remcos | 08f3b77d24f426e0b8a3492ded6f5a41b1ae779add806695a7814c35d4345945

General

Target
2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Size 645KB
Sample261026-d97avaby2w
SHA256 08f3b77d24f426e0b8a3492ded6f5a41b1ae779add806695a7814c35d4345945
MD5 5444819a2f82e322515aa9ab58712c84
SHA1 440945cf6eb61eb32b139073c3e32b368e0cb2e3
SHA512 43c9d23a68aad1094255e4efa463c2c1bfd5988c28f278e2597199f8959c9fca71dcdc0110a8506e223a1250873f316924156ef9fabc35aef358ba7e69f30b8e
SSDEEP 12288:TIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:U5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T1B6E46D59A39402F8D0B7C135C982953BE7B27C065571472F03E70E9B2F276A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost defense_evasion discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

89.106.84.23:2405

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CA11UJ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral2/files/0x0024000000018899-0.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4912-3-0x0000000140000000-0x00000001400AF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/files/0x0024000000018899-0.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4912-3-0x0000000140000000-0x00000001400AF000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-CA11UJ = "\"C:\\ProgramData\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-CA11UJ = "\"C:\\ProgramData\\remcos.exe\""	2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	remcos.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3516	remcos.exe

Executes dropped EXE 1 IoCs

pid	Process
3516	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-CA11UJ = "\"C:\\ProgramData\\remcos.exe\""	2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-CA11UJ = "\"C:\\ProgramData\\remcos.exe\""	2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-CA11UJ = "\"C:\\ProgramData\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-CA11UJ = "\"C:\\ProgramData\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3516 set thread context of 4912	3516	remcos.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3516	remcos.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3516	1884	2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe	89
PID 3516 wrote to memory of 4912	3516	remcos.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_5444819a2f82e322515aa9ab58712c84_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1884
- C:\ProgramData\remcos.exe
  "C:\ProgramData\remcos.exe"
  2⤵
  - Adds policy Run key to start application
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\remcos.exe
Size 645KB
SHA256 08f3b77d24f426e0b8a3492ded6f5a41b1ae779add806695a7814c35d4345945
MD5 5444819a2f82e322515aa9ab58712c84
SHA1 440945cf6eb61eb32b139073c3e32b368e0cb2e3
SHA512 43c9d23a68aad1094255e4efa463c2c1bfd5988c28f278e2597199f8959c9fca71dcdc0110a8506e223a1250873f316924156ef9fabc35aef358ba7e69f30b8e
SSDEEP 12288:TIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:U5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T1B6E46D59A39402F8D0B7C135C982953BE7B27C065571472F03E70E9B2F276A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 33a9ce1f73507e731d2e9c95cc8d3735d35f1280550bf30e3d1528f67282dd5c
MD5 fad3ef5eb227749384344573f9435017
SHA1 04974d7ac1de86a77c96844ec113767ddd224bf8
SHA512 6bfa194ddbc0c97ed3639a83505f0806d3897edae9665cf6cf44dc6aa77d99f6365c8f39ca149f85a9e888964c91e9804b2151bc7f3732ca23f22acb9a8fce67
TLSH
T113C09BD977D5101A7C727196547700397B73FD56103CCC0D11D1034D15F95005144797
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4912-3-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads