Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 18:21
Behavioral task
behavioral1
Sample
V79.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target V79.exe
- Size 644KB
- Sample261114-wzerysfz2q
- SHA256 fd49c076c9d494b91c782075e32649295e8132cf9fef210d3638ae2cba3a4246
- MD5 c62dda9f2aaffcc22ef1ad2897c50319
- SHA1 8dabbd4bcc788e665ce9212f7d696fb36a2d3922
- SHA512 14665b7e9b229e5349a423156032b612bfe67d2dadbf12b4eb8253a4f8d5ea806343e40fc1e25449af437eb88d4fdb18527eeb200a1bfa72175082462ab1fc2f
- SSDEEP 12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1DBE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
au88
C2
-
alexisvl.rocks:8080
-
www.alexisvl.rocks:8080
-
app.alexisvl.rocks:2404
-
c2.naga17.me:2404
-
backdoor.alexisvl.rocks:443
-
api.alexisvl.rocks:443
Attributes
-
audio_folder
au88
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
App.exe
-
copy_folder
au88
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VTIRLZ
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 189 2064 App.exe 189 2064 App.exe 3 2064 App.exe 3 2064 App.exe 26 2064 App.exe 26 2064 App.exe 86 2064 App.exe 86 2064 App.exe 83 2064 App.exe 83 2064 App.exe 50 2064 App.exe 50 2064 App.exe 98 2064 App.exe 98 2064 App.exe 133 2064 App.exe 133 2064 App.exe 49 2064 App.exe 49 2064 App.exe 18 2064 App.exe 18 2064 App.exe 57 2064 App.exe 57 2064 App.exe 114 2064 App.exe 114 2064 App.exe 150 2064 App.exe 150 2064 App.exe 185 2064 App.exe 185 2064 App.exe 193 2064 App.exe 193 2064 App.exe 198 2064 App.exe 198 2064 App.exe 196 2064 App.exe 196 2064 App.exe 25 2064 App.exe 25 2064 App.exe 63 2064 App.exe 63 2064 App.exe 53 2064 App.exe 53 2064 App.exe 13 2064 App.exe 13 2064 App.exe 163 2064 App.exe 163 2064 App.exe 120 2064 App.exe 120 2064 App.exe 88 2064 App.exe 88 2064 App.exe 119 2064 App.exe 119 2064 App.exe 10 2064 App.exe 10 2064 App.exe 65 2064 App.exe 65 2064 App.exe 170 2064 App.exe 170 2064 App.exe 125 2064 App.exe 125 2064 App.exe 130 2064 App.exe 130 2064 App.exe 145 2064 App.exe 145 2064 App.exe 208 2064 App.exe 208 2064 App.exe - Executes dropped EXE 1 IoCs
pid Process 2064 App.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-VTIRLZ = "\"C:\\ProgramData\\au88\\App.exe\"" V79.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-VTIRLZ = "\"C:\\ProgramData\\au88\\App.exe\"" V79.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-VTIRLZ = "\"C:\\ProgramData\\au88\\App.exe\"" App.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-VTIRLZ = "\"C:\\ProgramData\\au88\\App.exe\"" App.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain App.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname App.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2064 App.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1236 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1236 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2064 App.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2064 App.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2064 App.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4500 wrote to memory of 2064 4500 V79.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\V79.exe"C:\Users\Admin\AppData\Local\Temp\V79.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\ProgramData\au88\App.exe"C:\ProgramData\au88\App.exe"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\au88\App.exe
- Size 644KB
- SHA256 fd49c076c9d494b91c782075e32649295e8132cf9fef210d3638ae2cba3a4246
- MD5 c62dda9f2aaffcc22ef1ad2897c50319
- SHA1 8dabbd4bcc788e665ce9212f7d696fb36a2d3922
- SHA512 14665b7e9b229e5349a423156032b612bfe67d2dadbf12b4eb8253a4f8d5ea806343e40fc1e25449af437eb88d4fdb18527eeb200a1bfa72175082462ab1fc2f
- SSDEEP 12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1DBE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\remcos\logs.dat
- Size 208B
- SHA256 64533b105b69c87cc362763a4072adf4729af663dcfeeb11d5620762766b31d4
- MD5 addb62494e36921c0bb829706da485f1
- SHA1 50590308766a16fb8edbfbe4ff5a82d780c444da
- SHA512 7c6a553a979e6f4a61cc949001ca2fd8b2a2e9f9fc2254c9a2fc6753c0d9da5faf9fb283c8a71ad3e959f4526cab1d71feffd279e4996486991c0dfa209fa307
- TLSH T140D0121A77E11017BA63D1BBD67B05352D75B5720039C80C11D1924D14F250665007CF
- MD5 SHA1 SHA512 TLSH