remcos | 3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7

General

Target
3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe
Size 645KB
Sample261018-y7r4cssw3k
SHA256 3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7
MD5 2a24eedd1e39e5bc5721f16596a2f52a
SHA1 b4430c41b96a28ff89d59609e47f28e3069d5a07
SHA512 200fe927082a118a0de10e3cd78639932187d21c1b0b836880782ec7b6ed5d739a1cab4d2751a6fa2c04ad6a2c6771f86fc39c31832a0dcb87c9f0e8196c1ddc
SSDEEP 12288:jIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDzx:E5GXkH4nnwitNfuq9wgs3y3V5vgNyo37
TLSH
T104E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F277A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

qh88eu.com:8080
backdoor.qh88eu.com:8080
qh88eu.com:443
c2.qh88eu.com:443
qh88eu.com:2404
backdoor.qh88eu.com:2404
qq88.fan:8080
backdoor.qq88.fan:8080
c2.qq88.fan:443
qq88.fan:443
qq88.fan:2404
c2.qq88.fan:2404
qh88b3.com:8080
qh88b3.com:80
qh88b3.com:2404
qh88b3.com:443
www.qh88b3.com:443
www.qh88b3.com:80
www.qh88b3.com:8080
backdoor.qh88b3.com:443
backdoor.qh88b3.com:8080
backdoor.qh88b3.com:80
rajaslot5000.cc:8080
backdoor.rajaslot5000.cc:8080
backdoor.rajaslot5000.cc:2404
www.rajaslot5000.cc:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
s8
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XAWDM2
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 12 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
4	6120	remcos.exe
4	6120	remcos.exe
5	6120	remcos.exe
5	6120	remcos.exe
6	6120	remcos.exe
6	6120	remcos.exe
8	6120	remcos.exe
8	6120	remcos.exe
15	6120	remcos.exe
15	6120	remcos.exe
16	6120	remcos.exe
16	6120	remcos.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-XAWDM2 = "\"C:\\ProgramData\\s8\\remcos.exe\""	3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-XAWDM2 = "\"C:\\ProgramData\\s8\\remcos.exe\""	remcos.exe

Executes dropped EXE 1 IoCs

pid	Process
6120	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-XAWDM2 = "\"C:\\ProgramData\\s8\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-XAWDM2 = "\"C:\\ProgramData\\s8\\remcos.exe\""	3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-XAWDM2 = "\"C:\\ProgramData\\s8\\remcos.exe\""	3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-XAWDM2 = "\"C:\\ProgramData\\s8\\remcos.exe\""	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	remcos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2656	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2656	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6120	remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6120	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6120	remcos.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 6120	5100	3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe	89

C:\Users\Admin\AppData\Local\Temp\3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe
"C:\Users\Admin\AppData\Local\Temp\3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5100
- C:\ProgramData\s8\remcos.exe
  "C:\ProgramData\s8\remcos.exe"
  2⤵
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 210B
SHA256 e04fdce6ab98bd7da7e2f0da710df6b8d3b9763b66027c1c96c49d3a2ff75b1a
MD5 83429e22f5142c7fbd8036576720f7ad
SHA1 ac5eac52d00a214602b9e558eae8722bbfb8746f
SHA512 28592c52a685456fe1f530ba1a4259725c8d82a7f69f52338cf32f3602d9520d9e68dcb8ff61f34c618e85c35a58000e27756022c55923d1973820d284f18413
TLSH
T1A5D0125E37D505167A73D19A90F7403B3930B5A41539880C25D2174924B2903B5057DF
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\ProgramData\s8\remcos.exe
Size 645KB
SHA256 3f23e90a14d9238edd2327f1e3c8aec65b741f827cf338658aa435ff56f002d7
MD5 2a24eedd1e39e5bc5721f16596a2f52a
SHA1 b4430c41b96a28ff89d59609e47f28e3069d5a07
SHA512 200fe927082a118a0de10e3cd78639932187d21c1b0b836880782ec7b6ed5d739a1cab4d2751a6fa2c04ad6a2c6771f86fc39c31832a0dcb87c9f0e8196c1ddc
SSDEEP 12288:jIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDzx:E5GXkH4nnwitNfuq9wgs3y3V5vgNyo37
TLSH
T104E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F277A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads