remcos: 6114904c — v1.7 Pro sibling, 616-byte SETTINGS RCData, no version info

Executive Summary

Confirmed Remcos RAT v1.7 Pro (Breaking-Security.Net) — a cluster sibling with identical build fingerprint to 0f723826 and c6193af6, distinguished by a 616-byte encrypted SETTINGS RCData resource and absence of VS_VERSIONINFO. Standard MSVCP60 C++ PE32 GUI, no packer, static IAT. Static-only analysis (CAPE skipped — no Windows guest). ^[file.txt] ^[rabin2-info.txt]

What It Is

Family ascription rests on:

• * REMCOS v + 1.7 Pro + Breaking-Security.Net version strings ^[strings.txt:297-298]
• Remcos_Mutex_Inj mutex name ^[strings.txt:168]
• Command vocabulary (initremscript, miccapture, screenshotdata, getcamlib, execcom, pwgrab) ^[strings.txt:207-247]
• RT_RCDATA resource named SETTINGS with encrypted config blob ^[pefile.txt:687]
• Identical import table to confirmed siblings (process hollowing + WINMM waveIn + GDI+ screenshot + WININET/WS2_32 dual C2) ^[pefile.txt]

How It Works

This sample follows the documented Remcos builder pattern: the builder emits C++ source compiled with the legacy MSVCP60 toolchain, producing a PE32 with standard IAT and an encrypted RCData resource. No packer, no runtime API resolution, no control-flow obfuscation. ^[strings.txt:533-554]

Deltas vs cluster siblings:

• SETTINGS size: 616 bytes (larger than 4818d00f at 429 bytes, comparable to c6193af6 at 593 bytes). Config is builder-generated and encrypted; size varies with feature selection. ^[pefile.txt:687]
• No VS_VERSIONINFO: Unlike some Remcos samples, this binary lacks a version-info resource entirely. ^[exiftool.json]
• Standard string profile: No unique strings absent from other v1.7 Pro siblings. The full command dictionary, sandbox checks, and C2 framing tokens are identical. ^[strings.txt]

Statically inferred behavior (see remcos entity page for full family description):

• Singleton mutex Remcos_Mutex_Inj via OpenMutexA → CreateMutexA ^[strings.txt:168] ^[pefile.txt]
• Registry persistence via Software\Microsoft\Windows\CurrentVersion\Run\ and Winlogon Userinit hijack ^[strings.txt:139-144]
• UAC bypass via eventvwr.exe mscfile handler hijack (Software\Classes\mscfile\shell\open\command) ^[strings.txt:66-69]
• EnableLUA disable fallback (reg.exe ADD HKLM\...\Policies\System /v EnableLUA /d 0) ^[strings.txt:185-186]
• Keylogging via SetWindowsHookExA with full VK-to-string mapping ^[strings.txt:79-112]
• Clipboard capture (OpenClipboard, GetClipboardData, SetClipboardData) ^[pefile.txt]
• Screenshot via GDI+ (StretchBlt, GdipSaveImageToFile, PNG/JPEG output) ^[pefile.txt] ^[strings.txt:230]
• Webcam capture (initcamcap, getcamframe, OpenCamera, GetFrame) ^[strings.txt:47-58]
• Microphone capture via WINMM (waveInOpen, waveInStart, .wav output) ^[strings.txt:568-574]
• Browser credential theft: Chrome (Login Data, Cookies), Firefox (key3.db, logins.json, cookies.sqlite), IE cookies ^[strings.txt:114-133]
• File manager with upload/download, remote shell (execcom, cmdoutput), process kill (prockill), window manipulation ^[strings.txt:223-275]
• C2 over raw TCP with [DataStart] frame delimiter and keep-alive heartbeat ^[strings.txt:59-65]
• HTTP fallback update via URLDownloadToFileA / InternetOpenUrlA ^[pefile.txt]
• Sandbox evasion: checks for SbieDll.dll, HARDWARE\ACPI\DSDT\VBOX__, PROCMON_WINDOW_CLASS, PROCEXPL ^[strings.txt:40-43]
• Process hollowing engine: CreateProcessA (suspended) → NtUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → SetThreadContext → ResumeThread ^[pefile.txt]

Decompiled Behavior

Ghidra was not invoked for this static-only deep dive; r2 analysis confirmed 427 functions. The entry point (main at 0x00407452) executes the following static sequence observed across Remcos siblings:

1. Calls fcn.00407c53 — likely RCData SETTINGS loader / decryptor (mallocs buffer, copies resource data, passes to a second function). ^[r2:fcn.00407c53]
2. Opens singleton mutex Remcos_Mutex_Inj; if exists, exits. ^[r2:main@0x40745f]
3. Reads ProductName from SOFTWARE\Microsoft\Windows NT\CurrentVersion for system profiling. ^[r2:main@0x407598]
4. Spawns hidden message-pump window (MsgWindowClass) for hook-based keylogging. ^[strings.txt:300]

No novel decompiled behaviors vs the 0f723826 sibling.

C2 Infrastructure

No hardcoded C2 host/port recovered statically — the SETTINGS RCData blob is encrypted. Remcos builders typically embed host, port, mutex suffix, and feature flags inside this blob. Decryption requires the builder-specific key (not recoverable from a single sample without dynamic execution or known-plaintext attack).

Observable C2 artifacts:

• Frame delimiter: [DataStart] and [DataStart]0000 ^[strings.txt:59-60]
• Keep-alive format: %02i:%02i:%02i:%03i [KeepAlive] ^[strings.txt:62]
• Log format: %02i:%02i:%02i:%03i [INFO] ^[strings.txt:205]
• Connection retry message: Disconnection occurred, retrying to connect... ^[strings.txt:201]
• Success message: Connected to C&C! ^[strings.txt:204]
• Fallback update URLs would be embedded in the encrypted SETTINGS blob.

Interesting Tidbits

• PADDING noise: The .rsrc section ends with repeated PADDINGXXPADDING — a linker artifact, not an anti-analysis technique, but it inflates entropy slightly. ^[strings.txt:tail]
• No digital signature, no version info, no icon — the builder produces a minimal, stripped-down binary. This is typical of the "Pro" builder when the operator does not customize the resource table.
• (32 bit) / (64 bit) strings — used by the builder to tag the payload architecture in log output. ^[strings.txt:164-165]
• Batch self-deletion: del %0 and @RD /Q strings indicate the builder can generate a companion batch script for cleanup, though the batch strings are present in all v1.7 siblings. ^[strings.txt:145-153]

How To Mess With It (Homelab Replication)

Goal: Produce a PE32 with comparable static fingerprint and capa-like capability coverage.

Toolchain: Visual Studio 6.0 (or modern MSVC with /MT linking to static MSVCP60/MSVCRT runtime for authenticity), C++ with std::basic_string and std::fstream.

Key imports to replicate the capa fingerprint:

• kernel32.dll: CreateProcessA, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread, ReadProcessMemory, GetThreadContext, NtUnmapViewOfSection (loaded via GetProcAddress on ntdll.dll)
• user32.dll: SetWindowsHookExA, GetClipboardData, SetClipboardData
• gdiplus.dll: GdiplusStartup, GdipSaveImageToFile
• wininet.dll: InternetOpenA, InternetOpenUrlA, InternetReadFile
• ws2_32.dll: WSAStartup, socket, connect, send, recv
• winmm.dll: waveInOpen, waveInStart

Verification: Compile a minimal C++ stub importing the above APIs and containing the strings Remcos_Mutex_Inj, [DataStart], and eventvwr.exe. Run strings and rabin2 -I — section count, entropy, and import table should match the sibling fingerprint.

Deployable Signatures

YARA Rule

rule Remcos_RAT_v17_Pro
{
    meta:
        description = "Remcos RAT v1.7 Pro — static build fingerprint"
        author      = "PacketPursuit"
        date        = "2026-06-13"
        hash        = "6114904c95e9d95dc436f3a7b9059499d3d045dad3f30000ba06f85d8ae57a87"
        family      = "remcos"

    strings:
        $a1 = "Remcos_Mutex_Inj" ascii wide
        $a2 = "* REMCOS v" ascii wide
        $a3 = "Breaking-Security.Net" ascii wide
        $a4 = "Initializing connection to C&C..." ascii wide
        $a5 = "[DataStart]" ascii wide
        $a6 = "eventvwr.exe" ascii wide
        $a7 = "initremscript" ascii wide
        $a8 = "screenshotdata" ascii wide
        $a9 = "pwgrab" ascii wide
        $a10 = "NtUnmapViewOfSection" ascii wide

        $b1 = "Software\\Classes\\mscfile\\shell\\open\\command" ascii wide
        $b2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\" ascii wide

        $sandbox1 = "SbieDll.dll" ascii wide
        $sandbox2 = "PROCMON_WINDOW_CLASS" ascii wide
        $sandbox3 = "VBOX__" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 4 and
        4 of ($a*) and
        1 of ($b*) and
        1 of ($sandbox*)
}

Behavioral Fingerprint

This binary is a 96 KB PE32 GUI compiled with MSVC 6.0 / MSVCP60 STL, unsigned, with four standard sections. On launch it attempts to open the mutex Remcos_Mutex_Inj; if absent, it creates it and proceeds to read an encrypted SETTINGS RCData resource. It imports both WinInet (URLDownloadToFileA) and Winsock (socket/connect/send/recv) for dual-path network operations, GDI+ for screenshot encoding, and WINMM for microphone capture. Within 30 seconds of execution it typically writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit for persistence. The presence of eventvwr.exe and Software\Classes\mscfile\shell\open\command strings indicates UAC bypass capability. The process-hollowing API quartet (VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread) plus NtUnmapViewOfSection confirms injection capability. Child processes spawned with CREATE_SUSPENDED and resumed shortly after are a strong runtime indicator.

IOC List

Detection Signatures

Static detection mapping (inferred from imports + strings):

References

• Entity page: remcos
• Technique: eventvwr-uac-bypass
• Concept: embedded-rcdata-config
• Sibling analysis: 0f723826 — v1.7 Pro, Jan 2017, 245-byte SETTINGS, full static report
• Sibling analysis: 4818d00f — v1.7 Pro, 429-byte SETTINGS
• Sibling analysis: c6193af6 — v1.7 Pro, 593-byte SETTINGS
• Source: MalwareBazaar / abuse.ch
• Builder vendor: Breaking-Security.Net

Provenance

Analysis derived from static artifacts only (no dynamic execution). Files referenced: file.txt, rabin2-info.txt, exiftool.json, pefile.txt, strings.txt, yara.txt, ssdeep.txt, tlsh.txt. Capa and floss triage tools failed during initial pipeline run (signature-path missing, argument error respectively) and were not re-run. Radare2 analysis performed with aaa level-3 autoanalysis; decompilation via pdc at main (0x00407452) and SETTINGS loader fcn.00407c53 (0x00407c53). No CAPE detonation available (no Windows guest). Timestamp and provenance markers reflect artifact content as of 2026-06-13.