remcos | 5b3a81a89f578c2459f8fc9c0fe473d224bf6d4b45e2239b6436398b59372eda

Analysis

max time kernel
149s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transaction_02023.js
Size 58KB
Sample260924-ml4dqaserb
SHA256 5b3a81a89f578c2459f8fc9c0fe473d224bf6d4b45e2239b6436398b59372eda
MD5 71a5f6f74bca9fe338ccc2daca9517a5
SHA1 a75479b799377d163113f44867b4a8a080704383
SHA512 b609dddabdb48a64f6acab1c0c835955de1121a74403863b4e7d4736cecfa58aef29ac545808aa5f52f6ee73deababb521c27c95cd9b09c4a465d8ed7e3801dc
SSDEEP 768:hi5KKtGcatkp1IzQNnDRlPiQZDQEKrR9Cj0NWe9HLtc6WAnG5fS5MWCy2BvHCJpW:YcKtPDl7KVW6HLtBmq5MWCy2BvHCJpuR
TLSH
T14443C777C2974179837CB190C10BE11EDBB74920D4EEAC8DA55A66FEEBAC8271076730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost defense_evasion execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

ocean012.duckdns.org:7474
oceanbiggi907.duckdns.org:7474

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
yut-QEKAE1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3412	cmd.exe	89

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4540	powershell.exe
2	4540	powershell.exe
3	4540	powershell.exe
5	4540	powershell.exe
6	4540	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3324	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 4720	4540	powershell.exe	102

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5044	cmd.exe
1928	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3212	taskkill.exe
2892	taskkill.exe
3092	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4540	powershell.exe
4540	powershell.exe
3324	powershell.exe
3324	powershell.exe
4540	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4540	5044	cmd.exe	92
PID 4540 wrote to memory of 3656	4540	powershell.exe	93
PID 3656 wrote to memory of 5728	3656	csc.exe	94
PID 4540 wrote to memory of 3324	4540	powershell.exe	95
PID 3324 wrote to memory of 1928	3324	powershell.exe	97
PID 1928 wrote to memory of 2892	1928	cmd.exe	99
PID 1928 wrote to memory of 3092	1928	cmd.exe	100
PID 1928 wrote to memory of 3212	1928	cmd.exe	101
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102
PID 4540 wrote to memory of 4720	4540	powershell.exe	102

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Transaction_02023.js
1⤵
PID:5656

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .($env:ComSpec[4,26,25]-join'') $env:bdfhcdpcz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .($env:ComSpec[4,26,25]-join'') $env:bdfhcdpcz;
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oumyksgr\oumyksgr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E04.tmp" "c:\Users\Admin\AppData\Local\Temp\oumyksgr\CSC809B0397BDB0441C93C337FFA75E7469.TMP"
      4⤵
      PID:5728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85cc2152b8554cac3352c9cf3cb30a79ad427309940cabc2b3a4c496084f8dc5
MD5 959e1b4918203c51928cb5a717a9dbf3
SHA1 bec8d10e1a38546b4c57fd1b30c624a7dc9a55ca
SHA512 ae841fca8446900c2bb270869687dbd9d0a0082540fd221e145d345d4cf547c4b01bd3aefc4a091577c9966d52d3ba15e72f9518124172e390e655acc761e93c
TLSH
T1E3213633B3DC8615D889407A50CEAC1436B697DB809E8E5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

RES5E04.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5E04.tmp
Size 1KB
SHA256 89940ca5af82fb783c845dca8aaa58421a484bb9c68f6533961da31f2e32ed59
MD5 a0da7338cf91c68f6c56af50fa0eaf97
SHA1 87acbd8a06098bb4b1b369821e85ef135e3aef67
SHA512 58e36f760c2e589ae9234b536a978b9f5550ebb23c95a931f33f667162995156aa4d8a12495e6822ec8df99c80f3ce7dd8647e6316accb5cfefddca8565ef9f2
TLSH
T10E21890543EC471EF0B34B31A9FA072FA275FD69EFA2936A854002692C11504EEA1F73
MD5 SHA1 SHA512 TLSH

Submit Download

oumyksgr.dll

Path C:\Users\Admin\AppData\Local\Temp\oumyksgr\oumyksgr.dll
Size 3KB
SHA256 6d0c4c03f3120ba27e79ac1f727e529901fe084c82f19a7a9f09fa4c82bfb89b
MD5 3d950284f245d155702ab9c2ed91e8db
SHA1 5d2dfe14d0ca1936d24e8a81a54468513c6b1c26
SHA512 092dd471c75d603144e7af24218d81a35afb2472bcba20b4aad2026f991efd4a364d86c5e651007ce31b17843509934ab8be209092e4e0ebb58b3e42a2848aac
TLSH
T1D451DF1A53E8466BF4770B357EE343172774F920EB62535E4980026DAC31364AE32FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC809B0397BDB0441C93C337FFA75E7469.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oumyksgr\CSC809B0397BDB0441C93C337FFA75E7469.TMP
Size 652B
SHA256 719ff4cf0e693d78178715b9ba68f4cc50e2c9e64e2ab34a3d9fec60fe92d7f5
MD5 66f4632c8dc64876e6574732dc733aa0
SHA1 823c9a38b862e22e9276c832e65d257a9be3cfde
SHA512 bbce341e7fac770d4fb1d524a53bec912cabc2598ead7cc515cc932d8e59f103113971d04e96b90f01ebd024105548aa59f4f35dc2e2bfcbbbd102a749f15606
TLSH
T11AF0170963F8020EF0B34B30B9F6436791A9BC65DE3693AD1540035928645149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

oumyksgr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oumyksgr\oumyksgr.0.cs
Size 213B
SHA256 a0fdb9548ff75cbf48acee5affaa578eb60798807cb792da4d9640cfb371f157
MD5 5406714dfd58ae688d2c3b98082fab53
SHA1 7661a7744b9c40379bb479ff527fc8923696cf11
SHA512 7f0c60c8508a7fe17edd1f08b9207464d8471f07d563acd20a7d971fc249731a4851b7d1a2000ffce1da712a55a8d161511b409bf985b4bf9a60bc83d5a3ccc7
TLSH
T1FDD0A9803686F3384B9305073C03B89A223FA71103EA6408D86A0C83EE08070BB38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

oumyksgr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oumyksgr\oumyksgr.cmdline
Size 369B
SHA256 9a719b9bcfecf4e306a5bd3000cc9fd366280171abe580ce1a59003ea90ee283
MD5 66a5dfb45d78224bdf098d9e54a0a981
SHA1 324d0f254db12a2745b2e8fcf0a95fc11a76f181
SHA512 c825425a36921b83d6640b623c2e0dc9a2cacb7311dbb5a3db56af377d57a584055bca2bff9cd3777cfdcc9e78a34dd76489182919c0d36e8ed59f393b618984
TLSH
T1F3E0C02A435EC2FD15DD10072579C4ACD272076369407F84E04CA40EF0670086BD9751
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3656-27-0x000001F7FB550000-0x000001F7FBEF4000-memory.dmp

Download

memory/4540-9-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-29-0x00000219BDC20000-0x00000219BDC28000-memory.dmp

Download

memory/4540-11-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-12-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-13-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-14-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-15-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-0-0x00007FFBF31FF000-0x00007FFBF3200000-memory.dmp

Download

memory/4540-8-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-7-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-6-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-10-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-5-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-4-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-30-0x00000219BD500000-0x00000219BD514000-memory.dmp

Download

memory/4540-31-0x00000219BD510000-0x00000219BD518000-memory.dmp

Download

memory/4540-36-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-37-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-42-0x00007FFBF3070000-0x00007FFBF3A14000-memory.dmp

Download

memory/4540-3-0x00000219BDBB0000-0x00000219BDBD2000-memory.dmp

Download

memory/4720-38-0x0000000140000000-0x00000001400AF000-memory.dmp

Download