Analysis
- max time kernel
40s - max time network
43s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 12:18
Behavioral task
behavioral1
Sample
2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
40 seconds
Behavioral task
behavioral2
Sample
2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
40 seconds
General
- Target 2.exe
- Size 646KB
- Sample261014-pgpqwacy2x
- SHA256 740e3fc67bf3396ee05613466cd727480bd142ebdda1d0dc632a4f88e63dd7f1
- MD5 a9a74c2e0cfdd15840f2598d5bfcf5b3
- SHA1 16fa4be6e9a9887238ad0809c505e500b74bc234
- SHA512 1ddd1b1b0ed89e6c2802cfe0be904f00e2bf4c227008591b6d9716c73500290f33dbcfeddad102b7a25da1a2f9159831fd379e6aa7a2572bf8cdec5fdd12a3e7
- SSDEEP 12288:MIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:v5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1E6E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
RemoteHost
C2
-
ee88-e888-com.cc:8080
-
qh88eu.com:8080
-
fifa55red.me:8080
-
abgstore.com.co:8080
-
61116222b2.buzz:8080
-
doyanslot.us:8080
-
fifa55hr.com:8080
-
way2ship.in:8080
-
fifareport.com:8080
-
999betslot.vip:8080
-
skuy88.com:8080
-
mwpoker.us:8080
-
eficiencia-energetica.co:8080
-
webnghean.com:8080
-
afribus.co:8080
-
arkaan.cc:8080
-
juad888.us:8080
-
ex88.jp.net:8080
-
tk88lighting.in.net:8080
-
www.fifa55red.me:443
-
www.abgstore.com.co:443
-
www.fifa55hr.com:443
-
www.fifareport.com:443
-
www.skuy88.com:443
-
www.webnghean.com:443
-
www.ex88.jp.net:443
-
www.tk88lighting.in.net:443
-
qh88eu.com:443
-
fifa55red.me:443
-
abgstore.com.co:443
-
fifa55hr.com:443
-
fifareport.com:443
-
skuy88.com:443
-
webnghean.com:443
-
ex88.jp.net:443
-
tk88lighting.in.net:443
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-NHV1W6
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 268 2368 remcos.exe 268 2368 remcos.exe 18 2368 remcos.exe 18 2368 remcos.exe 67 2368 remcos.exe 67 2368 remcos.exe 120 2368 remcos.exe 120 2368 remcos.exe 235 2368 remcos.exe 235 2368 remcos.exe 224 2368 remcos.exe 224 2368 remcos.exe 233 2368 remcos.exe 233 2368 remcos.exe 283 2368 remcos.exe 283 2368 remcos.exe 272 2368 remcos.exe 272 2368 remcos.exe 74 2368 remcos.exe 74 2368 remcos.exe 175 2368 remcos.exe 175 2368 remcos.exe 227 2368 remcos.exe 227 2368 remcos.exe 237 2368 remcos.exe 237 2368 remcos.exe 238 2368 remcos.exe 238 2368 remcos.exe 132 2368 remcos.exe 132 2368 remcos.exe 279 2368 remcos.exe 279 2368 remcos.exe 294 2368 remcos.exe 294 2368 remcos.exe 70 2368 remcos.exe 70 2368 remcos.exe 165 2368 remcos.exe 165 2368 remcos.exe 127 2368 remcos.exe 127 2368 remcos.exe 234 2368 remcos.exe 234 2368 remcos.exe 119 2368 remcos.exe 119 2368 remcos.exe 122 2368 remcos.exe 122 2368 remcos.exe 66 2368 remcos.exe 66 2368 remcos.exe 110 2368 remcos.exe 110 2368 remcos.exe 108 2368 remcos.exe 108 2368 remcos.exe 275 2368 remcos.exe 275 2368 remcos.exe 226 2368 remcos.exe 226 2368 remcos.exe 276 2368 remcos.exe 276 2368 remcos.exe 105 2368 remcos.exe 105 2368 remcos.exe 178 2368 remcos.exe 178 2368 remcos.exe 281 2368 remcos.exe 281 2368 remcos.exe - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-NHV1W6 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ 2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-NHV1W6 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ remcos.exe - Executes dropped EXE 1 IoCs
pid Process 2368 remcos.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-NHV1W6 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-NHV1W6 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 2.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-NHV1W6 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-NHV1W6 = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname remcos.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain remcos.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2368 remcos.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 5756 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5756 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 remcos.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2368 remcos.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2368 remcos.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5372 wrote to memory of 2368 5372 2.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:5756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Remcos\logs.dat
- Size 218B
- SHA256 df6e84e514590e0d3b71ebe9f0442127679908f4b49d9c7f4d5e72455c8968c8
- MD5 df5969d6112b6b814185419ec89bd2ac
- SHA1 d951128b2ea7b77f0bfcba24854cf05767c6ab9b
- SHA512 a85ff82cfaf359901d8e0f4e2ff600a79fe8bb4f895ab4b539c768b6a387cb9e12057739d20893316013af1a25bd9896223830907357c4e80a800e2f7d5f8d94
- TLSH T1B4D0121D7BE906267A32D0EF90FB05293E71BA56043DDD0C11D1535D24B690E960479F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Remcos\remcos.exe
- Size 646KB
- SHA256 740e3fc67bf3396ee05613466cd727480bd142ebdda1d0dc632a4f88e63dd7f1
- MD5 a9a74c2e0cfdd15840f2598d5bfcf5b3
- SHA1 16fa4be6e9a9887238ad0809c505e500b74bc234
- SHA512 1ddd1b1b0ed89e6c2802cfe0be904f00e2bf4c227008591b6d9716c73500290f33dbcfeddad102b7a25da1a2f9159831fd379e6aa7a2572bf8cdec5fdd12a3e7
- SSDEEP 12288:MIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:v5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1E6E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26
- MD5 SHA1 SHA512 SSDEEP TLSH