Overview

overview

10

Static

static

5

2026-11-09...os.exe

windows10-2004-x64

10

2026-11-09...os.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/11/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  • Size 997KB
  • Sample261111-e8256stx6q
  • SHA256 07e6cc080fd14a6ad2390c34b2bc464d1ba31e0c2a459adfeb5061a22b5f3301
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hostdiscoveryexecutionremcospersistenceprivilege_escalationrat

Malware Config

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • 213.208.129.213:137

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    srvs.exe

  • copy_folder

    WindowsApp

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    WindowsApp

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_jpetmoenqu

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    srvs

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Custom signature
    detects Windows exceutables potentially bypassing UAC using eventvwr.exe 4 IoCs
  • Creates a file in the Startup directory 1 TTPs 3 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 28 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
    1⤵
    • Creates a file in the Startup directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
      2⤵
        PID:4148
      • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Windows\SysWOW64\PING.EXE
            PING 127.0.0.1 -n 2
            4⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4780
          • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
            "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
            4⤵
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5724
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:3276
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:1252
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:484
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:2036
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:3244
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:3412
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:5600
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4724
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:1888
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:5244
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4812
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:1820
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:3732
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:2876
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4328
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4448
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4640
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4452
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:5572
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4132
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:3444
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:5264
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:5948
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:552
            • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
              "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
              5⤵
              • Executes dropped EXE
              PID:4372
      • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
        2⤵
          PID:5632
        • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
          2⤵
            PID:1112
          • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
            2⤵
              PID:1480
            • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
              2⤵
                PID:4624
              • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                2⤵
                  PID:5336
                • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                  2⤵
                    PID:4168
                  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                    2⤵
                      PID:2232
                    • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                      2⤵
                        PID:1240
                      • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                        2⤵
                          PID:3808
                        • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                          "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                          2⤵
                            PID:2320
                          • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                            2⤵
                              PID:3536
                            • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                              "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                              2⤵
                                PID:1560
                              • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                2⤵
                                  PID:2496
                                • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                  2⤵
                                    PID:4844
                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                    2⤵
                                      PID:268
                                    • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                      2⤵
                                        PID:2632
                                      • C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-11-09_04062262aa5ea40a3af154e743a4e786_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
                                        2⤵
                                          PID:3548
                                      • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
                                        "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
                                        1⤵
                                        • Creates a file in the Startup directory
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of WriteProcessMemory
                                        PID:368
                                        • C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
                                          "C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Reads the TCP/IP host and domain name from the registry
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5500

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            install.bat
                                            • Path C:\Users\Admin\AppData\Local\Temp\install.bat
                                            • Size 101B
                                            • SHA256 e6f65c9e9b69042c7ac81b8249ca98ba081f71e9025d4e3d700e6f3cea820077
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            RmClient.url
                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RmClient.url
                                            • Size 64B
                                            • SHA256 749d7d16186b3d8b4d53abdc87a9cf2d6334ec9b5ee5e73e24e9db64937bb0b8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            srvs.exe
                                            • Path C:\Users\Admin\AppData\Roaming\WindowsApp\srvs.exe
                                            • Size 997KB
                                            • SHA256 07e6cc080fd14a6ad2390c34b2bc464d1ba31e0c2a459adfeb5061a22b5f3301
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            RmClient.vbs
                                            • Path C:\Users\Admin\MdRes\RmClient.vbs
                                            • Size 103B
                                            • SHA256 2f48612a9514cda737b94c5786373ac3821a4ea94be793397db387eea3296b5e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            klist.exe
                                            • Path C:\Users\Admin\MdRes\klist.exe
                                            • Size 999KB
                                            • SHA256 dfb01a263e31b43fe3bdca387671d6732ae4dde5a62e0db25e096da4a809871d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            klist.exe
                                            • Path C:\Users\Admin\MdRes\klist.exe
                                            • Size 999KB
                                            • SHA256 add773e79eeefd867ba259d77203c575586a6e9be914b8b9ce688c44539a67e9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            klist.exe
                                            • Path C:\Users\Admin\MdRes\klist.exe
                                            • Size 999KB
                                            • SHA256 5d4ec382500ece14be3901dc3bebc63ea0b4605acb9e128ac1c24d547756093f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/2200-4-0x0000000000400000-0x0000000000417000-memory.dmp
                                            Download

                                            memory/2200-10-0x0000000000400000-0x0000000000417000-memory.dmp
                                            Download

                                            memory/4316-3-0x0000000003520000-0x0000000003521000-memory.dmp
                                            Download

                                            memory/5500-35-0x0000000000400000-0x0000000000417000-memory.dmp
                                            Download

                                            memory/5500-36-0x0000000000400000-0x0000000000417000-memory.dmp
                                            Download