remcos | dd4fb0f49b80388230f3d4ba86472ea79243040e69a8766e0e6394dfca3859ce

General

Target
Task6.exe
Size 646KB
Sample260925-sqffcaygnc
SHA256 dd4fb0f49b80388230f3d4ba86472ea79243040e69a8766e0e6394dfca3859ce
MD5 4d0d2d828810d8ad31c43adc7a792470
SHA1 993bf78ee516e6833f53e673a732e497eb027d81
SHA512 5c7e237e35306576e12578d238b7acb3530971d6fa0add3b687b2b58a48ba37104785ca86014678f0d0e8158f2b8c5df662d4526fa21d77c47bf084ccdbcd46f
SSDEEP 12288:7IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:c5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T112E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F277A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

tribalwars.top:443
mb66ax.com:443
healixai.tech:443
upakari.in:443
kuwing.org:443
s666hn.com:443
eodev.org:443
ww88com.co:443
aoimichelle.me:443
uu8833.com:443
tribalwars.top:80
mb66ax.com:80
healixai.tech:80
upakari.in:80
kuwing.org:80
s666hn.com:80
eodev.org:80
ww88com.co:80
aoimichelle.me:80
uu8833.com:80
www.uu8833.com:80
www.uu8833.com:443
www.aoimichelle.me:443
www.aoimichelle.me:80
www.ww88com.co:80
www.ww88com.co:443
www.eodev.org:443
www.eodev.org:80
www.s666hn.com:80
www.s666hn.com:443
www.kuwing.org:443
www.kuwing.org:80
www.upakari.in:80
www.upakari.in:443
www.healixai.tech:443
www.healixai.tech:80
www.mb66ax.com:80
www.mb66ax.com:443
www.tribalwars.top:443
www.tribalwars.top:80
calebmedia.in:80
calebmedia.in:443
www.calebmedia.in:443
www.calebmedia.in:80

Attributes

audio_folder
MicRecords
audio_path
%Temp%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
RemoteBotnet.exe
copy_folder
s8
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
fsociety415
mouse_option
false
mutex
Remcos-N0604M
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%SystemDrive%
screenshot_time
1
startup_value
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
chrome;discord;facebook;telegram;whatsapp;youtube;instagram;tiktok;spotify;netflix;zoom;teams;slack;steam;vlc;coccoc

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
3312	RemoteBotnet.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	Task6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	Task6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	RemoteBotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos-N0604M = "\"C:\\ProgramData\\s8\\RemoteBotnet.exe\""	RemoteBotnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RemoteBotnet.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RemoteBotnet.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3312	RemoteBotnet.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4600	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3312	RemoteBotnet.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3312	RemoteBotnet.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3312	RemoteBotnet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3312	4916	Task6.exe	89

C:\Users\Admin\AppData\Local\Temp\Task6.exe
"C:\Users\Admin\AppData\Local\Temp\Task6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4916
- C:\ProgramData\s8\RemoteBotnet.exe
  "C:\ProgramData\s8\RemoteBotnet.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\fsociety415\logs.dat
Size 222B
SHA256 b5a86b24a76131695e8831d00c64d892ce2ed91f0aa391a0ed43b6974e33739c
MD5 c4b22084f410f142dda79169e502ec68
SHA1 879183bc720c5744c0ed2027e5635e75157e63a3
SHA512 05fb9fb34634777a38c9a6fd97a2c6258d4fb232389bd44b56f7005d96aea99c47921dfefd2bd93fc5b2e996dbcd50bcbbe4c03bf3f41fffa8760897608fb63d
TLSH
T149D0C96E2FE506B6BA73D55A94F34027A970F9641139C50C26D2038C15B161576417E7
MD5 SHA1 SHA512 TLSH

Submit Download

RemoteBotnet.exe

Path C:\ProgramData\s8\RemoteBotnet.exe
Size 646KB
SHA256 dd4fb0f49b80388230f3d4ba86472ea79243040e69a8766e0e6394dfca3859ce
MD5 4d0d2d828810d8ad31c43adc7a792470
SHA1 993bf78ee516e6833f53e673a732e497eb027d81
SHA512 5c7e237e35306576e12578d238b7acb3530971d6fa0add3b687b2b58a48ba37104785ca86014678f0d0e8158f2b8c5df662d4526fa21d77c47bf084ccdbcd46f
SSDEEP 12288:7IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:c5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T112E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F277A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads