remcos | 3508b55cbb53530a2bd9fec34a8c7f044841122db396049cb89df848c8cc154a

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/10/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product Inquiry.js
Size 55KB
Sample261028-mt65kscs5r
SHA256 3508b55cbb53530a2bd9fec34a8c7f044841122db396049cb89df848c8cc154a
MD5 e97f6fd96ca2061ad9380c300a776fa5
SHA1 5835006e22394a19f27d3cf8841e52cb19f5357a
SHA512 0a93176cdbad5a362c48f858eaa996b806b5949c21499978a3b80c0d0175e1199aea4fdd56640bac59437d4f763970f6498de8ace933d4398cef3117175f139a
SSDEEP 768:3ITl5L7mP9l4YnY7+Gw1T0NyxIC1iBVATBdkWi1KHj1LuNhU3Xrc/j6m:38A2pAdkW7hqNBjd
TLSH
T1EA43EC9A42C70A68D6620DC081BB611AD9F78D12584B78D9B74FF9DFE72C8C070E57B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

217.60.195.167:2404
www.phongketaonduchuyclassproject1.com:2404
www.phongketaonduchuyclassproject2.com:2404
www.phongketaonduchuyclassproject3.com:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
folder
mouse_option
false
mutex
Rmc-VGS34E
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4888	cmd.exe	90

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1200	powershell.exe
8	1200	powershell.exe
10	1200	powershell.exe
11	1200	powershell.exe
12	1200	powershell.exe
13	1200	powershell.exe
14	1200	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 3192	1200	powershell.exe	97

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5040	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1200	powershell.exe
1200	powershell.exe
1200	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1200	5040	cmd.exe	93
PID 1200 wrote to memory of 568	1200	powershell.exe	94
PID 568 wrote to memory of 1780	568	csc.exe	95
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97
PID 1200 wrote to memory of 3192	1200	powershell.exe	97

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Product Inquiry.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5780

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .([char[]](105,101,120) -join '') $env:ofgnadhkz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .([char[]](105,101,120) -join '') $env:ofgnadhkz;
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nwgi3box\nwgi3box.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES424F.tmp" "c:\Users\Admin\AppData\Local\Temp\nwgi3box\CSCDA573DE14A64203A8B5F3235141C8E.TMP"
      4⤵
      PID:1780
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe"
    3⤵
    PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES424F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES424F.tmp
Size 1KB
SHA256 52cfebb6ca90dee359fdb03a25762e4074a2c71eb108bcf9e9fad816d9bb27ee
MD5 0fa1b8b5688d97149050e1a42311670f
SHA1 ada16260f3f1fdea0b29da4bd538285581bdb26d
SHA512 727e77f9c280195cf4527c2e4f10bff7ba5f5740c6fb05ca88bb50b085d8cf99e57768eac603596f1e877f1cd0153cddb66cd8ccea65fc1582ab0508f4e76004
TLSH
T1A021C90153E9471EF0B3873169F6532BE675FC68EF62679F844402282C51140DEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j53iora1.ksr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j53iora1.ksr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nwgi3box.dll

Path C:\Users\Admin\AppData\Local\Temp\nwgi3box\nwgi3box.dll
Size 3KB
SHA256 8acbc13fa0836340b31413dfaf328d64a6e8081a3cbcb60ab84594a571aa4a25
MD5 fbb734459b0134363a2d080e02cc0b12
SHA1 bdb7ac9b7128b99fd8ef24faed453933807dc274
SHA512 533b72e758724cc6efd30822520a6214c32177ca72eae079703baaffe92e8eaec1ff470c51aaafed51934ad71541d08859833871d089683afeb15f393e649bef
TLSH
T19E511F1653E8832BE4B74B356EF347233378F9108B62935D4880022CAC213A01E31FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDA573DE14A64203A8B5F3235141C8E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nwgi3box\CSCDA573DE14A64203A8B5F3235141C8E.TMP
Size 652B
SHA256 f6a7e7000f54079eeefa591fe37c62f740b9c4edc275d7fb6dbcc16e3d7e0f53
MD5 0460f12ff50dd3668157424768aea38c
SHA1 973545e26529cbabf2b65fb62605ae50fcd9d768
SHA512 cfcbe92907e75f1af2a9ac318b27aa0dbf8016174ca5fce685ead3125d99751b903d93c05b5fe29a06b597a8bc14dad0db42e136e0282b35d1c65537c63c7173
TLSH
T131F03A0963F8020EF4F34B31BDF643A391A9BC65DE32A7ED1444031928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nwgi3box.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nwgi3box\nwgi3box.0.cs
Size 210B
SHA256 133a00d0bc7755aaaf3cf0896dd64af72d4d3a938529d86a5ca25c11cd3e74da
MD5 1cef907a71656833dce7b5996bc5a195
SHA1 e371f93df97d357e2754913e1d8ed2fd0f7b2d47
SHA512 aeab2e0fa50c6014dd6407260d8f345f834dc9da1e4266e4a7b383ccbf29ec1e35c7cea68af3a261e38e6734baa6efd123a4bc50518fd388ad91da65f6886dfa
TLSH
T1AFD0A91422C2F3344B8345073C07F8A5633FAB1003E56048E46A0D43EE08074A778C1A
MD5 SHA1 SHA512 TLSH

Submit Download

nwgi3box.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nwgi3box\nwgi3box.cmdline
Size 369B
SHA256 66f0de52ff2799c269a1716b4ce15517e4065442d6c00eee920228373c869176
MD5 be847cf7de2fc580fb31c8f92e241be4
SHA1 c31c160d4e0c1df211710fcce8339f2741e2e77f
SHA512 4f2b7737a254992e20f262cd14391488026c91f007d11a7f9e50844babdc1b19cd5de2e73ebaae1a064cdbb18e1bcd2df29a40a4ae2e41cb47cd876b452e29ce
TLSH
T1F8E0DF2B5296C67D1DE9100B22ABC5BC8272468729817FC49954845DE06B0146FF2FED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1200-12-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-11-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-13-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-14-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-15-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-16-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-17-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-18-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-19-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-20-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-21-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-0-0x00007FFBFF45F000-0x00007FFBFF460000-memory.dmp

Download

memory/1200-10-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-8-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-7-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-6-0x000002AE466B0000-0x000002AE466D2000-memory.dmp

Download

memory/1200-34-0x000002AE46940000-0x000002AE46948000-memory.dmp

Download

memory/1200-36-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-37-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-38-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-39-0x000002AE46AB0000-0x000002AE46AC8000-memory.dmp

Download

memory/1200-44-0x00007FFBFF2D0000-0x00007FFBFFC74000-memory.dmp

Download

memory/1200-43-0x000002AE46AD0000-0x000002AE46AFD000-memory.dmp

Download

memory/3192-40-0x0000000140000000-0x00000001400AF000-memory.dmp

Download