Malware Analysis Report – Remcos RAT 7.2.6 Light Embedded VBS Loader

Summary

Static reverse engineering identified the embedded payload as Remcos RAT 7.2.6 Light, a commercially available remote administration tool frequently abused by threat actors. The analyzed sample is delivered through a Visual Basic Script (VBS) loader that reconstructs an embedded PE executable from a Base64 blob before writing it to disk and executing it.

Analysis identified functionality consistent with Remcos including browser artifact collection, screenshot capture, clipboard interaction, process enumeration, downloader capabilities, registry manipulation, HTTP and native socket communications, TLS support, host profiling, and modular command processing.

Sample Information

Stage 1 – VBS Wrapper

Stage 2 – Embedded Executable

Stage One Analysis

The VBS wrapper performs only four operations:

• Decodes an embedded Base64 blob.

• Reconstructs the embedded PE executable.

• Writes the executable to %TEMP%\hepi8.exe.

• Executes the payload.

No networking, persistence, credential collection, or browser interaction logic exists within the script itself.

High-Level Architecture

                 VBS Loader
                      │
                      ▼
              Embedded PE Payload
                      │
     ┌──────────────┬──────────────┬──────────────┐
     │              │              │
     ▼              ▼              ▼
 Browser        Networking      Host Profiling
 Collection        Engine
     │              │              │
     ▼              ▼              ▼
 Browser      HTTP / TCP      GeoIP Lookup
 Profiles      TLS Client
     │              │
     ▼              ▼
 Upload Engine  Session Initialization
     │
     ▼
 Browser Cleanup
     │
     ▼
 Screenshot • Clipboard • Process Enumeration

Browser Support

Static analysis identified dedicated support for:

• Google Chrome

• Microsoft Edge

• Brave Browser

• Opera

• Opera GX

• Mozilla Firefox

• Internet Explorer

Observed browser paths include:

• \Google\Chrome\User Data

• \Microsoft\Edge\User Data

• \BraveSoftware\Brave-Browser\User Data

• \Opera Software\Opera Stable

• \Opera Software\Opera GX Stable

• \Mozilla\Firefox\Profiles\

Observed browser artifacts include:

• Login Data

• Cookies

• Network\Cookies

• StoredLogins

• cookies.sqlite

• logins.json

Functional Analysis

Browser Dispatcher

Function

fcn.0040ad02

Responsibilities

• Reads Explorer User Shell Folder registry values

• Expands environment variables

• Resolves browser profile directories

• Dispatches browser-specific collection modules

• Invokes Internet Explorer cookie processing when applicable

• Records browser processing status

Chrome Collection Module

Function

fcn.0040a35f

Creates the Chrome collection context before delegating processing to:

fcn.0040a25c

Observed references include:

• Chrome

• \Google\Chrome\User Data

Equivalent collection routines exist for Edge, Brave, Opera, Opera GX, Firefox and Internet Explorer.

Browser Artifact Processor

Function

fcn.0040a25c

Shared browser processing routine responsible for:

• Login Data

• StoredLogins

• Browser profile handling

Delegates artifact processing to:

fcn.00409f76

Browser Artifact Discovery

Function

fcn.00409d90

Determines whether browser artifacts are present by checking for:

• Login Data

• Cookies

• Network\Cookies

Returns a Boolean result used by the processing engine.

Shared Browser Processing Engine

Function

fcn.00409f76

Approximate size:

742 instructions

Responsibilities include:

• Browser artifact validation

• Artifact enumeration

• Path construction

• Database processing

• Cleanup

• Status reporting

Observed execution states:

• Not Found

• Found, Cleared

• Found, Retrying Later

The retry path likely handles locked browser databases while browsers remain active.

The routine invokes:

• DeleteFileW

indicating cleanup after processing.

Browser Structure Walker

Function

fcn.0040b20a

Iterates browser structures using fixed 24-byte records before forwarding them to:

fcn.0040b564

Likely responsible for traversing internal browser collections.

Upload Module

Function

fcn.0040769c

Responsible for uploading collected files.

Observed APIs:

• CreateFileW

• ReadFile

• GetFileSizeEx

• SetFilePointerEx

Files are transferred in approximately 100,000-byte chunks.

Observed status messages:

• Uploading file to Controller:

• Uploaded file:

• Failed to upload file:

HTTP Communication Module

Function

fcn.0041666d

Generic HTTP communication routine.

Observed APIs:

• InternetOpenW

• InternetOpenUrlW

• InternetReadFile

The routine accepts caller-supplied URLs and downloads their contents into an internal buffer rather than being dedicated to a single endpoint.

Cross-references demonstrate that it is used for victim geolocation through the embedded GeoIP service.

Network Session Initializer

Function

fcn.004016a3

Initializes the internal networking context.

Responsibilities include:

• Socket creation

• Session state initialization

• Buffer allocation

• Event creation

• Connection object initialization

This routine prepares the networking structures used by later communication components.

Secure Communications

Function

fcn.00401745

Implements connection establishment and secure communications.

Observed capabilities include:

• connect()

• TLS handshake

• Peer authentication

• Session establishment

• Connection cleanup

• Error handling

Observed diagnostic strings include:

• TLS Handshake…

• TLS Authentication Failed

• TLS Error 1

• TLS Error 2

• TLS Error 3

• TLS On

• TLS Off

Static analysis indicates the malware incorporates its own TLS communication layer in addition to WinINet functionality.

Controller Initialization

Function

fcn.004110ca

Primary networking initialization routine.

Observed responsibilities include:

• Sleep-based beacon delay

• Configuration loading

• Host metadata collection

• GeoIP integration

• Session initialization

• Connection status reporting

Observed strings include:

• Connecting |

• Connected |

• Connection Error

• 7.2.6 Light

Static analysis indicates this function prepares the malware’s initial communication with the remote controller, although the complete protocol was not reconstructed.

Screenshot Capture Module

Function

fcn.00414a15

Captures the desktop and constructs a bitmap entirely in memory.

Observed APIs:

• CreateDCA

• CreateCompatibleDC

• CreateCompatibleBitmap

• StretchBlt

• BitBlt

• DrawIcon

• GetDIBits

The implementation manually constructs a valid BMP image before returning the completed bitmap.

Clipboard Module

Observed APIs include:

• OpenClipboard

• GetClipboardData

• EmptyClipboard

• CloseClipboard

Multiple clipboard access attempts indicate dedicated clipboard interaction capability.

Process Enumeration

Function

fcn.0040d977

Enumerates running processes using:

• CreateToolhelp32Snapshot

• Process32FirstW

• Process32NextW

Current static analysis indicates process inventory generation rather than process termination.

Privilege Detection

Function

fcn.004170ad

Determines the privilege level of the current process.

The function invokes GetCurrentProcess() before calling a dynamically resolved privilege-check routine. The resulting privilege flag is cached and referenced later by other components.

Registry Operations

Function

fcn.004103a3

Generic registry modification wrapper.

Observed APIs:

• RegCreateKeyW

• RegSetValueExW

• RegCloseKey

Although registry modification capability is present, static analysis did not identify a confirmed persistence path or autorun registry key.

Downloader

Observed helper:

URLDownloadToFileW

Two independent download call sites were identified, indicating dedicated download functionality separate from the HTTP communication layer.

Host Profiling

Victim geolocation is performed using:

https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&fields=25948155

Cross-references show this URL is supplied to the generic HTTP communication routine before the returned information is incorporated into the malware’s host profiling workflow.

Imported Capabilities

Networking

• InternetOpenW

• InternetOpenUrlW

• InternetReadFile

• URLDownloadToFileW

• getaddrinfo

• socket

• connect

Browser Interaction

• Browser profile access

• Clipboard APIs

Graphics

• BitBlt

• StretchBlt

• DrawIcon

• GetDIBits

Registry

• RegCreateKeyExW

• RegCreateKeyW

• RegOpenKey

• RegSetValueExW

Process Management

• CreateToolhelp32Snapshot

• Process32FirstW

• Process32NextW

File Operations

• CreateFileW

• ReadFile

• DeleteFileW

• GetFileSizeEx

• SetFilePointerEx

Cryptography

• CryptAcquireContextA

• CryptGenRandom

• CryptReleaseContext

Assessment

Static reverse engineering confirms that the recovered executable is Remcos RAT 7.2.6 Light, delivered through a self-contained VBS loader that reconstructs and executes an embedded PE payload.

Analysis identified a mature and modular architecture composed of independent components responsible for browser artifact collection, browser cleanup, host profiling, screenshot capture, clipboard interaction, process enumeration, privilege detection, registry manipulation, downloader functionality, HTTP communications, native Winsock networking, TLS session establishment, and controller communications.

Browser collection routines support multiple browser families including Google Chrome, Microsoft Edge, Brave Browser, Opera, Opera GX, Mozilla Firefox, and Internet Explorer. Rather than implementing duplicated logic for each browser, dedicated collection modules delegate processing to a shared browser artifact engine responsible for enumeration, validation, upload, cleanup, and operational status reporting.

Networking functionality extends beyond standard WinINet usage. The malware incorporates both generic HTTP retrieval routines and a native socket-based communication layer supporting DNS resolution, TCP connectivity, optional TLS transport, session initialization, and structured controller communications. Host profiling is further supplemented through integration with an external GeoIP service.

Although browser credential theft represents a significant capability, the recovered functionality demonstrates that the malware is a complete remote access framework rather than a standalone information stealer. The separation of browser collection, networking, controller communications, downloader functionality, and host interaction into discrete modules reflects a mature and reusable codebase designed to support a wide range of operator-controlled tasks.

Dynamic analysis would be required to fully reconstruct the command protocol, runtime task execution, persistence behavior, and browser credential decryption workflow. However, the recovered static functionality alone provides sufficient evidence to characterize the sample as a full-featured Remcos RAT deployment.

Indicators of Compromise (IOCs)

Original VBS SHA-256

405ef24e22c3dd939e0e1df0f2a0a0a66dbea9c7d8b0c4fa58fe76fad8764ef8

Extracted Executable SHA-256

83777cd78c7b2378dcdde7556591d4c33464e24551546cb8bd15f976dda0c83d

Dropped Executable

%TEMP%\hepi8.exe

Embedded GeoIP Endpoint

https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&fields=25948155

Analysis Limitations

This assessment is based exclusively on static reverse engineering of the recovered executable.

Dynamic execution was intentionally excluded. Consequently, the following behaviors remain unconfirmed:

• Complete command-and-control protocol

• Runtime command dispatch

• Browser credential decryption workflow

• Persistence mechanism

• Secondary payload retrieval

• Operator task execution

Conclusion

The analyzed VBS script functions exclusively as a delivery wrapper for Remcos RAT 7.2.6 Light. Its sole purpose is to decode an embedded Base64-encoded PE payload, reconstruct the executable, write it to disk, and launch it.

Static reverse engineering of the embedded executable revealed a mature remote access framework composed of modular components responsible for browser artifact collection, browser cleanup, screenshot capture, clipboard interaction, host profiling, privilege detection, process enumeration, registry modification, downloader functionality, HTTP communications, native Winsock networking, optional TLS transport, and structured controller communications.

The browser collection subsystem supports multiple browser families through dedicated discovery routines that feed a shared processing engine responsible for artifact enumeration, upload, cleanup, and status reporting. Independent networking components implement both WinINet-based HTTP retrieval and native socket communications, while additional modules provide victim profiling and remote administration capabilities consistent with the Remcos RAT family.

Although dynamic execution was intentionally excluded from this analysis, the recovered functionality demonstrates that the sample is a complete deployment of Remcos RAT 7.2.6 Light rather than a simple browser credential stealer or downloader. The modular architecture, extensive subsystem separation, embedded version information, and broad feature set indicate a mature and reusable malware framework capable of supporting comprehensive remote access operations.

Function Reference Table

fcn.004016a3

Component: Networking

Purpose:
Initializes the malware’s internal networking session, allocates buffers, creates synchronization objects, and prepares the socket state.

Confidence: High

fcn.00401745

Component: Secure Communications

Purpose:
Establishes TCP connections, performs the TLS handshake, authenticates the remote endpoint, and initializes encrypted communications.

Confidence: High

fcn.0040769c

Component: Upload Engine

Purpose:
Uploads collected files to the controller using approximately 100 KB chunks while reporting upload status.

Confidence: High

fcn.00409d90

Component: Browser Discovery

Purpose:
Locates browser artifacts including Login Data, Cookies, and Network\Cookies before processing begins.

Confidence: High

fcn.00409f76

Component: Browser Processing Engine

Purpose:
Core browser processing routine responsible for artifact validation, enumeration, upload preparation, cleanup, and status reporting.

Confidence: High

fcn.0040a25c

Component: Browser Processing

Purpose:
Shared browser artifact handler used by multiple browser-specific collection modules.

Confidence: High

fcn.0040a35f

Component: Chrome Collector

Purpose:
Initializes Google Chrome collection, locates browser profiles, and invokes the shared browser processing engine.

Confidence: High

fcn.0040ad02

Component: Browser Dispatcher

Purpose:
Master browser orchestration routine responsible for locating browser profiles, dispatching browser-specific modules, and coordinating artifact processing.

Confidence: High

fcn.0040b20a

Component: Browser Engine

Purpose:
Traverses browser data structures using fixed-size records before forwarding them for processing.

Confidence: Medium

fcn.0040b564

Component: Browser Engine

Purpose:
Processes browser data structures supplied by the browser walker.

Confidence: Medium

fcn.0040d977

Component: Process Enumeration

Purpose:
Enumerates running processes using the ToolHelp32 API and constructs an inventory of active processes.

Confidence: High

fcn.004103a3

Component: Registry Operations

Purpose:
Generic wrapper for registry creation and modification using RegCreateKey and RegSetValueEx APIs.

Confidence: High

fcn.004110ca

Component: Controller Initialization

Purpose:
Initializes communications with the controller by loading configuration, collecting host metadata, performing GeoIP profiling, and preparing the initial session.

Confidence: High

fcn.00414a15

Component: Screenshot Capture

Purpose:
Captures the desktop using GDI functions and constructs an in-memory bitmap image.

Confidence: High

fcn.0041666d

Component: HTTP Communications

Purpose:
Generic HTTP client responsible for retrieving remote resources, including victim geolocation information.

Confidence: High

fcn.004170ad

Component: Privilege Detection

Purpose:
Determines whether the malware is executing with elevated privileges and caches the result for later use.

Confidence: High

Additional Notes

Configuration Resource Loader

Function

fcn.004167d9

Purpose

Loads the malware’s embedded configuration resource directly from the executable.

Observed APIs

• FindResourceA
• LoadResource
• LockResource
• SizeofResource

Resource Information

Resource Name : SETTINGS
Resource Type : RT_RCDATA (10)

Analysis

The routine retrieves the raw configuration blob stored inside the executable’s resources and returns both its memory address and size. The configuration is not hardcoded within the executable but embedded as a dedicated SETTINGS resource, which is later parsed by higher-level initialization routines.

This confirms the malware separates configuration loading from configuration parsing, a common design used by modular RAT families such as Remcos.

Service Management API Resolver

Function

fcn.004156e7

Purpose

Initializes the malware’s service management subsystem by dynamically resolving service-related functionality.

Resolved Operations

GetSvc
StartSvc
StopSvc
PauseSvc
ResumeSvc
RestartSvc
SetSvcStartup

Analysis

Rather than directly implementing service management operations, the malware dynamically resolves and caches pointers to these exported functions during initialization.

The routine validates that all required service functions are successfully resolved before enabling the service management subsystem.

This architecture suggests the malware supports remote service administration through command dispatch rather than performing these actions during startup.

Installed Software Enumeration

Function

fcn.00417c95

Purpose

Enumerates installed software by traversing the Windows uninstall registry database.

Registry Location

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Retrieved Values

DisplayName
Publisher
DisplayVersion
InstallLocation
InstallDate
UninstallString

Analysis

The routine iterates every installed application under the Windows uninstall registry key, collecting metadata associated with each entry.

The collected information is serialized into an internal buffer, indicating preparation for transmission to the remote controller as part of host inventory collection.

No evidence of software removal or modification was observed during static analysis.

Screenshot Initialization and Secure Desktop Awareness

Function

fcn.00414322

Purpose

Initializes the screenshot subsystem and prepares desktop capture operations.

Observed Components

• GdiplusStartup()
• Screenshot initialization routines
• Desktop capture preparation
• Internal bitmap construction

Registry Access

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Queried Value

PromptOnSecureDesktop

Analysis

The routine initializes GDI+ before preparing the screenshot subsystem.

It also queries the Windows PromptOnSecureDesktop policy, which determines whether UAC elevation prompts are displayed on the isolated Secure Desktop.

This behavior suggests the malware accounts for Secure Desktop transitions when performing screenshot capture, although no evidence was observed indicating modification of the registry value.

Privilege Detection

Function

fcn.004170ad

Purpose

Determines the privilege level of the current process.

Observed APIs

GetCurrentProcess()

Analysis

The function invokes a dynamically resolved privilege-check routine using the current process handle.

The resulting privilege state is cached globally for reuse by other components, avoiding repeated privilege checks throughout execution.

Cross-references indicate the cached value is later consulted by networking and process management routines.

Mutex Initialization

Observed API

CreateMutexA

Cross References

main
fcn.0040b89a

Analysis

The malware creates a named mutex during initialization.

Although the mutex name has not yet been recovered, the presence of mutex creation strongly suggests single-instance enforcement to prevent multiple copies of the malware from executing simultaneously.

Configuration Architecture

The recovered control flow indicates a clear separation between configuration loading and configuration parsing.

main()
      │
      ▼
Initialization
      │
      ▼
fcn.004167d9
Load SETTINGS Resource
      │
      ▼
Configuration Parser
      │
      ▼
Runtime Initialization

This modular design allows configuration updates without modifying the executable code itself.

Additional Host Enumeration

Beyond browser artifact collection, static analysis confirms the malware gathers broader host intelligence including:

• Installed software inventory
• Running process enumeration
• Browser profile discovery
• Browser credential and cookie databases
• Host geolocation
• Privilege level
• Screenshot capture capability
• Clipboard interaction

This significantly expands the malware’s profiling capabilities beyond simple browser credential theft.