remcos | 877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de

Analysis

max time kernel
58s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe
Size 645KB
Sample260901-zdndraxbmc
SHA256 877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de
MD5 79b3207ab108464ab6aaa377af6cc471
SHA1 f53fadc5b480f2812b6b0db22f287a4199a4aed3
SHA512 a727771e55da97c67ebbdcd9fd031bd8d17df96296e4b263c8b7af7a7cf74f0282d38abc2838841c5862c9798c8fd6b1d29e3e9c5bf2f10c86a49846da08f009
SSDEEP 12288:BIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:G5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T1DAE46D59A39402F8D0B7C135C982953BE7B27C065571472F03E70E9B2F276A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

qh88.bedefiant.gg:443
h13.games:443
8kbet5.com:443
nadur8k.com:443
8kbet.poker:443
8kbets8.com:443
qh88w.com:443
qh88best.com:443
qh88gg.com:443
qh88m.net:443
qh88us.com:443
123u7gf1.com:443
trafficono.me:443
tt88.zip:443
s666hp.com:443
alo789tet.com:443
kuwinad.com:443
qh88.es:443
uu88.ws:443
slot91.co:443
slotticagiris.live:443
superslot55.co:443

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
WinService.exe
copy_folder
service
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc_c2-7JN76A
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe

Executes dropped EXE 1 IoCs

pid	Process
4564	WinService.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc_c2-7JN76A = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc_c2-7JN76A = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	WinService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc_c2-7JN76A = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	WinService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc_c2-7JN76A = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 4032	4564	WinService.exe	86
PID 4032 set thread context of 1612	4032	iexplore.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3336	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3336	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4032	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4032	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4564	4572	877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe	85
PID 4564 wrote to memory of 4032	4564	WinService.exe	86
PID 4032 wrote to memory of 1612	4032	iexplore.exe	88

C:\Users\Admin\AppData\Local\Temp\877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe
"C:\Users\Admin\AppData\Local\Temp\877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Roaming\service\WinService.exe
  "C:\Users\Admin\AppData\Roaming\service\WinService.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4564
- - \??\c:\program files\internet explorer\iexplore.exe
    "c:\program files\internet explorer\iexplore.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:1612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x448 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 248B
SHA256 32829f48c1185b34d3b5cafe4f017a8653a63f82eb9135ab97be3c8476d82d62
MD5 aac0ea69512d96d36702e689ff3c4dbd
SHA1 2b5f00ca4aa9c43be207a41a05cf5f5d716820af
SHA512 a0796516ddc5a0755476a74c2327d22504db4d5ff6820ed220aa2221493bfb4232d342763d2d13e59994a12de517b8ff6e549f01c7b004857e6cef26722d8779
TLSH
T1D6D02B554513C5E080E50166942139A439C124013B0438D76FD71477F17995372840CA
MD5 SHA1 SHA512 TLSH

Submit Download

WinService.exe

Path C:\Users\Admin\AppData\Roaming\service\WinService.exe
Size 645KB
SHA256 877bc9b9c8ec7c49a28574c4193af1a3518cf71326f0b6adcb0037d06f6868de
MD5 79b3207ab108464ab6aaa377af6cc471
SHA1 f53fadc5b480f2812b6b0db22f287a4199a4aed3
SHA512 a727771e55da97c67ebbdcd9fd031bd8d17df96296e4b263c8b7af7a7cf74f0282d38abc2838841c5862c9798c8fd6b1d29e3e9c5bf2f10c86a49846da08f009
SSDEEP 12288:BIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:G5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T1DAE46D59A39402F8D0B7C135C982953BE7B27C065571472F03E70E9B2F276A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1612-14-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/4032-8-0x0000022A91F50000-0x0000022A91FFF000-memory.dmp

Download

memory/4032-13-0x0000022A91F50000-0x0000022A91FFF000-memory.dmp

Download

memory/4032-17-0x0000022A91F50000-0x0000022A91FFF000-memory.dmp

Download

memory/4032-21-0x0000022A91F50000-0x0000022A91FFF000-memory.dmp

Download

memory/4032-25-0x0000022A91F50000-0x0000022A91FFF000-memory.dmp

Download

memory/4032-29-0x0000022A91F50000-0x0000022A91FFF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads