remcos | 9f0df64cc8a15b2c96e639a975acb9f54ff26721dc60a8035d4bbc65476485e7

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Confirmação_de_Pagamento.js
Size 763KB
Sample260930-s1gfdsbf79
SHA256 9f0df64cc8a15b2c96e639a975acb9f54ff26721dc60a8035d4bbc65476485e7
MD5 4cda731b2a82dbdcc587b5bec0b84dcd
SHA1 5efc1d0e3deb89b747357dac5ce81ed1e3bf5d3a
SHA512 6784a3df42c7bd153804994343ac8e3a5ae99a593a2b76007deaf74eb952ff8a0e085f0a036342dac690f507d7138699bbb9d07e49e136e50716d81e3444e032
SSDEEP 12288:V3iWESTm0Mi90Jdum/rg/4ZR1dzmHBzeLG1MUjc7LwvEBHzDsdRxES:V3iSyJzVr04H1dzYBVMUjcvwcFsdF
TLSH
T177F44591A5671CDB816B54A052EA5F9D22D1E605306D3F03FFEE610A0F0B73B35A2B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

RemoteHost

155.103.69.174:4981

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XMIE8L
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3140	remx.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	remx.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remx.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2136	powershell.exe
2136	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 2136	6072	wscript.exe	90
PID 6072 wrote to memory of 3140	6072	wscript.exe	92

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Confirmação_de_Pagamento.js
1⤵
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\34f984fea6_d.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Users\Admin\AppData\Local\Temp\remx.exe
  "C:\Users\Admin\AppData\Local\Temp\remx.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34f984fea6_c.b64

Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_c.b64
Size 626KB
SHA256 6fb8556cc7cfc10a91a97e9b3bea3a9f6ba5b7a510be320a69bc19c0466b5913
MD5 f5a612133177e1df48eced5b4f5fefec
SHA1 cc5427c3e9dfae60a8d1d4f482732819bbd74024
SHA512 28e6dbc37f1ce5b5ac6d26287fea543c7d53331e574af7d4d9623f048ee50a302b14392daa7bce1e60ac4bad55074c112c0cad637b3b6902e73d3811c53b7419
SSDEEP 12288:TYugw87UQdhRhLM/3KemSTXueDOi3S2aFIGoy1nk83ZM96u7Su7G2:TYsIVQieXTeeDO8S6Goy1k8J+RSA
TLSH
T1A1D42321EE5A7CBDCDFC5E08F3F29B370AA26B06D0E96590098771131D5FE09096BD4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34f984fea6_d.ps1

Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_d.ps1
Size 728B
SHA256 c44e1e78b6102cbc7307ea38b5b548d0c838485ae40005ae1b84155939c138e1
MD5 826790eec6d19a177eb2ab902c6306cd
SHA1 17ca880ad7c4b68063a315d31bab075791e0d1d8
SHA512 1b2f6c552633623235a4a29b7f07f8c01244b6624e4b274aeecd88af9fb3d2403b84caeb8325e96c82aa9a4fa1412af5d7596572a748706ab25f92ae2b44a8f7
TLSH
T1140145A866D789790484A06761F1C2C8C2A4946C266E3FA4FB08C609721C588E2EE28E
MD5 SHA1 SHA512 TLSH

Submit Download

34f984fea6_i.b64

Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_i.b64
Size 24B
SHA256 1864b5780779f0bb6cd04241cec2f29fc153f961d9a0bd3f131a4e6d00a35892
MD5 7e53f468467de1193f25b9371f0b71f5
SHA1 0d10bcd1e5a7e78901672ebc80bd8ebbd8886e1f
SHA512 97f944d016aa463c0f90f59c5f11cc0a268a9254a6000929bc1e6b6b46f2059af8b9b22b9df2c32b7bb16e85a0a9296c801f98dbf0ec0172cbf681af37f9b2c6
MD5 SHA1 SHA512

Submit Download

34f984fea6_k.b64

Path C:\Users\Admin\AppData\Local\Temp\34f984fea6_k.b64
Size 44B
SHA256 576ef8f43834f224a7c3a28505f2f19e838f4ca8b3b0261cdd7e8d3befa4ca9d
MD5 eb53cce6ab0d5603ac1d248b54a586d4
SHA1 b207b08fb97ce5dd8132af40ef2fdb9a74399c1a
SHA512 431b8c9e5c14c50417940ed59de3701156e2268bc7d8c8b4c4817ce3febe97e3b1e48fe1a17ad00c605a47e11e76c346d1e6bc0b8a22315a24e743541ada22b6
MD5 SHA1 SHA512

Submit Download

remx.exe

Path C:\Users\Admin\AppData\Local\Temp\remx.exe
Size 469KB
SHA256 6f3ac78109bb86b7cad6342b2194f93ae3916bb221adba9e344f01493128a642
MD5 5315876a459b3ec25e2989b0a2d370b9
SHA1 7d81f2e593df452499db6c514a61ac7be9a549db
SHA512 fd17ad54c93c31a3cd65bdadf2f33a6c41d4930e03f347ab151346ba89258c53ea977e8563a87c59565a8449725d4472e00e9ba1d0f6f49eddd5427d5880bd77
SSDEEP 12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSEn9:uiLJbpI7I2WhQqZ7E9
TLSH
T1BEA4AE02BAD2C072D57161344D2AE735DABDBD202835997BB3E61D5BFD30180A73A7B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2136-10-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-12-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-14-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-13-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-11-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-4-0x00007FFB22DEF000-0x00007FFB22DF0000-memory.dmp

Download

memory/2136-6-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-7-0x000001D0A0120000-0x000001D0A0142000-memory.dmp

Download

memory/2136-19-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-21-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-23-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-24-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download

memory/2136-5-0x00007FFB22C60000-0x00007FFB23604000-memory.dmp

Download