Analysis
- max time kernel
58s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 20:03
Behavioral task
behavioral1
Sample
a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe
- Size 646KB
- Sample261020-ysnsdsdb24
- SHA256 a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106
- MD5 d7ad2c69290d14ca3b5aec76b759023f
- SHA1 bc6f1a44e6543a0d567e6542c08aecfb7e76ab4c
- SHA512 fe9128f3536658b99ff816525d99b9a6cb6e49de4ec43ae609c4965344db2ce926238a2d2b55ed72c82420efe039f741d035eeda9944fe8d0042893419de69bd
- SSDEEP 12288:MIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDzV:v5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T14EE46D59A39402F8D0B7C135C982953BE7B27C065571472F03E70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
tele@VietNamReport
-
68win43.com:8080
-
backdoor.68win43.com:8080
-
deiure.com.co:8080
-
backdoor.deiure.com.co:8080
-
79king.ai:8080
-
backdoor.79king.ai:8080
-
2mic.my:8080
-
backdoor.2mic.my:8080
-
cm88ab.com:8080
-
backdoor.cm88ab.com:8080
-
ee88-e888-com.cc:8080
-
backdoor.ee88-e888-com.cc:8080
-
dvcard.me:8080
-
backdoor.dvcard.me:8080
-
02go8.com:8080
-
backdoor.02go8.com:8080
-
go99.games:8080
-
backdoor.go99.games:8080
-
jun88wt.com:8080
-
backdoor.jun88wt.com:8080
-
directoryblue.info:8080
-
backdoor.directoryblue.info:8080
-
sdw.org.pl:8080
-
backdoor.sdw.org.pl:8080
-
nohu90.com:8080
-
backdoor.nohu90.com:8080
-
qh88.casino:8080
-
backdoor.qh88.casino:8080
-
qq889lol.com:8080
-
backdoor.qq889lol.com:8080
-
s666ht.com:8080
-
backdoor.s666ht.com:8080
-
s8.market:8080
-
backdoor.s8.market:8080
-
tk88.com:8080
-
backdoor.tk88.com:8080
-
urbanslot.co:8080
-
backdoor.urbanslot.co:8080
-
u888t8.com:8080
-
backdoor.u888t8.com:8080
-
dudoanxosodongthap.org:8080
-
backdoor.dudoanxosodongthap.org:8080
-
43cycles.com:8080
-
backdoor.43cycles.com:8080
-
aulastar.com:8080
-
backdoor.aulastar.com:8080
-
79king4.com:8080
-
backdoor.79king4.com:8080
-
bet88.ph:8080
-
backdoor.bet88.ph:8080
-
mcbpoker.vip:8080
-
backdoor.mcbpoker.vip:8080
-
go8.digital:8080
-
backdoor.go8.digital:8080
-
h13vip.com:8080
-
backdoor.h13vip.com:8080
-
hello88.org.ph:8080
-
backdoor.hello88.org.ph:8080
-
jun88be.com:8080
-
backdoor.jun88be.com:8080
-
figshare.com:8080
-
backdoor.figshare.com:8080
-
mu88.icu:8080
-
backdoor.mu88.icu:8080
-
okolofutbola.io:8080
-
backdoor.okolofutbola.io:8080
-
tr88.love:8080
-
backdoor.tr88.love:8080
-
tabaccai.it:8080
-
backdoor.tabaccai.it:8080
-
hokiku888.pro:8080
-
backdoor.hokiku888.pro:8080
-
108uu88.com:8080
-
backdoor.108uu88.com:8080
-
qh88b3.com:8080
-
backdoor.qh88b3.com:8080
-
qh88eu.com:8080
-
backdoor.qh88eu.com:8080
-
rajaslot5000.cc:8080
-
backdoor.rajaslot5000.cc:8080
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
- copy_file
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LILHKE
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
- Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-LILHKE = "\"C:\\Windows\\SysWOW64\\[email protected]\"" a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-LILHKE = "\"C:\\Windows\\SysWOW64\\[email protected]\"" [email protected] Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe - Executes dropped EXE 1 IoCs
pid Process 5852 [email protected] - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-LILHKE = "\"C:\\Windows\\SysWOW64\\[email protected]\"" a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-LILHKE = "\"C:\\Windows\\SysWOW64\\[email protected]\"" a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-LILHKE = "\"C:\\Windows\\SysWOW64\\[email protected]\"" [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-LILHKE = "\"C:\\Windows\\SysWOW64\\[email protected]\"" [email protected] - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\[email protected] a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname [email protected] Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain [email protected] - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4644 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4644 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5852 [email protected] - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5852 [email protected] - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5852 [email protected] - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3784 wrote to memory of 5852 3784 a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe"C:\Users\Admin\AppData\Local\Temp\a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\[email protected]"C:\Windows\SysWOW64\[email protected]"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5852
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\remcos\logs.dat
- Size 238B
- SHA256 85ca9b0510a920cc53431acaf87060c6b35049c833f943eefb8b124490a1b12a
- MD5 7eb10d82d8f0c2ffbb593f814342ff3d
- SHA1 e7e3d892e709886cd15de8ebcf70b569987cb2b1
- SHA512 34a44cceb0bbe171ee10e822f71a51f345a54bbb54e3d6d2c932e117aa916cae68e853d03f5bfec6db30c946c6eadf9bca6e8cf58a9bdecea877763b71527e1a
- TLSH T1BCD0A92E2AD1001AFAB2D0AB50F3042729B1BAA1103AEA8D11D0034E16A0A04F0043AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\[email protected]
- Size 646KB
- SHA256 a35db964a1b17fbb00f86f93fa6253564a8875b3be77b013d913e16b983d3106
- MD5 d7ad2c69290d14ca3b5aec76b759023f
- SHA1 bc6f1a44e6543a0d567e6542c08aecfb7e76ab4c
- SHA512 fe9128f3536658b99ff816525d99b9a6cb6e49de4ec43ae609c4965344db2ce926238a2d2b55ed72c82420efe039f741d035eeda9944fe8d0042893419de69bd
- SSDEEP 12288:MIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDzV:v5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T14EE46D59A39402F8D0B7C135C982953BE7B27C065571472F03E70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH