Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/10/2026, 16:47
Behavioral task
behavioral1
Sample
o.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
o.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
o.exe
Resource
win11-20260911-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
o.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target o.exe
- Size 644KB
- Sample261026-va138abe39
- SHA256 393d1d4767730fe6272ec4697c303b441fe352135953276233c916eb71e04457
- MD5 368718b176fc10a670c664022565811c
- SHA1 a2af85d8b96f21c7af364ec1ce2b60590efc8bc2
- SHA512 67c41e5df7834787063f49812b9f3a4d9afcb14538bf7f5038dfee9849cc0485c96bdb7f2d43caac032d67bce5ff595232ae30df16e601b896199eb88e378998
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1F6E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F276A16F3EB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
BeYeuGroup
C2
-
redmob.cc:8080
-
qq88.fan:8080
-
luck80.net:8080
-
8kbetn.net:8080
-
8kbett.shop:8080
-
8kbett.icu:8080
-
8kbett.one:8080
-
qh88.casino:8080
-
8kbet.hk.com:8080
-
qq88.studio:8080
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0AssignedName=tele@VietNamReport
-
connect_interval
5
-
copy_file
Updater.exe
-
copy_folder
byg
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y2LFBE
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
facebook;discord;telegram
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 70 5040 Updater.exe 70 5040 Updater.exe 100 5040 Updater.exe 100 5040 Updater.exe 131 5040 Updater.exe 131 5040 Updater.exe 162 5040 Updater.exe 162 5040 Updater.exe 216 5040 Updater.exe 216 5040 Updater.exe 223 5040 Updater.exe 223 5040 Updater.exe 261 5040 Updater.exe 261 5040 Updater.exe 205 5040 Updater.exe 205 5040 Updater.exe 24 5040 Updater.exe 24 5040 Updater.exe 192 5040 Updater.exe 192 5040 Updater.exe 136 5040 Updater.exe 136 5040 Updater.exe 194 5040 Updater.exe 194 5040 Updater.exe 170 5040 Updater.exe 170 5040 Updater.exe 32 5040 Updater.exe 32 5040 Updater.exe 67 5040 Updater.exe 67 5040 Updater.exe 116 5040 Updater.exe 116 5040 Updater.exe 225 5040 Updater.exe 225 5040 Updater.exe 7 5040 Updater.exe 7 5040 Updater.exe 53 5040 Updater.exe 53 5040 Updater.exe 217 5040 Updater.exe 217 5040 Updater.exe 28 5040 Updater.exe 28 5040 Updater.exe 44 5040 Updater.exe 44 5040 Updater.exe 56 5040 Updater.exe 56 5040 Updater.exe 96 5040 Updater.exe 96 5040 Updater.exe 160 5040 Updater.exe 160 5040 Updater.exe 198 5040 Updater.exe 198 5040 Updater.exe 179 5040 Updater.exe 179 5040 Updater.exe 14 5040 Updater.exe 14 5040 Updater.exe 158 5040 Updater.exe 158 5040 Updater.exe 173 5040 Updater.exe 173 5040 Updater.exe 235 5040 Updater.exe 235 5040 Updater.exe 208 5040 Updater.exe 208 5040 Updater.exe - Executes dropped EXE 1 IoCs
pid Process 5040 Updater.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Y2LFBE = "\"C:\\ProgramData\\byg\\Updater.exe\"" Updater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-Y2LFBE = "\"C:\\ProgramData\\byg\\Updater.exe\"" Updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-Y2LFBE = "\"C:\\ProgramData\\byg\\Updater.exe\"" o.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-Y2LFBE = "\"C:\\ProgramData\\byg\\Updater.exe\"" o.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Updater.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5040 Updater.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4624 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4624 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5040 Updater.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5040 Updater.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5040 Updater.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3260 wrote to memory of 5040 3260 o.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\o.exe"C:\Users\Admin\AppData\Local\Temp\o.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\ProgramData\byg\Updater.exe"C:\ProgramData\byg\Updater.exe"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5040
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\byg\Updater.exe
- Size 644KB
- SHA256 393d1d4767730fe6272ec4697c303b441fe352135953276233c916eb71e04457
- MD5 368718b176fc10a670c664022565811c
- SHA1 a2af85d8b96f21c7af364ec1ce2b60590efc8bc2
- SHA512 67c41e5df7834787063f49812b9f3a4d9afcb14538bf7f5038dfee9849cc0485c96bdb7f2d43caac032d67bce5ff595232ae30df16e601b896199eb88e378998
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1F6E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F276A16F3EB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\remcos\logs.dat
- Size 214B
- SHA256 78848c5bfc667c756ba32a359ad70ae5710de23079f3597ccacf3444e4850b80
- MD5 a2fd98508b2c42596cd345bd2bd524f0
- SHA1 a1a054c90b8135378feb92bdfe8d342f27f82654
- SHA512 b4849349e0eeeb06032fd1ac81c4525ab78da3e7f606644f2f6ebdc3587348f755fef463a471edeac5b1ede4748bc6cf9527490a95a70698813e1297627edd13
- TLSH T1F8D0125E3BD502177E72D09B94FB84667B74F6613138C40C5AD0434D29F9501A2057BB
- MD5 SHA1 SHA512 TLSH