remcos | 55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7

General

Target
55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
Size 645KB
Sample261106-y18grsda39
SHA256 55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7
MD5 02cf52f6c1572c1d75ceed252f81cfcd
SHA1 12b3436798a105cc1222f84de5d54fab22fc888d
SHA512 1249e598b77c0558081dd33c5abbc945b65a717baf6b62fe133b381a8e5d3f4320eba946cbed09737fe4d727679d0d030ebd224f3489716ad929aa87acd71092
SSDEEP 12288:3IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:45GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T16AE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

au88 discovery remcos persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

au88

C2

m.asianslots.co:80
pg999asia.net:80
jacksclub.co:80
v99win.tv:80
fomo444slot.co:80
mmoo.spot:80
x88.cheap:80
juad888.us:80
anxietyinchildren.co:80
afribus.co:80
vanoppenenpartners.nl:80
8kbeta5.com:80
8kbet.property:80
toplikes.in:80
themoviezflix.in.net:80
8kbetmb.com:80
x41t3.buzz:80
funpunch.in:80
8kbet1.cc:80
teatoxlife.in:80
w88thbet.com:80
b52club.bio:80
xc.estates4u.co:80
crumbs.nat-ho.me:80
32win23.pro:80
member.noboncos.co:80
xx8.loans:80
nmk.yosusai.in:80
8kbet.ae.org:80
fortunecomps.co.uk:80
cat.small-business-tracker.com:80
abgstore.com.co:80

Attributes

audio_folder
au88
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
App.exe
copy_folder
au88
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4ALFEH
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 14 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
4	4124	App.exe
4	4124	App.exe
5	4124	App.exe
5	4124	App.exe
8	4124	App.exe
8	4124	App.exe
6	4124	App.exe
6	4124	App.exe
2	4124	App.exe
2	4124	App.exe
3	4124	App.exe
3	4124	App.exe
7	4124	App.exe
7	4124	App.exe

Executes dropped EXE 1 IoCs

pid	Process
4124	App.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-4ALFEH = "\"C:\\ProgramData\\au88\\App.exe\""	App.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	App.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2160	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2160	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4124	App.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4124	App.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4124	App.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4124	4348	55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe	89

C:\Users\Admin\AppData\Local\Temp\55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe
"C:\Users\Admin\AppData\Local\Temp\55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4348
- C:\ProgramData\au88\App.exe
  "C:\ProgramData\au88\App.exe"
  2⤵
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4124

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

App.exe

Path C:\ProgramData\au88\App.exe
Size 645KB
SHA256 55b6c451dcba3ebd157279574975e9679032e3a12d4c1b1dcd5d5cf587107fc7
MD5 02cf52f6c1572c1d75ceed252f81cfcd
SHA1 12b3436798a105cc1222f84de5d54fab22fc888d
SHA512 1249e598b77c0558081dd33c5abbc945b65a717baf6b62fe133b381a8e5d3f4320eba946cbed09737fe4d727679d0d030ebd224f3489716ad929aa87acd71092
SSDEEP 12288:3IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:45GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T16AE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 208B
SHA256 7d4402bd62471b898f4c8e67300f5fb490039781dda08c5ee31a9e1fce379608
MD5 d257728a2aa307957202be74d5723539
SHA1 166424d47f785df5cc40ada129cd5795b218674d
SHA512 0798b715cb90fd60251057f6262a5dd621b1d4af631519c49882dd3062b60f57e0d1819186bfdebf3948881c845d6dae285ea44d7e4b7dbfc15ad49984cab4ac
TLSH
T175D0127E3BE51256FE63D15B91F740273975FDA02138844C55E2474C14F5909750178F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads