Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 14, 2025, 10:09 a.m.	April 14, 2025, 10:18 a.m.

Size	469.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e3aecc3188eac24edb8e34f5044b3a6a`
SHA256	`782895a1a1f924fd2a8271667f7749723bbc02a2db458e56bd270f2ee122b88d`
CRC32	`7FC51182`
ssdeep	`12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSSn9:uiLJbpI7I2WhQqZ7S9`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library infoStealer_browser_b_Zero - browser info stealer Network_Downloader - File Downloader IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

remcos_a.exe "C:\Users\test22\AppData\Local\Temp\remcos_a.exe"
1880
- cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  1504
  - reg.exe C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    2092
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
  2152
  - cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
    2276
    - remcos.exe C:\ProgramData\Remcos\remcos.exe
      2340
      - cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        2384
        
        reg.exe C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        2584
      - svchost.exe svchost.exe
        2524

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
160.30.192.52	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 14, 2025, 10:10 a.m.			0	0

Command line console output was observed (19 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 14, 2025, 10:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW April 14, 2025, 10:09 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: -------------------------- * Remcos v3.8.0 Pro * BreakingSecurity.net -------------------------- console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:01:687 i \| Remcos Agent initialized console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:01:703 i \| Access Level: Administrator console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:01:703 i \| Connecting \| TLS On \| 160.30.192.52:2404 console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:01:890 i \| Watchdog module activated console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:22:828 E \| Connection Failed: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:23:828 i \| Connecting \| TLS On \| 160.30.192.52:2404 console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:44:859 E \| Connection Failed: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:10 a.m.	buffer: 10:50:45:859 i \| Connecting \| TLS On \| 160.30.192.52:2404 console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:11 a.m.	buffer: 10:51:06:890 E \| Connection Failed: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:11 a.m.	buffer: 10:51:07:890 i \| Connecting \| TLS On \| 160.30.192.52:2404 console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:11 a.m.	buffer: 10:51:28:890 E \| Connection Failed: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:11 a.m.	buffer: 10:51:29:890 i \| Connecting \| TLS On \| 160.30.192.52:2404 console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:11 a.m.	buffer: 10:51:50:968 E \| Connection Failed: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. console_handle: 0x0000000f	1	1
WriteConsoleA April 14, 2025, 10:11 a.m.	buffer: 10:51:51:968 i \| Connecting \| TLS On \| 160.30.192.52:2404 console_handle: 0x0000000f	1	1
WriteConsoleW April 14, 2025, 10:10 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1
WriteConsoleW April 14, 2025, 10:10 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 14, 2025, 10:09 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

A process attempted to delay the analysis task. (1 event)

description

remcos.exe tried to sleep 467 seconds, actually delayed analysis time by 467 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
cmdline	svchost.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\remcos_a.exe

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 14, 2025, 10:09 a.m.	thread_identifier: 524 thread_handle: 0x000000c4 process_identifier: 1504 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000c0	1	1
ShellExecuteExW April 14, 2025, 10:09 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\install.vbs parameters: filepath: C:\Users\test22\AppData\Local\Temp\install.vbs	1	1
ShellExecuteExW April 14, 2025, 10:10 a.m.	show_type: 0 filepath_r: cmd parameters: /c "C:\ProgramData\Remcos\remcos.exe" filepath: cmd	1	1
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2388 thread_handle: 0x000000c4 process_identifier: 2384 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000c0	1	1

Yara rule detected in process memory (22 events)

description	Create a windows service	rule	Create_Service
description	Client_SW_User_Data_Stealer	rule	Client_SW_User_Data_Stealer
description	Win Backdoor RemcosRAT	rule	Win_Backdoor_RemcosRAT
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	browser info stealer	rule	infoStealer_browser_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Run a KeyLogger	rule	KeyLogger

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess April 14, 2025, 10:10 a.m.	status_code: 0x00000000 process_identifier: 2436 process_handle: 0x000000c8		0	0
NtTerminateProcess April 14, 2025, 10:10 a.m.	status_code: 0x00000000 process_identifier: 2436 process_handle: 0x000000c8	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
cmdline	/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Communicates with host for which no DNS query was performed (1 event)

host

160.30.192.52

Installs itself for autorun at Windows startup (50 out of 120 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos	reg_value	"C:\ProgramData\Remcos\remcos.exe"

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 14, 2025, 10:10 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2524 process_handle: 0x00000158	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2340 called NtSetContextThread to modify thread in remote process 2524
NtSetContextThread April 14, 2025, 10:10 a.m.	registers.eip: 2005598660 registers.esp: 1308696 registers.edi: 0 registers.eax: 1517476 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000154 process_identifier: 2524	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	cmd /c "C:\ProgramData\Remcos\remcos.exe"
parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2340 resumed a thread in remote process 2524
NtResumeThread April 14, 2025, 10:10 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2524	1	0	0

Disables Windows Security features (1 event)

description

attempts to disable user access control

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

160.30.192.52:2404

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 14, 2025, 10:09 a.m.	thread_identifier: 524 thread_handle: 0x000000c4 process_identifier: 1504 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000c0	1	1
NtResumeThread April 14, 2025, 10:09 a.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1880	1	0
CreateProcessInternalW April 14, 2025, 10:09 a.m.	thread_identifier: 2156 thread_handle: 0x0000029c process_identifier: 2152 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000290	1	1
CreateProcessInternalW April 14, 2025, 10:09 a.m.	thread_identifier: 2096 thread_handle: 0x00000084 process_identifier: 2092 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\reg.exe track: 1 command_line: C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f filepath_r: C:\Windows\System32\reg.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2280 thread_handle: 0x000002f4 process_identifier: 2276 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002fc	1	1
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2344 thread_handle: 0x00000084 process_identifier: 2340 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\ProgramData\Remcos\remcos.exe track: 1 command_line: C:\ProgramData\Remcos\remcos.exe filepath_r: C:\ProgramData\Remcos\remcos.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2388 thread_handle: 0x000000c4 process_identifier: 2384 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000000c0	1	1
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2440 thread_handle: 0x000000cc process_identifier: 2436 current_directory: filepath: track: 1 command_line: c:\program files (x86)\google\chrome\application\chrome.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000c8	1	1
NtGetContextThread April 14, 2025, 10:10 a.m.	thread_handle: 0x000000cc		3221225485
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: track: 0 command_line: C:\Program Files(x86)\Internet Explorer\ieinstal.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: filepath: track: 0 command_line: C:\Program Files(x86)\Internet Explorer\ielowutil.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000		0
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2528 thread_handle: 0x00000154 process_identifier: 2524 current_directory: filepath: track: 1 command_line: svchost.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000158	1	1
NtGetContextThread April 14, 2025, 10:10 a.m.	thread_handle: 0x00000154	1	0
NtMapViewOfSection April 14, 2025, 10:10 a.m.	section_handle: 0x00000164 process_identifier: 2524 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00140000 allocation_type: 0 () section_offset: 0 view_size: 520192 process_handle: 0x00000158	1	0
WriteProcessMemory April 14, 2025, 10:10 a.m.	buffer: base_address: 0x7efde008 process_identifier: 2524 process_handle: 0x00000158	1	1
NtSetContextThread April 14, 2025, 10:10 a.m.	registers.eip: 2005598660 registers.esp: 1308696 registers.edi: 0 registers.eax: 1517476 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000154 process_identifier: 2524	1	0
NtResumeThread April 14, 2025, 10:10 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2524	1	0
CreateProcessInternalW April 14, 2025, 10:10 a.m.	thread_identifier: 2588 thread_handle: 0x00000084 process_identifier: 2584 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\reg.exe track: 1 command_line: C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f filepath_r: C:\Windows\System32\reg.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

File has been identified by 66 AntiVirus engines on VirusTotal as malicious (50 out of 66 events)

Bkav	W32.NmePomklM.Trojan
Lionic	Trojan.Win32.Remcos.4!c
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Backdoor.RemcosRI.S28628436
Skyhigh	BehavesLike.Win32.Remcos.gh
ALYac	Generic.Dacic.A9349469.A.7E1755CF
Cylance	Unsafe
VIPRE	Generic.Dacic.A9349469.A.7E1755CF
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Generic.Dacic.A9349469.A.7E1755CF
K7GW	Trojan ( 0053ac2c1 )
K7AntiVirus	Trojan ( 0053ac2c1 )
Arcabit	Generic.Dacic.A9349469.A.7E1755CF
Baidu	Win32.Trojan.Kryptik.awm
VirIT	Trojan.Win32.Genus.LRH
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Remcos
ESET-NOD32	a variant of Win32/Rescoms.B
APEX	Malicious
Avast	Win32:MalwareX-gen [Rat]
ClamAV	Win.Trojan.Remcos-9841897-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:Win32/Remcos.a1b725cb
NANO-Antivirus	Trojan.Win32.Rescoms.jrvcmj
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
MicroWorld-eScan	Generic.Dacic.A9349469.A.7E1755CF
Rising	Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft	Generic.Dacic.A9349469.A.7E1755CF (B)
F-Secure	Backdoor.BDS/Backdoor.Gen
DrWeb	Trojan.Siggen18.37973
Zillya	Trojan.Rescoms.Win32.1014
TrendMicro	Backdoor.Win32.REMCOS.SMCHD
McAfeeD	Real Protect-LS!E3AECC3188EA
CTX	exe.trojan.remcos
Sophos	Troj/Remcos-DI
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Generic.hlqfz
Webroot	W32.Trojan.Gen
Google	Detected
Avira	BDS/Backdoor.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Rescoms.b
Kingsoft	malware.kb.a.999
Gridinsoft	Trojan.Win32.Remcos.tr
Microsoft	Trojan:Win32/Remcos!pz
ViRobot	Trojan.Win.Z.Rescoms.480768.KP
ZoneAlarm	Troj/Remcos-DI
GData	Win32.Malware.Bucaspys.B
Varist	W32/Trojan.JUMH-7419

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

remcos_a.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All