remcos | dd4fb0f49b80388230f3d4ba86472ea79243040e69a8766e0e6394dfca3859ce

General

Target
Task6.exe
Size 646KB
Sample260925-sqffcaygnc
SHA256 dd4fb0f49b80388230f3d4ba86472ea79243040e69a8766e0e6394dfca3859ce
MD5 4d0d2d828810d8ad31c43adc7a792470
SHA1 993bf78ee516e6833f53e673a732e497eb027d81
SHA512 5c7e237e35306576e12578d238b7acb3530971d6fa0add3b687b2b58a48ba37104785ca86014678f0d0e8158f2b8c5df662d4526fa21d77c47bf084ccdbcd46f
SSDEEP 12288:7IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:c5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T112E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F277A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

tribalwars.top:443
mb66ax.com:443
healixai.tech:443
upakari.in:443
kuwing.org:443
s666hn.com:443
eodev.org:443
ww88com.co:443
aoimichelle.me:443
uu8833.com:443
tribalwars.top:80
mb66ax.com:80
healixai.tech:80
upakari.in:80
kuwing.org:80
s666hn.com:80
eodev.org:80
ww88com.co:80
aoimichelle.me:80
uu8833.com:80
www.uu8833.com:80
www.uu8833.com:443
www.aoimichelle.me:443
www.aoimichelle.me:80
www.ww88com.co:80
www.ww88com.co:443
www.eodev.org:443
www.eodev.org:80
www.s666hn.com:80
www.s666hn.com:443
www.kuwing.org:443
www.kuwing.org:80
www.upakari.in:80
www.upakari.in:443
www.healixai.tech:443
www.healixai.tech:80
www.mb66ax.com:80
www.mb66ax.com:443
www.tribalwars.top:443
www.tribalwars.top:80
calebmedia.in:80
calebmedia.in:443
www.calebmedia.in:443
www.calebmedia.in:80

Attributes

audio_folder
MicRecords
audio_path
%Temp%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
RemoteBotnet.exe
copy_folder
s8
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
fsociety415
mouse_option
false
mutex
Remcos-N0604M
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%SystemDrive%
screenshot_time
1
startup_value
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
chrome;discord;facebook;telegram;whatsapp;youtube;instagram;tiktok;spotify;netflix;zoom;teams;slack;steam;vlc;coccoc

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Task6.exe

Executes dropped EXE 1 IoCs

pid	Process
3060	RemoteBotnet.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	Task6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	RemoteBotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	RemoteBotnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	Task6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RemoteBotnet.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RemoteBotnet.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	RemoteBotnet.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1900	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	RemoteBotnet.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3060	RemoteBotnet.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	RemoteBotnet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3060	4336	Task6.exe	88

C:\Users\Admin\AppData\Local\Temp\Task6.exe
"C:\Users\Admin\AppData\Local\Temp\Task6.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4336
- C:\ProgramData\s8\RemoteBotnet.exe
  "C:\ProgramData\s8\RemoteBotnet.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x420
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\fsociety415\logs.dat
Size 222B
SHA256 b266e7c65ed7046e517e48453eff9a9e87484a4e221aeb6f0396e1647de05506
MD5 ebd3278475242cb44b952f9283c0a0ad
SHA1 488bc71ae388c796df11006a7e596f8c366a303e
SHA512 c64d607bc24192aa9605c3729d2c0b09ce4df15a4c6fa6e4f0d313752be3c3a726d4bd5ff5ee2079a42f5231b7964fa2159477323ce731952b70acd12fb51067
TLSH
T182D0C96E2FE612A6BA73D55A94F34427A970F9601139C50C26D6038C15B160575417E7
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\ProgramData\fsociety415\logs.dat
Size 442B
SHA256 93d886a0770ae03a4a0387320bc28e6e61692dca820b6f750c867a348e855a7f
MD5 f356ca999c670106eec4612ac78a39c8
SHA1 347427fba015061fee2c7b8d627b99fc62ce07dd
SHA512 ffbce8e736a36e782366e30b0674ed0f3cb76e190f34f773d224efbf3f22ce76419d41ba3086e7b05438d084304247f7cabfe27bd5c33e7e55a3f642d2859a67
TLSH
T1F8F06D6E3FF502B6B677DA4A94F30037AA71B8B06539C40D16D6038C16F1A04A9503EB
MD5 SHA1 SHA512 TLSH

Submit Download

RemoteBotnet.exe

Path C:\ProgramData\s8\RemoteBotnet.exe
Size 646KB
SHA256 dd4fb0f49b80388230f3d4ba86472ea79243040e69a8766e0e6394dfca3859ce
MD5 4d0d2d828810d8ad31c43adc7a792470
SHA1 993bf78ee516e6833f53e673a732e497eb027d81
SHA512 5c7e237e35306576e12578d238b7acb3530971d6fa0add3b687b2b58a48ba37104785ca86014678f0d0e8158f2b8c5df662d4526fa21d77c47bf084ccdbcd46f
SSDEEP 12288:7IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:c5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T112E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F277A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads