remcos | 8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4

General

Target
8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe
Size 626KB
Sample260820-yscecsfe76
SHA256 8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4
MD5 24dba7e1a28f101346355248f433f072
SHA1 d0ede55eccdf8aeb10df0dab81e9a63e6b9b7b8b
SHA512 889e77f9c4805d3fcf874cd8db273a2d18851bf9c9a4936d70ad10b2d071ca78e301d663bfb41660bb7bb2e4a778062df79ccddbcf90b2a412097f2381d8a4e3
SSDEEP 12288:KZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:0QKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T1B0D47D5AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F233A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mu88remotehost remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

MU88RemoteHost

C2

admin.ilmlink.io:25
api.ilmlink.io:443
ilmlink.io:8082
c2.ilmlink.io:8080
exfil.ilmlink.io:8888
login.ilmlink.io:2223
panel.ilmlink.io:9999
phishing.ilmlink.io:3460
update.ilmlink.io:1604
www.ilmlink.io:2967

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
WinService.exe
copy_folder
service
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0V3IH6
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%WinDir%\System32
screenshot_time
5
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	WinService.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-0V3IH6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-0V3IH6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-0V3IH6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	WinService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-0V3IH6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\service\\WinService.exe\""	WinService.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Screenshots\time_20260820_210234.jpg	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2708 set thread context of 2420	2708	WinService.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2120	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2708	4460	8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe	85
PID 2708 wrote to memory of 2420	2708	WinService.exe	86

C:\Users\Admin\AppData\Local\Temp\8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe
"C:\Users\Admin\AppData\Local\Temp\8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Roaming\service\WinService.exe
  "C:\Users\Admin\AppData\Roaming\service\WinService.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2708
- - \??\c:\program files\internet explorer\iexplore.exe
    "c:\program files\internet explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 1KB
SHA256 fea848f6f3daae77a476c760d232880a6734943b5a2e343c76cca6039fb0df6f
MD5 d278197986b97e0ce4cdfe436b80da83
SHA1 76ecc127c0be384badd1fb0271ee80c3c6eb55b1
SHA512 8403b445e80548e024eb429712831ba5bd6e6d3b2e1cd93dd534926a183205d88e2e2a2c0f88d676b1b4e28cf3cccd53fc6844f160043b87f2dbfb86a2d89b99
TLSH
T1CC21CC0227F51259F9F7AFA0E9F645592A36BD22183CC09C21D40A0E0DF2F46D5E0773
MD5 SHA1 SHA512 TLSH

Submit Download

WinService.exe

Path C:\Users\Admin\AppData\Roaming\service\WinService.exe
Size 626KB
SHA256 8695db0045e87ccc6d93f10f1364a96f1ae851a7274d35a4d7f4defe069cccd4
MD5 24dba7e1a28f101346355248f433f072
SHA1 d0ede55eccdf8aeb10df0dab81e9a63e6b9b7b8b
SHA512 889e77f9c4805d3fcf874cd8db273a2d18851bf9c9a4936d70ad10b2d071ca78e301d663bfb41660bb7bb2e4a778062df79ccddbcf90b2a412097f2381d8a4e3
SSDEEP 12288:KZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:0QKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T1B0D47D5AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F233A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2420-8-0x000001DD6D920000-0x000001DD6D9CB000-memory.dmp

Download

memory/2420-13-0x000001DD6D920000-0x000001DD6D9CB000-memory.dmp

Download

memory/2420-16-0x000001DD6D920000-0x000001DD6D9CB000-memory.dmp

Download

memory/2420-19-0x000001DD6D920000-0x000001DD6D9CB000-memory.dmp

Download

memory/2420-22-0x000001DD6D920000-0x000001DD6D9CB000-memory.dmp

Download

memory/2420-25-0x000001DD6D920000-0x000001DD6D9CB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads