remcos | bdf1461dd96fa9ce83db1a380ed14c3ed274364931bb6956b8b2b198867d5497

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_62ba334f92dc40c513c1fa74c1a247ca_elex_parallax_remcos_remocs_wannacry.exe
Size 109KB
Sample260910-tlxdqssckd
SHA256 bdf1461dd96fa9ce83db1a380ed14c3ed274364931bb6956b8b2b198867d5497
MD5 62ba334f92dc40c513c1fa74c1a247ca
SHA1 f6fc5d5e43319af58e4d7ba418cf033ac11cdb84
SHA512 96d7d3aada85f1a406c15c3baa415939df322673daa8e1edeb6d5ff7ad321ff342bf321bbb901a53fcf86b1c2ad72bb179aa9a77f2a3e608eb78156f3c615049
SSDEEP 1536:NgMvmxGSIMjzfrf3gVwbB46eIEcWz0NsMnVUNsQV1xC/wDETZp9Y+zqh7lMcna0E:6QmBzgm4JIEcAMsgWIwyp9Y+zQMcd
TLSH
T12CB3F607360596A3E815C1B027417BA2EFBC782A169AB173C788D1819D74C4AF275BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_62ba334f92dc40c513c1fa74c1a247ca_elex_parallax_remcos_remocs_wannacry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1208	2026-09-10_62ba334f92dc40c513c1fa74c1a247ca_elex_parallax_remcos_remocs_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_62ba334f92dc40c513c1fa74c1a247ca_elex_parallax_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_62ba334f92dc40c513c1fa74c1a247ca_elex_parallax_remcos_remocs_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 9cc57e662e69ff54697b6dc2b43ae90d8dbaa73fa642ed1e73bbf7927d26d737
MD5 6611d5f58d63d905f73936c1211ad076
SHA1 8becb3b0992be0ac317df1d8bf3b2b3319a927a1
SHA512 d66bf844a8cdfcbc05539592a05ee9fa519cdaab261566599efcac7521017bde2f139619b8c5c05cd9d25b7ea80e3fa17b8180d5fc3c4d869545a844f5b8bfa7
TLSH
T16CA0245DD730CD47001134F0714D30C75045041031775705D0014F0C434F0017DC0151
MD5 SHA1 SHA512 TLSH

Submit Download