\MyApp\core.exe
Size 6.0MB
SHA256 87b9bfdc7a429d3ead6750d706ff9d36afaf67a1b936b3c0cffe0fde029c3473
MD5 deeb26cf54ecd96403f1f07595150ebf
SHA1 6a729ff1185fc41b273ffe973ada1c7f328ab1d2
SHA512 68ca472484f14cd456e61bfe6ffe3ac08624ac64c030c915a1632cbdafb224bc439fd9cf644d0274334f288bd0bcaf3b33b1334f11d5f19ef90f9b9389d6c73d
SSDEEP 49152:L5YoGsbPsBuVSXcgEApaDjlc9EBj/an9ttttattta87WPv8Tjw5e:LSQZR7Bj0vdo
TLSH
T13B563907AA8590A9D869E735C9666114B274FC49D73233E33E51FAB06F623C1AF79F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-0-0x0000000000D20000-0x0000000000E09000-memory.dmp

Download

memory/460-21-0x0000000000D20000-0x0000000000E09000-memory.dmp

Download

memory/1164-19-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1164-22-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/5196-6-0x00000000018F0000-0x00000000018F1000-memory.dmp

Download

memory/5196-20-0x00000000002C0000-0x0000000000712000-memory.dmp

Download