remcos | 4111cd3f5b768549c30452c19f033795f9839997a3379c0d8f0c9489b82eef90

General

Target
2.exe
Size 644KB
Sample261025-sbd9qsgt91
SHA256 4111cd3f5b768549c30452c19f033795f9839997a3379c0d8f0c9489b82eef90
MD5 8dfba7dfb6bf56247bae7252ca4369ee
SHA1 c322d2b50e6d7dec51b247cf305baf093cae97f1
SHA512 82d9558d9ee0196a74eeb0da88382b3fca85a64e1b158082aab8ada4f0255f3ea62f86652e17c804dbd5cedb822cc5324cbb94f7b4376b2bb134623383918c1c
SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T153E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F276A16F3EB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tele@vietnamreport discovery remcos persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

tele@VietNamReport

C2

seony.co:80
8kbeta3.com:80
8kbet1.cc:80
8kbetsco.com:80
funpunch.in:80
x41t3.buzz:80
8kbetmb.com:80
loveletterer.co:80
8kbeting1.com:80
8kbett.gg:80
themoviezflix.in.net:80
8kbetpro.live:80
toplikes.in:80
8kbeta5.com:80
8kbetn.net:80
8kbett.shop:80
8kbett.icu:80
8kbett.one:80
teatoxlife.in:80

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
[email protected]
copy_folder
rp
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-DY1SER
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
facebook;discord;telegram

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 22 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
5	4860	[email protected]
5	4860	[email protected]
10	4860	[email protected]
10	4860	[email protected]
15	4860	[email protected]
15	4860	[email protected]
16	4860	[email protected]
16	4860	[email protected]
12	4860	[email protected]
12	4860	[email protected]
7	4860	[email protected]
7	4860	[email protected]
14	4860	[email protected]
14	4860	[email protected]
11	4860	[email protected]
11	4860	[email protected]
17	4860	[email protected]
17	4860	[email protected]
4	4860	[email protected]
4	4860	[email protected]
9	4860	[email protected]
9	4860	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
4860	[email protected]

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-DY1SER = "\"C:\\ProgramData\\rp\\[email protected]\""	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-DY1SER = "\"C:\\ProgramData\\rp\\[email protected]\""	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-DY1SER = "\"C:\\ProgramData\\rp\\[email protected]\""	2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-DY1SER = "\"C:\\ProgramData\\rp\\[email protected]\""	2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	[email protected]

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1272	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	[email protected]

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4860	[email protected]

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4860	[email protected]

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4860	1744	2.exe	89

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1744
- C:\ProgramData\rp\[email protected]
  "C:\ProgramData\rp\[email protected]"
  2⤵
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 234B
SHA256 0ef0a522df60b5f6ed63f0f495b035119ba1526f18c2acb28492c39145655151
MD5 76d3da416e91813d513aec5b032eef1e
SHA1 98b68f86fb9eb5d01993fb19099a100c46e9115e
SHA512 344d5257e5fdcb030da640101427fec25e3cac94061be745716293eb3084d382ff1e843fe3fe5d412e00126f9a9906dfaaec28710a116a16aef148a17e266ab8
TLSH
T1F1D0C95A3BE500A7BE67D19A95F74036FAB5B574203AD81E15D3034E15B0900B6087AF
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\ProgramData\rp\[email protected]
Size 644KB
SHA256 4111cd3f5b768549c30452c19f033795f9839997a3379c0d8f0c9489b82eef90
MD5 8dfba7dfb6bf56247bae7252ca4369ee
SHA1 c322d2b50e6d7dec51b247cf305baf093cae97f1
SHA512 82d9558d9ee0196a74eeb0da88382b3fca85a64e1b158082aab8ada4f0255f3ea62f86652e17c804dbd5cedb822cc5324cbb94f7b4376b2bb134623383918c1c
SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T153E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F276A16F3EB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads