Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 08:37
Behavioral task
behavioral1
Sample
33.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 33.exe
- Size 645KB
- Sample261110-kjamhs1vez
- SHA256 90fd512b3550d736b701ff5e66f7a51a83c14d30605b12114db0820da2c22e21
- MD5 6041e7e6be7b5c344138ab40a84c7c88
- SHA1 304af5244b04b70cedcf8ba78c28ed5047131f0d
- SHA512 82b36a1dcd63331c7ff3df971879249b72fc6ecdda5d79b4ab3fd9e4889ab7b399782933c29ae259d05d8be7175281829733f817b13017938f3202076801c663
- SSDEEP 12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T111E46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
au88
C2
-
e390a.com:8080
-
uy88.net:8080
-
b52club.bio:8080
-
member.betvice.co:8080
-
nmk.yosusai.in:8080
-
xx8.loans:8080
-
bigslot855.vip:8080
-
member.noboncos.co:8080
-
digitalconsulting.techvmc.co.in:8080
-
tga95.games:8080
-
di.beckham.in:8080
-
8kbet.ae.org:8080
-
help.eselfmade.in:8080
-
whatsapp-group.dostbook.in:8080
-
mparivahan.digilockers.in:8080
-
backdoor.e390a.com:8080
-
backdoor.uy88.net:8080
-
backdoor.b52club.bio:8080
-
backdoor.member.betvice.co:8080
-
backdoor.nmk.yosusai.in:8080
-
backdoor.xx8.loans:8080
-
backdoor.bigslot855.vip:8080
-
backdoor.member.noboncos.co:8080
-
backdoor.digitalconsulting.techvmc.co.in:8080
-
backdoor.tga95.games:8080
-
backdoor.di.beckham.in:8080
-
backdoor.8kbet.ae.org:8080
-
backdoor.help.eselfmade.in:8080
-
backdoor.whatsapp-group.dostbook.in:8080
-
backdoor.mparivahan.digilockers.in:8080
Attributes
-
audio_folder
au88
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
App.exe
-
copy_folder
au88
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-JBRMWZ
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 13 4192 App.exe 13 4192 App.exe 35 4192 App.exe 35 4192 App.exe 77 4192 App.exe 77 4192 App.exe 24 4192 App.exe 24 4192 App.exe 3 4192 App.exe 3 4192 App.exe 19 4192 App.exe 19 4192 App.exe 245 4192 App.exe 245 4192 App.exe 46 4192 App.exe 46 4192 App.exe 196 4192 App.exe 196 4192 App.exe 40 4192 App.exe 40 4192 App.exe 45 4192 App.exe 45 4192 App.exe 125 4192 App.exe 125 4192 App.exe 211 4192 App.exe 211 4192 App.exe 141 4192 App.exe 141 4192 App.exe 64 4192 App.exe 64 4192 App.exe 204 4192 App.exe 204 4192 App.exe 237 4192 App.exe 237 4192 App.exe 55 4192 App.exe 55 4192 App.exe 167 4192 App.exe 167 4192 App.exe 8 4192 App.exe 8 4192 App.exe 94 4192 App.exe 94 4192 App.exe 147 4192 App.exe 147 4192 App.exe 116 4192 App.exe 116 4192 App.exe 227 4192 App.exe 227 4192 App.exe 251 4192 App.exe 251 4192 App.exe 41 4192 App.exe 41 4192 App.exe 103 4192 App.exe 103 4192 App.exe 79 4192 App.exe 79 4192 App.exe 17 4192 App.exe 17 4192 App.exe 54 4192 App.exe 54 4192 App.exe 120 4192 App.exe 120 4192 App.exe 264 4192 App.exe 264 4192 App.exe - Executes dropped EXE 1 IoCs
pid Process 4192 App.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-JBRMWZ = "\"C:\\ProgramData\\au88\\App.exe\"" 33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-JBRMWZ = "\"C:\\ProgramData\\au88\\App.exe\"" 33.exe Set value (str) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-JBRMWZ = "\"C:\\ProgramData\\au88\\App.exe\"" App.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-JBRMWZ = "\"C:\\ProgramData\\au88\\App.exe\"" App.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain App.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname App.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4192 App.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4324 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4324 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4192 App.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4192 App.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4192 App.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5192 wrote to memory of 4192 5192 33.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\33.exe"C:\Users\Admin\AppData\Local\Temp\33.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\ProgramData\au88\App.exe"C:\ProgramData\au88\App.exe"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4192
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x000000000000050C1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\au88\App.exe
- Size 645KB
- SHA256 90fd512b3550d736b701ff5e66f7a51a83c14d30605b12114db0820da2c22e21
- MD5 6041e7e6be7b5c344138ab40a84c7c88
- SHA1 304af5244b04b70cedcf8ba78c28ed5047131f0d
- SHA512 82b36a1dcd63331c7ff3df971879249b72fc6ecdda5d79b4ab3fd9e4889ab7b399782933c29ae259d05d8be7175281829733f817b13017938f3202076801c663
- SSDEEP 12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T111E46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\remcos\logs.dat
- Size 208B
- SHA256 5f1a35cd7874f5eea505f4fcb5dfca8acee43482a1bd41e4e0952afd205948e3
- MD5 1dc0454a696670d5636b975aa3cc4727
- SHA1 7c1efc5971c0b01a85875879f5c382805eaa5741
- SHA512 8d36550c4a3fe4bee8eee4d66aa3cb5a3d9c514da794dd8ef1cfd0ad4bc1838b9bb2aadc05a129d27b5c4195ad846f60c2c917096a4e6bacc90006b8c49e29c9
- TLSH T1E1D0122937E1105B7A73D19BE2F700662935B5A700388C0E21D1574914F6906654474F
- MD5 SHA1 SHA512 TLSH