Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 10:56
General
- Target b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1.exe
- Size 994KB
- Sample260910-m1t4lagf29
- SHA256 b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1
Malware Config
Extracted
-
remcos
-
7.2.6 Pro
-
DON32UPX
-
217.60.195.33:17541
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-QO96S8
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1.exe"C:\Users\Admin\AppData\Local\Temp\b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1.exe"C:\Users\Admin\AppData\Local\Temp\b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1.exe"2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$l02k0j=Get-Date;$bqqgil=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$ppnope=[System.Environment]::TickCount;$ulhnro=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGpYTC5leGU=')));$ppnope=[System.Environment]::TickCount;& $bqqgil -FilePath $ulhnro"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\jXL.exe"C:\Users\Admin\AppData\Roaming\jXL.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\jXL.exe"C:\Users\Admin\AppData\Roaming\jXL.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\jXL.exe"C:\Users\Admin\AppData\Roaming\jXL.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\jXL.exe"C:\Users\Admin\AppData\Roaming\jXL.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
jXL.exe
memory/2636-24-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-15-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-56-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-55-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-53-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-54-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-51-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-52-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-49-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-50-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-11-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-12-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-13-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-42-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-16-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-41-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-17-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-40-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-36-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-35-0x0000000010000000-0x00000000100F7000-memory.dmp
memory/2636-23-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-34-0x0000000010000000-0x00000000100F7000-memory.dmp
memory/2636-31-0x0000000010000000-0x00000000100F7000-memory.dmp
memory/2636-25-0x0000000000400000-0x0000000000495000-memory.dmp
memory/2636-14-0x0000000000400000-0x0000000000495000-memory.dmp
memory/4128-10-0x00000000076B0000-0x0000000007790000-memory.dmp
memory/4128-3-0x0000000004E70000-0x0000000004F02000-memory.dmp
memory/4128-4-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/4128-2-0x00000000054E0000-0x0000000005A9A000-memory.dmp
memory/4128-0-0x0000000074602000-0x0000000074603000-memory.dmp
memory/4128-5-0x00000000745F0000-0x0000000074DAC000-memory.dmp
memory/4128-1-0x0000000000380000-0x0000000000480000-memory.dmp
memory/4128-6-0x00000000051C0000-0x00000000051CE000-memory.dmp
memory/4128-7-0x0000000074602000-0x0000000074603000-memory.dmp
memory/4128-8-0x00000000745F0000-0x0000000074DAC000-memory.dmp
memory/4128-9-0x0000000007B10000-0x0000000007BAC000-memory.dmp
memory/4128-18-0x00000000745F0000-0x0000000074DAC000-memory.dmp
memory/5292-22-0x000002770D710000-0x000002770D732000-memory.dmp
memory/5292-26-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/5292-28-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/5292-39-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/5292-19-0x00007FFA7978F000-0x00007FFA79790000-memory.dmp
memory/5292-27-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/5292-30-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/5292-29-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp