remcos | e2aa498ea12515bda490178f708405ffd4a50100c90291f544477b02ff299aaa

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Multiple Card Charges.js
Size 5.2MB
Sample261006-jsbeqstdpd
SHA256 e2aa498ea12515bda490178f708405ffd4a50100c90291f544477b02ff299aaa
MD5 a34f40f10c55df256f127bd20839839a
SHA1 df0957030ff63cad26e451eceaab65c6ce04a7d5
SHA512 a94615ba6a93df1ab08bc3843423472ea817ee2bae3aa9d6289f070f343fe43ba30270189af62d6edb753cf9015a5eac81c8f00f0b50f4a3c9bb154e56819cce
SSDEEP 1536:Cbm5Un6b6XUWnLIY86DYFp68hlmjO+PtgpEbEcmvsHP2GJ0iXR4Cgze/KNTMWWma:FIvT
TLSH
T100464E5B1F0C3E4EC4C65F6AA115D59FC088B6EA2910781E76CFECAACC74EA0FE19154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

partnerone discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

PartnerOne

www.grantcampaign.store:9985
www.direct.sinio-agri-reidsun.com:9985
www.direct.sinio-agri-reidsunbackup.com:9985
www.direct.sinio-agri-reidsunbackup1.com:9985
www.direct.sinio-agri-reidsunbackup2.com:9985
www.grantcampaignbackup.store:9985
www.grantcampaignbackup1.store:9985
www.grantcampaignbackup2.store:9985

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
folder
mouse_option
false
mutex
Rmc-SD96B0
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
audio
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5892	1216	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5892	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5892 set thread context of 2708	5892	powershell.exe	92

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5892	powershell.exe
5892	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5892	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5960	conhost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5892 wrote to memory of 2708	5892	powershell.exe	92
PID 5960 wrote to memory of 5600	5960	conhost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Multiple Card Charges.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -Command "$apaturia=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$szomolnokite=[System.Reflection.Assembly]::Load([Convert]::FromBase64String($apaturia));[Win32.RMP.Cls_NlnwcDjXpu]::Met_gVxRnCsYopJh('fOf+WtEYgP+o3mEhrlU15QetIJLpZTNQaQDNSCVyHXCyL6p7edg70IMQ8MvTCyiuRfABMBvT+ysmFesQRJFmubbWTEe8NXH7dYG0dnCQ3wA=','kzMzPU6S5HpspKOBMIFjTt4cOCy5JuNrTr6tUY4RM+8=','VA0QbcTo7mCJ9KviFRWuFtnf0I3zT5RJTVirTSafDeaJP5eBNsnzNPxYgB7B2xFl','etyxqKHwt1bC8kmkK2nfeC+RdTUHA/AGjXRo0mbKHZI=','5fofF+uz82afcXj5tOUxCC1+UvDN+Vcb+vC95YbQPbk=','fbqX4B7FxMMqhv/QET7/tHIgijaZEcvkSY3WjOBMYiw=','/wZCFpjo1RFN1of0XjtWSUCV0taGpaXdDcRnzr/vj8Q=','voYtlo9uDS3to4EkZdts5pyT99UlEVJK63VOEJOy5Xo=','','q8nueG5kfYd8aw+Nr1vWgIDXCdjWkouXBPj+kbyoP/uGsEulPM30iU4VS/zoBq7U','w/s+TKZyasAxSFJp0Zt1sPTWZSTG5TBOEI/68dM956I=','NfnbdlcacFF2LCgKqW3spJMChiWXHVIjRKcK4Z1Si0c=','7thbMWFGH2FzTPrSDgy3I5Iv8fkILIUCLYpJt9qgb9A=','d/zORDkt2k86GFQiJrQcfC65Md1+MSgoDU+5fNJCjZE=','ili+F8f1ACSPI9HE19QqWjiVJm1ABPKFSz5sQSgiwTM=','bQitxtA5C5cExoHyOyxkJn2Qr993prc9J1JaAv5s+7Y=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\System32\cleanmgr.exe
  C:\Windows\System32\cleanmgr.exe
  2⤵
  PID:2708

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-17-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/5892-10-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-12-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-6-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-4-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-7-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-9-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-5-0x00000188AD730000-0x00000188AD752000-memory.dmp

Download

memory/5892-8-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-11-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-0-0x00007FF820D7F000-0x00007FF820D80000-memory.dmp

Download

memory/5892-13-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-14-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-15-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-16-0x00000188AD770000-0x00000188AD792000-memory.dmp

Download

memory/5892-1-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download

memory/5892-19-0x00007FF820BF0000-0x00007FF821594000-memory.dmp

Download