remcos | d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7

Analysis

max time kernel
60s
max time network
37s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe
Size 1.5MB
Sample261024-y2lpdsb13x
SHA256 d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7
MD5 d9dabecbe099dc99f079b37fb2bb46f0
SHA1 f30c7bdf37e882a78d25f07122c31482757a53c1
SHA512 c26057563a9bdbb25693f08a33891b0e4aa13cd419b564dbd849b9dfcebb6a6185e42db1b44e8326063f560b2adebba5bc476a3d4c0d74a08a723c0c257ad3d3
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fs:+Tg3ZOcuUL3xAx/8b2S7Z0+
TLSH
T1397523FA8E706892D5BD563205AF0F6D35F54FF37A14AC4311713D2A2F3A267A920A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
5596	AboutSettingsHandlers.exe
5412	AboutSettingsHandlers.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4956-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4956-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4956-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5596-33-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5596-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/5596-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 4828	4956	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe	89
PID 5596 set thread context of 5412	5596	AboutSettingsHandlers.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2676	schtasks.exe
1308	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4828	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4828	4956	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe	89
PID 4956 wrote to memory of 4828	4956	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe	89
PID 4956 wrote to memory of 2676	4956	d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe	90
PID 5596 wrote to memory of 5412	5596	AboutSettingsHandlers.exe	94
PID 5596 wrote to memory of 5412	5596	AboutSettingsHandlers.exe	94
PID 5596 wrote to memory of 1308	5596	AboutSettingsHandlers.exe	96

C:\Users\Admin\AppData\Local\Temp\d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe
"C:\Users\Admin\AppData\Local\Temp\d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe
  "C:\Users\Admin\AppData\Local\Temp\d91be49f4a7de16db77094fbfc405ae1c5323c43e9dd20ed9285a10726c2f2a7.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4828
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2676

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:5412
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 0302a43be13b4c6f08a3801545f1547bf1677cdf0d996cfea19be4268a4df78b
MD5 5ab85ebde85fd01b45dd2daa39c70a48
SHA1 6d39b230099b2a1b316235a26337723d4525f9dc
SHA512 ca5d68ef82b9a43f5d67b32154e3a4a72e277a79ac21ead9a8f3fe6a17c45ccc4e4b816e4d740de3be82ba4f114a393c99e69f24717228a649dab485f942d1a6
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fo:+Tg3ZOcuUL3xAx/8b2S7Z0y
TLSH
T1B87523FA8E706892D5BD563205AF0F6D35F54FF37A14AC4311713D2A2F3A267A920A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 93b0143b9d5eda88df049dfda2ae7811ccb61a300004ec70c72c184d059ad57b
MD5 8a2b73a4bdccef9e1caf190ec538ac17
SHA1 84aa3e470fc7f069c21b70d4ad072e56d9a14d4b
SHA512 3074da488ff34742a17b80f3a4c6f1b72a1fe9b55e3ce0c87034c2ca87d6c4f22e24b6c131b48bde924ab2e6267e9ea5e8b630447352721bb4aa24a2de9c0392
TLSH
T18DA01246C220CA84001229E0644A3157500118A1367A0516A0026F0C038800035C0211
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4828-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4828-3-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4828-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4828-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4956-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4956-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4956-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4956-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4956-2-0x0000000003120000-0x0000000003121000-memory.dmp

Download

memory/4956-1-0x00000000009B0000-0x00000000009B3000-memory.dmp

Download

memory/5596-23-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Download

memory/5596-33-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5596-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/5596-36-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads