remcos | 010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f

Analysis

max time kernel
60s
max time network
37s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe
Size 1.5MB
Sample261026-y5bnlayyet
SHA256 010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f
MD5 c9aadb78c09e977017911f0f9c906920
SHA1 f568f7c05850b2128d7c14275cd6f9f81ac021c5
SHA512 c8ab1c7bf7fa42a6649fe3ae05cff508a9a316a222842290acdd02b9e92515f57d129aea34b48a2adc6707082ec4f32913bfe0f2a1d0f238f2175ce5ea938c8b
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0FC:+Tg3ZOcuUL3xAx/8b2S7Z0Y
TLSH
T1AC7523FA8E706892D5BD463205AF0F6D35F54FF37A14AC4311713D2A2F3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chinemerem discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

chinemerem

remcoss.onmypc.org:3765

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
r-8ET8H0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4092	AboutSettingsHandlers.exe
5708	AboutSettingsHandlers.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3312-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3312-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/3312-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4092-33-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4092-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe
behavioral2/memory/4092-37-0x0000000000DE0000-0x0000000000F69000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 4224	3312	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe	89
PID 4092 set thread context of 5708	4092	AboutSettingsHandlers.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AboutSettingsHandlers.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5592	schtasks.exe
1856	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4224	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4224	3312	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe	89
PID 3312 wrote to memory of 4224	3312	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe	89
PID 3312 wrote to memory of 5592	3312	010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe	90
PID 4092 wrote to memory of 5708	4092	AboutSettingsHandlers.exe	94
PID 4092 wrote to memory of 5708	4092	AboutSettingsHandlers.exe	94
PID 4092 wrote to memory of 1856	4092	AboutSettingsHandlers.exe	96

C:\Users\Admin\AppData\Local\Temp\010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe
"C:\Users\Admin\AppData\Local\Temp\010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe
  "C:\Users\Admin\AppData\Local\Temp\010cb23c8b36dda00871c946ca11b6e2d5adf2fec9a35e19d52a2ec6caeb271f.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4224
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5592

C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
  "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe"
  2⤵
  - Executes dropped EXE
  PID:5708
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn SystemSettingsAdminFlows /tr "C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AboutSettingsHandlers.exe

Path C:\Users\Admin\AppData\Roaming\UIMgrBroker\AboutSettingsHandlers.exe
Size 1.5MB
SHA256 daa172de7b97bb1e1ac6dbb5cc1662e8f73422ef3a668143215be84d6b657479
MD5 6e3b2e7e9edc1fd952eb4f97baf429f6
SHA1 8dc16364a903c1d9fff2cbd13e21b8242886618c
SHA512 381e0a009d294059297d0392f75382bb0ab114f9520ba17ffaa7c03a7bd3a57b9314665b4307df626c36fcdf6a866b43d7824cd7efac451e6462586be6219561
SSDEEP 24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0FR:+Tg3ZOcuUL3xAx/8b2S7Z0T
TLSH
T16D7523FA8E706892D5BD563205AF0F6D35F54FF37A14AC4311713D2A6F3A267A820A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 cf71835e0bd054e76f1e80f9190bc252e511f05049c511ab04da020d29e61399
MD5 94a5a3c648c779cc6fd76e60124fd0f6
SHA1 268eed290bf1a7ee4132e64385219e8f82b7cda4
SHA512 40a4f9263883d044994790d6a6af3a4373931e05e99f8c27e4be2358bba6c7ec852353d33748ed59d12592337750d86ce8542b1e8ccca654e5e16b45fe2cb603
TLSH
T1A6A02447C330CD4C101034F0754C30575007143F3D774507D041DF0C035C11035C0111
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3312-18-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3312-1-0x0000000000DC0000-0x0000000000DC3000-memory.dmp

Download

memory/3312-2-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/3312-0-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3312-20-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/3312-15-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4092-33-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4092-23-0x0000000000860000-0x0000000000863000-memory.dmp

Download

memory/4092-35-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4092-37-0x0000000000DE0000-0x0000000000F69000-memory.dmp

Download

memory/4224-14-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4224-11-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4224-10-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/4224-3-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads