remcos | 55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7

General

Target
55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
Size 645KB
Sample261106-y18grsda39
SHA256 55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7
MD5 02cf52f6c1572c1d75ceed252f81cfcd
SHA1 12b3436798a105cc1222f84de5d54fab22fc888d
SHA512 1249e598b77c0558081dd33c5abbc945b65a717baf6b62fe133b381a8e5d3f4320eba946cbed09737fe4d727679d0d030ebd224f3489716ad929aa87acd71092
SSDEEP 12288:3IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:45GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T16AE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

au88 discovery remcos persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

au88

C2

m.asianslots.co:80
pg999asia.net:80
jacksclub.co:80
v99win.tv:80
fomo444slot.co:80
mmoo.spot:80
x88.cheap:80
juad888.us:80
anxietyinchildren.co:80
afribus.co:80
vanoppenenpartners.nl:80
8kbeta5.com:80
8kbet.property:80
toplikes.in:80
themoviezflix.in.net:80
8kbetmb.com:80
x41t3.buzz:80
funpunch.in:80
8kbet1.cc:80
teatoxlife.in:80
w88thbet.com:80
b52club.bio:80
xc.estates4u.co:80
crumbs.nat-ho.me:80
32win23.pro:80
member.noboncos.co:80
xx8.loans:80
nmk.yosusai.in:80
8kbet.ae.org:80
fortunecomps.co.uk:80
cat.small-business-tracker.com:80
abgstore.com.co:80

Attributes

audio_folder
au88
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
App.exe
copy_folder
au88
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4ALFEH
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 14 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
19	2888	App.exe
19	2888	App.exe
6	2888	App.exe
6	2888	App.exe
15	2888	App.exe
15	2888	App.exe
10	2888	App.exe
10	2888	App.exe
21	2888	App.exe
21	2888	App.exe
23	2888	App.exe
23	2888	App.exe
8	2888	App.exe
8	2888	App.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	App.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	App.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	App.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5012	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	App.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2888	App.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	App.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2888	4728	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe	85

C:\Users\Admin\AppData\Local\Temp\55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
"C:\Users\Admin\AppData\Local\Temp\55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4728
- C:\ProgramData\au88\App.exe
  "C:\ProgramData\au88\App.exe"
  2⤵
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2888

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x464
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

App.exe

Path C:\ProgramData\au88\App.exe
Size 645KB
SHA256 55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7
MD5 02cf52f6c1572c1d75ceed252f81cfcd
SHA1 12b3436798a105cc1222f84de5d54fab22fc888d
SHA512 1249e598b77c0558081dd33c5abbc945b65a717baf6b62fe133b381a8e5d3f4320eba946cbed09737fe4d727679d0d030ebd224f3489716ad929aa87acd71092
SSDEEP 12288:3IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:45GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T16AE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 208B
SHA256 d403c28c77e6a63e8e558693f21ee348f334648cecc601da1d327d40bf54d0d3
MD5 5a8f73f5a9b766b36e4d146f5a9dbefc
SHA1 3ebf1f11cfcb88710c4c75d3087c96c1404591eb
SHA512 c055257fef38f5c230564215a405397cb3bfd3d34af21430a51e33fbf981a1ba611b4ef18c5ef5cd85fc9985efac166c67148d0e836e03cbd15977cf09be8e55
TLSH
T136D0227E3BE40262FE23D00B80F700333A74BC602138800C50E2430C24F2808320138F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads