e37258a3586b4571338cc84b84525c9a80d1ae0b1e9bbfed1182533975b37c17

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
remcos.exe
Size 482KB
Sample261109-ql9saaz1fx
SHA256 e37258a3586b4571338cc84b84525c9a80d1ae0b1e9bbfed1182533975b37c17
MD5 b4462f0cca7495621e06185843dd353a
SHA1 2ea125954ef3a5889682c9760f63a215b22e6ce0
SHA512 e041832906fc1b933f2640d01017d4b58a063a263d9764d83f29afbf5ea0e83819642ff0a7a6506e6ab5cf67fba60891337d285605c2b1b8c99f6bfa47011e60
SSDEEP 12288:N13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQZS:Hak/mBXTV/R0nEF76gFZS
TLSH
T11CA4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 3416	4872	remcos.exe	89
PID 4872 set thread context of 1660	4872	remcos.exe	90
PID 4872 set thread context of 5124	4872	remcos.exe	91
PID 4872 set thread context of 260	4872	remcos.exe	92
PID 4872 set thread context of 4572	4872	remcos.exe	93
PID 4872 set thread context of 256	4872	remcos.exe	94
PID 4872 set thread context of 3320	4872	remcos.exe	95
PID 4872 set thread context of 4320	4872	remcos.exe	96
PID 4872 set thread context of 1424	4872	remcos.exe	97
PID 4872 set thread context of 4900	4872	remcos.exe	98
PID 4872 set thread context of 1032	4872	remcos.exe	99
PID 4872 set thread context of 3168	4872	remcos.exe	100
PID 4872 set thread context of 5220	4872	remcos.exe	101
PID 4872 set thread context of 4056	4872	remcos.exe	102
PID 4872 set thread context of 5436	4872	remcos.exe	103
PID 4872 set thread context of 2708	4872	remcos.exe	104
PID 4872 set thread context of 2240	4872	remcos.exe	105
PID 4872 set thread context of 3204	4872	remcos.exe	106
PID 4872 set thread context of 5572	4872	remcos.exe	108
PID 4872 set thread context of 5980	4872	remcos.exe	109
PID 4872 set thread context of 4600	4872	remcos.exe	110
PID 4872 set thread context of 6008	4872	remcos.exe	111
PID 4872 set thread context of 2672	4872	remcos.exe	112
PID 4872 set thread context of 1780	4872	remcos.exe	113
PID 4872 set thread context of 2976	4872	remcos.exe	114
PID 4872 set thread context of 5700	4872	remcos.exe	115
PID 4872 set thread context of 3156	4872	remcos.exe	116
PID 4872 set thread context of 5564	4872	remcos.exe	117
PID 4872 set thread context of 4628	4872	remcos.exe	118
PID 4872 set thread context of 2272	4872	remcos.exe	119

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	remcos.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Suspicious behavior: MapViewOfSection 1 TTPs 30 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe
4872	remcos.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3416	4872	remcos.exe	89
PID 4872 wrote to memory of 1660	4872	remcos.exe	90
PID 4872 wrote to memory of 5124	4872	remcos.exe	91
PID 4872 wrote to memory of 260	4872	remcos.exe	92
PID 4872 wrote to memory of 4572	4872	remcos.exe	93
PID 4872 wrote to memory of 256	4872	remcos.exe	94
PID 4872 wrote to memory of 3320	4872	remcos.exe	95
PID 4872 wrote to memory of 4320	4872	remcos.exe	96
PID 4872 wrote to memory of 1424	4872	remcos.exe	97
PID 4872 wrote to memory of 4900	4872	remcos.exe	98
PID 4872 wrote to memory of 1032	4872	remcos.exe	99
PID 4872 wrote to memory of 3168	4872	remcos.exe	100
PID 4872 wrote to memory of 5220	4872	remcos.exe	101
PID 4872 wrote to memory of 4056	4872	remcos.exe	102
PID 4872 wrote to memory of 5436	4872	remcos.exe	103
PID 4872 wrote to memory of 2708	4872	remcos.exe	104
PID 4872 wrote to memory of 2240	4872	remcos.exe	105
PID 4872 wrote to memory of 3204	4872	remcos.exe	106
PID 4872 wrote to memory of 5572	4872	remcos.exe	108
PID 4872 wrote to memory of 5980	4872	remcos.exe	109
PID 4872 wrote to memory of 4600	4872	remcos.exe	110
PID 4872 wrote to memory of 6008	4872	remcos.exe	111
PID 4872 wrote to memory of 2672	4872	remcos.exe	112
PID 4872 wrote to memory of 1780	4872	remcos.exe	113
PID 4872 wrote to memory of 2976	4872	remcos.exe	114
PID 4872 wrote to memory of 5700	4872	remcos.exe	115
PID 4872 wrote to memory of 3156	4872	remcos.exe	116
PID 4872 wrote to memory of 5564	4872	remcos.exe	117
PID 4872 wrote to memory of 4628	4872	remcos.exe	118
PID 4872 wrote to memory of 2272	4872	remcos.exe	119

C:\Users\Admin\AppData\Local\Temp\remcos.exe
"C:\Users\Admin\AppData\Local\Temp\remcos.exe"
1⤵
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\paamwgqxtsvdkebmplazigknwgtmiclqsw"
  2⤵
  PID:3416
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\zcgfxz"
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\cwlyxrlsvi"
  2⤵
  PID:5124
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\wlhpuqgdjekojsiaiknnlzlnyfzic"
  2⤵
  PID:260
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\hnmaujrxxmctlgemavaowmyezljrvpez"
  2⤵
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\rirsv"
  2⤵
  PID:256
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\mxnkriwkgryrznwwksbbpsev"
  2⤵
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\ortcsageuzqektsatdncafyebkon"
  2⤵
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\ytgvttrfihijmzgeloiwcjtvcqgwrbx"
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\taumprdrwemcyalkeso"
  2⤵
  PID:4900
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\dczxqkokkmehiozwvdjqdxr"
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\gwmprczmguwulvvaenvsgkmufp"
  2⤵
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\alahnbtxtrbnxv"
  2⤵
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\kgozoterhztshcokpk"
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\vitspmptvhlxjqkogvjgr"
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\pxhjlljejd"
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\sruumduyxlhvf"
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\ctznmveztuziidrk"
  2⤵
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\hcbxkvcf"
  2⤵
  PID:5572
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\jwgpkfugigo"
  2⤵
  PID:5980
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\uzlalxfawogyrfb"
  2⤵
  PID:4600
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\oghrherlklkrdggimasczkwthupppgijbc"
  2⤵
  PID:6008
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\zinkix"
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\bcscjpngtb"
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\droufohshgyubbndgzgqdcxajsvtj"
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\gltmggsuvoqhehjhxkssnhkjkynukbakr"
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\qngxh"
  2⤵
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\lcuodxxzwsnfaobrihtegvqa"
  2⤵
  PID:5564
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\vxaheqiasbfkcuyvrsggrikrexsx"
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\remcos.exe
  C:\Users\Admin\AppData\Local\Temp\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\yznafisugjxpnimhidahunxandcgynt"
  2⤵
  PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-6-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3416-0-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4872-82-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4872-85-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4872-86-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4872-88-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4872-87-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4872-89-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5124-8-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads