remcos | 08ac0b0b248a5982f4140e5111b7b25132437da350cd92451c10d5929ecb917e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice_scan.js
Size 1.9MB
Sample261101-ns7kdsvset
SHA256 08ac0b0b248a5982f4140e5111b7b25132437da350cd92451c10d5929ecb917e
MD5 0161dfc7f44d1df66f9b07e35f2c7b99
SHA1 cc0d3f4671d735c3d85f8d6704e6fb6e068e2262
SHA512 b2967fa08628099a2bfe9379eb76b1808a7b24d457050decace887d06d067ad24d17a221e100104b16603ef1f6394a32e8f39b3cf0b19b5004b3dadc0b8e3a57
SSDEEP 24576:6Jxu6xnSLKzNqid/n/xUH2ISemwuQt5FOF8aZVHP/6QZ89SDwBAuBgfXTg6cG2+3:6JlSebGO3n6Q4BhBG3
TLSH
T17695F314DE6714FCBC1FA4034BAE5E4509BB5A231620C882766EA4CFCF1655B6C3A8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aedesegypti defense_evasion discovery execution remcos persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

AedesEgypti

23.132.164.115:2595

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-AS5Y4K
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	MSBuild.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	graphviewcg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 2832	4060	graphviewcg.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	graphviewcg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3488	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2832	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 3488	732	wscript.exe	82
PID 732 wrote to memory of 4060	732	wscript.exe	93
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94
PID 4060 wrote to memory of 2832	4060	graphviewcg.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\invoice_scan.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "ChannelIndex58" /xml "C:\Users\Admin\AppData\Local\Temp\1340827.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\graphviewcg.exe
  "C:\Users\Admin\AppData\Local\Temp\graphviewcg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - UAC bypass
    - Suspicious use of SetWindowsHookEx
    PID:2832

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 170B
SHA256 957ccb50056f6f3ca7b58ed2d1a50cc0ada82d242867c24ca6b8989cf31fc989
MD5 70862378fe4fa57b0071711d2831f000
SHA1 8a5667700f2435ed798e76482e5c295cf884b208
SHA512 4b1607a495589533543c4984abc0df3152bd02ee59429cea72f089d8cb0191588517775412d34ce87911869f3245424c68ef3a078000fd7e825706bd61227993
TLSH
T13FC04C5633F1101AB9F6576E98B600762E70B968093ED98C13D0424C19F0E00A855B9F
MD5 SHA1 SHA512 TLSH

Submit Download

1340827.xml

Path C:\Users\Admin\AppData\Local\Temp\1340827.xml
Size 1KB
SHA256 1ef6c34d9d875366575f97e6505d3a1d92cf4bd537f60825080d3be775ece413
MD5 63fa372040f93843e45c60d08e0cebf6
SHA1 b983acd3a09fb970f956130042d922d4a24d2971
SHA512 d585bea3586cb584ca93912c1ca2c460ff9cf65da2b276758dfd01bafda6658962781d441f764badceaa477a8485cd92a8715abac71c6cb5f531e3eeb944ced1
TLSH
T1FD315843ABFD220DF1F76F5CAABA545199BAFD655C28D46D0070090D0930E71C9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

cachecg.store

Path C:\Users\Admin\AppData\Local\Temp\cachecg.store
Size 318KB
SHA256 c4f7897739312e790b8566d3f5dc05a9fd2f9f2fc82520c5d3f49291f30c7d8c
MD5 ac446ee277ea1afe9a93cad9dc2ad125
SHA1 85f3289308c94b8704b97c6d137da342d22a385a
SHA512 ceda3cb55103ed1ee89415b6994a1dfbf2950da95fe4f6e971737b7c6666aa64adfa17d7b3e12011d3f7a8372e9fef6df6dd2c6b60b5c7f9bb509ec90c6dd578
SSDEEP 6144:2T6RKb2hPZqN6Y0TucEuGiXyCJ6g+FVj4hSQspMiBrmHXQcbgQAZ4JHcrGVWF/zT:vRKbA80lhHwj4hSQsp/Hc0t4JA1zPuNI
TLSH
T15164236815977D3CE868CFFE6EF4E1A21D1CECFD45D00263E6E61F156260CD981AE222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

graphviewcg.exe

Path C:\Users\Admin\AppData\Local\Temp\graphviewcg.exe
Size 546KB
SHA256 9cf98864fb027867f9a2252dee6268a882194c64dea60990c29e9572b60bc828
MD5 abee6e83b271b4dffb745f159962ebb0
SHA1 23bc2fd27d5bf28a1925dc3fc182e61b3c4343e8
SHA512 ae53a84d3c2cbe83a0458906040738d011ae0635358eaec1fa1d839e09bc0b786482cd98c2d26e18c30e4e62d926b55ba16846a52affd4a04957d7a72688aece
SSDEEP 12288:lQTQkA4apWrSZ7iFCiAD5ij6yMTGslmvjnRfXLT0vjnQqn:lQxFPL2bn
TLSH
T1BAC4877EB8F8FBB78075C237B5F19052F9AB512792080858B195738F3EB8905A08FD65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2832-24-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-29-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-16-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-17-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-18-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-21-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-22-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-23-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-14-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-27-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-28-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-15-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-49-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-36-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-37-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-41-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-42-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-43-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-44-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/2832-48-0x0000000000800000-0x0000000000890000-memory.dmp

Download

memory/4060-13-0x0000000000406000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads