Dissecting REMCOS RAT: An in- depth analysis of a widespread 2024 malware, Part Three

In previous articles in this multipart series, malware researchers on the Elastic Security Labs team analyzed REMCOS execution flow, detailing its recording capabilities and its communication with C2. In this article, you’ll learn more about REMCOS configuration structure and its C2 commands.

The configuration

In this section, we provide a comprehensive overview of the configuration fields of the malware.

Configuration Table

Researchers successfully recovered approximately 80% of the configuration structure (45 out of 56 fields). We provide detailed configuration information in the following table:

Integer to path mapping

REMCOS utilizes custom mapping for some of its "folder" fields instead of a string provided by the user.

We provide details of the mapping below:

Configuration extraction, an inside perspective

We enjoy building tools, and we'd like to take this opportunity to provide some insight into the type of tools we develop to aid in our analysis of malware families like REMCOS.

We developed a configuration extractor called "conf-tool", which not only extracts and unpacks the configuration from specific samples but can also repackage it with modifications.

First, we unpack the configuration.

The configuration is saved to the disk as a JSON document, with each field mapped to its corresponding type.

We are going to replace all the domains in the list with the IP address of our C2 emulator to initiate communication with the sample.

We are also enabling the logging mode to console (2):

Once we're done, repack everything:

And voilà, we have the console, and the sample attempts to connect to our emulator!

We are releasing a REMCOS malware configuration extractor that includes some of these features.

C2 commands

In this section, we present a list of all the commands we've reversed that are executable by the Command and Control (C2). Furthermore, we provide additional details for a select subset of commands.

Command table

Researchers recovered approximately 95% of the commands (74 out of 78). We provide information about the commands in the following table:

ListInstalledApplications command

To list installed applications, REMCOS iterates over the Software\Microsoft\Windows\CurrentVersion\Uninstall registry key. For each subkey, it queries the following values:

• DisplayName
• Publisher
• DisplayVersion
• InstallLocation
• InstallDate
• UninstallString

ExecuteShellCmd command

Shell commands are executed using the ShellExecuteW API with cmd.exe /C {command} as arguments.

GetHostGeolocation command

To obtain host geolocation, REMCOS utilizes the geoplugin.net API and directly uploads the returned JSON data.

StartOnlineKeylogger command

The online keylogger employs the same keylogger structure as the offline version. However, instead of writing the data to the disk, the data is sent live to the C2.

StartWebcamModule command

REMCOS uses an external module for webcam recording. This module is a DLL that must be received and loaded from its C2 as part of the command parameters.

Once the module is loaded, you can send a sub-command to capture and upload a webcam picture.

StealPasswords command

Password stealing is likely carried out using 3 different Nirsoft binaries, identified by the "/sext" parameters. These binaries are received from the C2 and injected into a freshly created process. Both elements are part of the command parameters.

The /sext parameter instructs the software to write the output to a file, each output filename is randomly generated and stored in the malware installation folder. Once their contents are read and uploaded to the C2, they are deleted.

An additional DLL, with a FoxMailRecovery export, can also be utilized. Like the other binaries, the DLL is received from the C2 as part of the command parameters. As the name implies the DLLis likely to be used to dump FoxMail data

Uninstall command

The uninstall command will delete all Remcos-related files and persistence registry keys from the host machine.

First, it kills the watchdog process.

Then, it deletes all the recording files (keylogging, screenshots, and audio recordings).

Then, it deletes its registry persistence keys.

Finally, it deletes its installation files by creating and executing a Visual Basic script in the %TEMP% folder with a random filename, then terminates its process.

Below the generated script with comments.

' Continue execution even if an error occurs
On Error Resume Next

' Create a FileSystemObject
Set fso = CreateObject("Scripting.FileSystemObject")

' Loop while the specified file exists
while fso.FileExists("C:\Users\Cyril\Desktop\corpus\0af76f2897158bf752b5ee258053215a6de198e8910458c02282c2d4d284add5.exe")

' Delete the specified file
fso.DeleteFile "C:\Users\Cyril\Desktop\corpus\0af76f2897158bf752b5ee258053215a6de198e8910458c02282c2d4d284add5.exe"

' End of the loop
wend

' Delete the script itself
fso.DeleteFile(Wscript.ScriptFullName)

Restart command

The Restart command kills the watchdog process and restarts the REMCOS binary using a generated Visual Basic script.

Below is the generated script with comments.

' Create a WScript.Shell object and run a command in the command prompt
' The command runs the specified .exe file
' The "0" argument means the command prompt window will not be displayed
CreateObject("WScript.Shell").Run "cmd /c ""C:\Users\Cyril\Desktop\corpus\0af76f2897158bf752b5ee258053215a6de198e8910458c02282c2d4d284add5.exe""", 0

' Create a FileSystemObject and delete the script itself
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)

DumpBrowserHistoryUsingNirsoft command

Like the StealPasswords command, the DumpBrowserHistoryUsingNirsoft command steals browser history using likely another Nirsoft binary received from the C2 as part of the command parameter. Again, we identify the binary as part of Nirsoft because of the /stext parameter.

ElevateProcess command

The ElevateProcess command, if the process isn’t already running with administrator privileges, will set the HKCU/SOFTWARE/{mutex}/elev registry key and restart the malware using the same method as the Restart command.

Upon restart, the REMCOS checks the elev value as part of its initialization phase. If the value exists, it'll delete it and utilize its UAC bypass feature to elevate its privileges.

That’s the end of the third article. In the final part we’ll cover detection and hunt strategies of REMCOS using Elastic technologies.