remcos | 5588a94ecd771787f14f73d040d3cc08a1c1ff594b04ef01c6275952254f2b67

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-04_e916ca3216e02eac04f56f32a87ad1f9_elex_parallax_remcos_remocs_wannacry.exe
Size 124KB
Sample261004-28mf2sttas
SHA256 5588a94ecd771787f14f73d040d3cc08a1c1ff594b04ef01c6275952254f2b67
MD5 e916ca3216e02eac04f56f32a87ad1f9
SHA1 6860cdbd38a642709b52f9db6a9a6a1eaed68536
SHA512 105ebd36a75fd6fe0a2c9b9dc63acf6e076d6d91b3582f071689b04ccddaaa94b5ac5453af71f092582ee8cf9b9fac9253b959601bb8c47adc27376185d039fe
SSDEEP 3072:8qLondaxZq2ovMb6E9kwBC4ApY+zQMIq:8qLon4vxHawBC4Au+zQMI
TLSH
T1FBC31817264AC5A3E8211DB40B417F929FFC6F964A46A1E3D348DC852D7580AF03EA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-04_e916ca3216e02eac04f56f32a87ad1f9_elex_parallax_remcos_remocs_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-04_e916ca3216e02eac04f56f32a87ad1f9_elex_parallax_remcos_remocs_wannacry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3932	2026-10-04_e916ca3216e02eac04f56f32a87ad1f9_elex_parallax_remcos_remocs_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e916ca3216e02eac04f56f32a87ad1f9_elex_parallax_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e916ca3216e02eac04f56f32a87ad1f9_elex_parallax_remcos_remocs_wannacry.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 63e70b0d2e947b3bf49ae88e020585b75ab9c14b1b8111f67fcca9481982e631
MD5 7cb936787b309d5e6f88278c93132f55
SHA1 ee8b14c43252ec8cd5bcff5cfcda16ed54972088
SHA512 7d7e4b5a6a446f10060cbb52628e7e56779852a0ddbf4f0a04d17883506050e7151ee018f832d36bfae52b6be4aa1c3982f98f7e375530ca767f333b09539fec
TLSH
T126A012578321C940001024E4A08834579002341135B60446A1466B09034C01135C0211
MD5 SHA1 SHA512 TLSH

Submit Download