remcos | 5b50d1394e6feae7922f683b57cdd67a68fe2785699e4cf6bb04bf04dba55790

General

Target
S8T1.exe
Size 646KB
Sample260925-3b5f2aygla
SHA256 5b50d1394e6feae7922f683b57cdd67a68fe2785699e4cf6bb04bf04dba55790
MD5 b9c0e6701431fb858570bc807ffb944c
SHA1 61c0d077ca797dafe250cc0700bed2a1482d1671
SHA512 dcc8a68ac47e27de6dc10e219bea1e650cc534b1fd88bc3cbb4a52935aa8cadaf4349a30bb6bc3a5bc20d31285b4647322685c42e254dd734f2067e7e059f974
SSDEEP 12288:zIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:05GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T15CE46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F276A16F3EB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

kuwing.org:443
mb66ax.com:443
healixai.tech:443
upakari.in:443
tribalswar.top:443
s666hn.com:443
eodev.org:443
ww88com.co:443
aoimichelle.me:443
uu8833.com:443
tribalwars.top:80
mb66ax.com:80
healixai.tech:80
upakari.in:80
kuwing.org:80
s666hn.com:80
eodev.org:80
ww88com.co:80
aoimichelle.me:80
uu8833.com:80
www.uu8833.com:80
www.uu8833.com:443
www.aoimichelle.me:443
www.aoimichelle.me:80
www.ww88com.co:80
www.ww88com.co:443
www.eodev.org:443
www.eodev.org:80
www.s666hn.com:80
www.s666hn.com:443
www.kuwing.org:443
www.kuwing.org:80
www.upakari.in:80
www.upakari.in:443
www.healixai.tech:443
www.healixai.tech:80
www.mb66ax.com:80
www.mb66ax.com:443
www.tribalwars.top:443
www.tribalwars.top:80
calebmedia.in:80
calebmedia.in:443
www.calebmedia.in:443
www.calebmedia.in:80
kuwing.org:8080
calebmedia.in:8080
joycasino-cmk.top:8080
joycasino-cmk.top:80
joycasino-cmk.top:443
www.joycasino-cmk.top:443
www.joycasino-cmk.top:80

Attributes

audio_folder
MicRecords
audio_path
%Temp%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
RemoteBotnet.exe
copy_folder
s8
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
fsociety415
mouse_option
false
mutex
Remcos-URZYYC
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%SystemDrive%
screenshot_time
1
startup_value
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
chrome;discord;facebook;telegram;whatsapp;youtube;instagram;tiktok;spotify;netflix;zoom;teams;slack;steam;vlc;coccoc

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
5180	RemoteBotnet.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-URZYYC = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	S8T1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos-URZYYC = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	RemoteBotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-URZYYC = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	RemoteBotnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos-URZYYC = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	S8T1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RemoteBotnet.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RemoteBotnet.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5180	RemoteBotnet.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2680	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5180	RemoteBotnet.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5180	RemoteBotnet.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5180	RemoteBotnet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 5180	4508	S8T1.exe	88

C:\Users\Admin\AppData\Local\Temp\S8T1.exe
"C:\Users\Admin\AppData\Local\Temp\S8T1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4508
- C:\ProgramData\s8\RemoteBotnet.exe
  "C:\ProgramData\s8\RemoteBotnet.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5180

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\fsociety415\logs.dat
Size 222B
SHA256 89bf002d1874bc721624571cce940fb866a63bceb932554c39dd27e3df141e4a
MD5 d33e53d3d0732d30d97ca91697eda5b1
SHA1 cfc1a6b0611e7cf194c6da07feff0dbdf4f0d2c0
SHA512 a6cd2f6305a68fd1b296e2cb18d877a98a7bdf210e23b1ef9aa05496b6ccf1164b37d2c792ea8e64704890ff6b15dab147b9760b9f4f155b1c586e04cdfc9612
TLSH
T187D0122E2FF916F57677D65B94F31437B970BA641039D40D21D1078C16B5606F5407E3
MD5 SHA1 SHA512 TLSH

Submit Download

RemoteBotnet.exe

Path C:\ProgramData\s8\RemoteBotnet.exe
Size 646KB
SHA256 5b50d1394e6feae7922f683b57cdd67a68fe2785699e4cf6bb04bf04dba55790
MD5 b9c0e6701431fb858570bc807ffb944c
SHA1 61c0d077ca797dafe250cc0700bed2a1482d1671
SHA512 dcc8a68ac47e27de6dc10e219bea1e650cc534b1fd88bc3cbb4a52935aa8cadaf4349a30bb6bc3a5bc20d31285b4647322685c42e254dd734f2067e7e059f974
SSDEEP 12288:zIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:05GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T15CE46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F276A16F3EB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads