remcos | 286ae740278234a35e85eb0c2931824f4df807b0840de2675c66e3ca2d892a17

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRAADS.A. eINFO3634763575473644652467735.cmd
Size 6KB
Sample261026-vd25paxyhz
SHA256 286ae740278234a35e85eb0c2931824f4df807b0840de2675c66e3ca2d892a17
MD5 0950bdf90e621959b5550f3fe45a9c66
SHA1 6ed07c52478f00e170a16de91326945c3f2acf11
SHA512 dfb7fd34423c3af848f855a6d927ccf57b8affe970ee692287b51b7001aa5ad30d213b031efb525df3117099b0e12526ff032bdf6e07f9cf79a37dd0748cc6e4
SSDEEP 192:/bFmaJwxkpvGZQQWJeFF9fkmsORi6vEJc/gnPvTCBHVWPE:jFm1aGYmnf5O6v5/gnnTC3N
TLSH
T1B6D1D6101748634AE14B2FF2C4DFC687E6BD026CC5086840E2BACA49BD72D5C5BB89CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

buxtonfina collection defense_evasion discovery execution remcos persistence privilege_escalation rat suricata

Malware Config

Extracted

Family

remcos

Version

7.2.1 Pro

Botnet

BuxtonFina

gumduck.duckdns.org:36511
gumduck1.duckdns.org:36511
gumduck2.duckdns.org:36511
rawegg123.duckdns.org:36511

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-16SUXA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 10 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
17	6032	backgroundtaskhost.exe
18	6032	backgroundtaskhost.exe
18	6032	backgroundtaskhost.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4616-54-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4524	powershell.exe
8	4524	powershell.exe
9	4524	powershell.exe
11	4524	powershell.exe
12	4524	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4524	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key queried	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lythrum = "%Uforskammetheder% -windowstyle 2 $Nontentative='HKCU:\\Software\\Bigotteriets\\';(.'gp' $Nontentative).'Smalsavens' \| %Uforskammetheder% -"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
6032	backgroundtaskhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4524	powershell.exe
6032	backgroundtaskhost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 6032 set thread context of 5592	6032	backgroundtaskhost.exe	102
PID 6032 set thread context of 5668	6032	backgroundtaskhost.exe	104
PID 6032 set thread context of 4616	6032	backgroundtaskhost.exe	105

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5988	cmd.exe
2356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4524	powershell.exe
4524	powershell.exe
4524	powershell.exe
4524	powershell.exe
4524	powershell.exe
4524	powershell.exe
5592	userinit.exe
5592	userinit.exe
4616	userinit.exe
4616	userinit.exe
5592	userinit.exe
5592	userinit.exe
5592	userinit.exe
5592	userinit.exe
5592	userinit.exe
5592	userinit.exe
5592	userinit.exe
5592	userinit.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4524	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	4616	userinit.exe
Token: SeImpersonatePrivilege	5592	userinit.exe
Token: SeImpersonatePrivilege	5592	userinit.exe
Token: SeImpersonatePrivilege	5592	userinit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	backgroundtaskhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 1256	5988	cmd.exe	89
PID 5988 wrote to memory of 4524	5988	cmd.exe	90
PID 4524 wrote to memory of 4508	4524	powershell.exe	93
PID 4524 wrote to memory of 6032	4524	powershell.exe	94
PID 4524 wrote to memory of 6032	4524	powershell.exe	94
PID 6032 wrote to memory of 404	6032	backgroundtaskhost.exe	95
PID 6032 wrote to memory of 2356	6032	backgroundtaskhost.exe	96
PID 2356 wrote to memory of 916	2356	cmd.exe	98
PID 6032 wrote to memory of 1064	6032	backgroundtaskhost.exe	99
PID 6032 wrote to memory of 4836	6032	backgroundtaskhost.exe	100
PID 6032 wrote to memory of 2288	6032	backgroundtaskhost.exe	101
PID 6032 wrote to memory of 5592	6032	backgroundtaskhost.exe	102
PID 6032 wrote to memory of 2932	6032	backgroundtaskhost.exe	103
PID 6032 wrote to memory of 5668	6032	backgroundtaskhost.exe	104
PID 6032 wrote to memory of 4616	6032	backgroundtaskhost.exe	105

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRAADS.A. eINFO3634763575473644652467735.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %mtrik% "
  2⤵
  PID:1256
- C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\backgroundtaskhost.exe
    "C:\Windows\SysWOW64\backgroundtaskhost.exe"
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\backgroundtaskhost.exe
    "C:\Windows\SysWOW64\backgroundtaskhost.exe"
    3⤵
    - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
    - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Windows\SysWOW64\backgroundtaskhost.exe
      "C:\Windows\SysWOW64\backgroundtaskhost.exe"
      4⤵
      PID:404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Lythrum" /t REG_EXPAND_SZ /d "%Uforskammetheder% -windowstyle 2 $Nontentative='HKCU:\Software\Bigotteriets\';(.'gp' $Nontentative).'Smalsavens' | %Uforskammetheder% -"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Lythrum" /t REG_EXPAND_SZ /d "%Uforskammetheder% -windowstyle 2 $Nontentative='HKCU:\Software\Bigotteriets\';(.'gp' $Nontentative).'Smalsavens' | %Uforskammetheder% -"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:916
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\akoajiurpwfbpfalfshobgkobc"
      4⤵
      PID:1064
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\akoajiurpwfbpfalfshobgkobc"
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\akoajiurpwfbpfalfshobgkobc"
      4⤵
      PID:2288
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\akoajiurpwfbpfalfshobgkobc"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5592
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\kmttkafldexgrmwpoduhmtfxjjzne"
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\kmttkafldexgrmwpoduhmtfxjjzne"
      4⤵
      Accesses Microsoft Outlook accounts
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      outlook_office_path
      PID:5668
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\ngymltpmznplcsktfnpjpxzosxqoxeml"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 37eae5e9336e2e15bd0aaed270626cec2e1d818d2e0c3761bf2907213c499a66
MD5 d5d73fcfef4b0b512959e4fd05d525f0
SHA1 b43b8b05a8b8de85f6f31debbe62ee17b4ecc81c
SHA512 46231e3014395f5e04309907f30353d4832bcbc08d64d773595f86d19200cd9dca3bbfa987680f56b1d5fd6e417518efacd26019ed1f395d34efca26e08c52fb
TLSH
T151B0128C37D111557C68E16AD4B70015B8B07A502039980C26D1034D3578601704839F
MD5 SHA1 SHA512 TLSH

Submit Download

akoajiurpwfbpfalfshobgkobc

Path C:\Users\Admin\AppData\Local\Temp\akoajiurpwfbpfalfshobgkobc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1064-43-0x0000000000600000-0x000000000067E000-memory.dmp

Download

memory/2932-48-0x0000000000320000-0x000000000037E000-memory.dmp

Download

memory/4524-11-0x0000000006100000-0x000000000611E000-memory.dmp

Download

memory/4524-24-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-7-0x0000000005440000-0x00000000054A6000-memory.dmp

Download

memory/4524-6-0x00000000053D0000-0x0000000005436000-memory.dmp

Download

memory/4524-10-0x0000000005D20000-0x000000000607B000-memory.dmp

Download

memory/4524-0-0x0000000074702000-0x0000000074703000-memory.dmp

Download

memory/4524-12-0x0000000006170000-0x00000000061BC000-memory.dmp

Download

memory/4524-13-0x00000000066C0000-0x0000000006708000-memory.dmp

Download

memory/4524-14-0x0000000007BD0000-0x000000000824C000-memory.dmp

Download

memory/4524-15-0x0000000007590000-0x00000000075AA000-memory.dmp

Download

memory/4524-16-0x00000000077A0000-0x0000000007836000-memory.dmp

Download

memory/4524-17-0x0000000007690000-0x00000000076B2000-memory.dmp

Download

memory/4524-18-0x0000000008810000-0x0000000008DCA000-memory.dmp

Download

memory/4524-19-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-20-0x0000000074702000-0x0000000074703000-memory.dmp

Download

memory/4524-21-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-22-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-5-0x0000000005330000-0x0000000005352000-memory.dmp

Download

memory/4524-25-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-26-0x0000000008DD0000-0x000000000A7B6000-memory.dmp

Download

memory/4524-1-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/4524-28-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-2-0x00000000054F0000-0x0000000005B3A000-memory.dmp

Download

memory/4524-4-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4524-3-0x00000000746F0000-0x0000000074EAC000-memory.dmp

Download

memory/4616-52-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4616-54-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5592-57-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/5668-55-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/6032-47-0x0000000000150000-0x00000000001C5000-memory.dmp

Download

memory/6032-59-0x000000001DCD0000-0x000000001DCE9000-memory.dmp

Download

memory/6032-62-0x000000001DCD0000-0x000000001DCE9000-memory.dmp

Download

memory/6032-63-0x000000001DCD0000-0x000000001DCE9000-memory.dmp

Download

memory/6032-38-0x00000000007B0000-0x0000000001A96000-memory.dmp

Download

memory/6032-27-0x0000000000150000-0x00000000001C5000-memory.dmp

Download