Overview

overview

10

Static

static

5

2026-11-09...os.exe

windows10-2004-x64

10

2026-11-09...os.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/11/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  • Size 997KB
  • Sample261111-e8256stx6q
  • SHA256 07e6cc080fd14a6ad2390c34b2bc464d1ba31e0c2a459adfeb5061a22b5f3301
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hostdiscoveryexecutionremcospersistenceprivilege_escalationrat

Malware Config

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • 213.208.129.213:137

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    srvs.exe

  • copy_folder

    WindowsApp

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    WindowsApp

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_jpetmoenqu

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    srvs

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Custom signature
    detects Windows exceutables potentially bypassing UAC using eventvwr.exe 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 3 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 21 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
    1⤵
    • Creates a file in the Startup directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Windows\SysWOW64\PING.EXE
          PING 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:812
        • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
          "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
          4⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4780
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4496
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4728
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:5064
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4668
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4424
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4916
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4744
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:1884
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:2080
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:2252
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:3620
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:2112
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4656
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:1592
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4296
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:1176
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            5⤵
            • Executes dropped EXE
            PID:4736
    • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
      2⤵
        PID:4960
      • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
        2⤵
          PID:4028
        • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
          2⤵
            PID:2076
          • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
            2⤵
              PID:1748
            • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
              2⤵
                PID:2820
              • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                2⤵
                  PID:4224
                • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                  2⤵
                    PID:1460
                  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                    2⤵
                      PID:1640
                    • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                      2⤵
                        PID:812
                      • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                        2⤵
                          PID:4472
                        • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                          "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                          2⤵
                            PID:4436
                          • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                            2⤵
                              PID:4092
                            • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                              "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                              2⤵
                                PID:4064
                              • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                2⤵
                                  PID:2496
                                • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                  2⤵
                                    PID:1752
                                • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
                                  "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
                                  1⤵
                                  • Creates a file in the Startup directory
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of WriteProcessMemory
                                  PID:4004
                                  • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
                                    "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Reads the TCP/IP host and domain name from the registry
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4776

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      install.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\install.bat
                                      • Size 101B
                                      • SHA256 e6f65c9e9b69042c7ac81b8249ca98ba081f71e9025d4e3d700e6f3cea820077
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      RmClient.url
                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url
                                      • Size 64B
                                      • SHA256 749d7d16186b3d8b4d53abdc87a9cf2d6334ec9b5ee5e73e24e9db64937bb0b8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      srvs.exe
                                      • Path C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
                                      • Size 997KB
                                      • SHA256 07e6cc080fd14a6ad2390c34b2bc464d1ba31e0c2a459adfeb5061a22b5f3301
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      RmClient.vbs
                                      • Path C:\Users\Admin\MdRes\RmClient.vbs
                                      • Size 103B
                                      • SHA256 2f48612a9514cda737b94c5786373ac3821a4ea94be793397db387eea3296b5e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      klist.exe
                                      • Path C:\Users\Admin\MdRes\klist.exe
                                      • Size 999KB
                                      • SHA256 606f3c735bf8aae5ede1db1af79bd60923b9a5860ba91658d2306ad50ad7d650
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      klist.exe
                                      • Path C:\Users\Admin\MdRes\klist.exe
                                      • Size 999KB
                                      • SHA256 079129ea520d34dc61ca25f027056a8fb3573b92181bf95b16b4410d6b2f6d67
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      memory/1040-3-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
                                      Download

                                      memory/2792-4-0x0000000000400000-0x0000000000417000-memory.dmp
                                      Download

                                      memory/2792-10-0x0000000000400000-0x0000000000417000-memory.dmp
                                      Download

                                      memory/4776-37-0x0000000000400000-0x0000000000417000-memory.dmp
                                      Download

                                      memory/4776-38-0x0000000000400000-0x0000000000417000-memory.dmp
                                      Download