remcos | d1c484aca0c4bbd38c7fb112256c697aa3ec7f185f9979196b934e02627450ab

General

Target
From S8.exe
Size 645KB
Sample260922-xt9ktade48
SHA256 d1c484aca0c4bbd38c7fb112256c697aa3ec7f185f9979196b934e02627450ab
MD5 d0459bc3352d5c657caecde4f3bd26ae
SHA1 358158a1a50953cf0371ee220094296921161599
SHA512 2927a8c3c9c948910a3b75077eedb9f675c069992eddbfc7ac02741643c40ba2fabd1eadc48bbd449bceafb8eb67683217c5585b07142661ba4fc457e101acce
SSDEEP 12288:NIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:C5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T1BAE46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost remcos persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

c2.compute.in.net:2404
c2.amazinge.io:2404
c2.kuwin.estellestudios.in:2404
c2.fifa55winbet.com:2404
c2.sportius.com.co:2404
c2.slot16alt1.top:2404
c2.hubeco.co:2404
c2.candybestellen.nl:2404
c2.upakari.in:2404
compute.in.net:8080
fifa55winbet.com:8080
sportius.com.co:8080
www.sportius.com.co:443
www.fifa55winbet.com:443
www.compute.in.net:443

Attributes

audio_folder
MicRecords
audio_path
%SystemDrive%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
s8 tÛi ch¡i.exe
copy_folder
s8
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
ay391stx
mouse_option
false
mutex
f4stb4ck-SQIXG0
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%SystemDrive%
screenshot_time
10
startup_value
take_screenshot_option
true
take_screenshot_time
65
take_screenshot_title
chrome;discord;facebook;telegram

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 16 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
14	3728	s8 tới chơi.exe
14	3728	s8 tới chơi.exe
21	3728	s8 tới chơi.exe
21	3728	s8 tới chơi.exe
17	3728	s8 tới chơi.exe
17	3728	s8 tới chơi.exe
13	3728	s8 tới chơi.exe
13	3728	s8 tới chơi.exe
11	3728	s8 tới chơi.exe
11	3728	s8 tới chơi.exe
16	3728	s8 tới chơi.exe
16	3728	s8 tới chơi.exe
12	3728	s8 tới chơi.exe
12	3728	s8 tới chơi.exe
15	3728	s8 tới chơi.exe
15	3728	s8 tới chơi.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	s8 tới chơi.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\f4stb4ck-SQIXG0 = "\"C:\\ProgramData\\s8\\s8 tới chơi.exe\""	From S8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f4stb4ck-SQIXG0 = "\"C:\\ProgramData\\s8\\s8 tới chơi.exe\""	From S8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\f4stb4ck-SQIXG0 = "\"C:\\ProgramData\\s8\\s8 tới chơi.exe\""	s8 tới chơi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f4stb4ck-SQIXG0 = "\"C:\\ProgramData\\s8\\s8 tới chơi.exe\""	s8 tới chơi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3728	s8 tới chơi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3512	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3512	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3728	s8 tới chơi.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3728	s8 tới chơi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3728	s8 tới chơi.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3728	4104	From S8.exe	89

C:\Users\Admin\AppData\Local\Temp\From S8.exe
"C:\Users\Admin\AppData\Local\Temp\From S8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4104
- C:\ProgramData\s8\s8 tới chơi.exe
  "C:\ProgramData\s8\s8 tới chơi.exe"
  2⤵
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\ay391stx\logs.dat
Size 220B
SHA256 63cec32b4ff9292e67970af6beecb6b8abf204d538dddfb4dc56c1d113fd1347
MD5 39106a4981d4921cb4677b5af3eabeaf
SHA1 759191c0e5abfe8197b37e112c7149616990141f
SHA512 13191a02771bc9d4447203edbe923aa1a5daf10e011095dc130bda9c74ab1dee4fe51cdc7fa117e1bdd421ca875b9c5d24f86784522f30dbec99c80afd68b62d
TLSH
T169D0122D3FE518E6B633D55BD0F301272E71FA6C163A840D21D6078D19B1A0975017A3
MD5 SHA1 SHA512 TLSH

Submit Download

s8 tới chơi.exe

Path C:\ProgramData\s8\s8 tới chơi.exe
Size 645KB
SHA256 d1c484aca0c4bbd38c7fb112256c697aa3ec7f185f9979196b934e02627450ab
MD5 d0459bc3352d5c657caecde4f3bd26ae
SHA1 358158a1a50953cf0371ee220094296921161599
SHA512 2927a8c3c9c948910a3b75077eedb9f675c069992eddbfc7ac02741643c40ba2fabd1eadc48bbd449bceafb8eb67683217c5585b07142661ba4fc457e101acce
SSDEEP 12288:NIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:C5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T1BAE46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads