Malware Analysis Chronicles: Inside Remcos RAT

Introduction

Sometimes the most revealing moment in malware analysis isn’t when you discover what it does — it’s when you realize what it’s trying to hide. I recently analyzed a Remcos RAT sample downloaded from MalwareBazaar, expecting a straightforward remote access trojan. What I found instead was a sophisticated multi-stage operation that installs itself, activates surveillance, and then commits suicide — only to respawn from a new location and begin its real mission.

This analysis chronicles a Remcos 7.2.1 Pro variant that demonstrates the evolution of commercial RATs into full-featured surveillance platforms. We’ll trace its execution from initial triage through persistence establishment, multi-threaded surveillance architecture, self-termination, and finally its cleartext C2 protocol that exposed the entire operation.

For threat hunters and malware analysts, this breakdown provides actionable detection strategies and insights into modern RAT operational patterns.

Remcos

Initial Triage: First Contact

Sample Acquisition:

Source:   MalwareBazaar (abuse.ch)
SHA-256:  e49412097e84021f9079b43e61f6d46b8a1737d8bda33d43398d1f366a4d7839
SHA-1:    ddcc45ea5d9298f140a3fe2cf60e050feb68b684
Filename: sysconf.exe
Size:     527,872 bytes (515 KB)
Type:     PE32 executable (GUI) Intel 80386

Static Analysis Highlights:

PEStudio immediately flagged suspicious imports:

Category        Key APIs  
Persistence     RegCreateKeyExW, RegSetValueExW
Network         WSAStartup, socket, connect, send, recv
Crypto          BCryptGenRandom, BCryptEncrypt
Surveillance    GetForegroundWindow, GetWindowTextW, SetWindowsHookExW
Threading       CreateThread, ResumeThread, CreateRemoteThread

Execution Flow:

I executed the sample in an isolated Windows 10 VM instrumented with Process Monitor, Network Monitor, and Process Hacker. Within 100ms, Remcos had already established complete persistence.

Phase 1: System Reconnaissance

Observed Behavior (Procmon):

Registry Queries:
  ✓ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
    → "Windows 10 Enterprise"
  ✓ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber
    → "19045"
  ✓ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Hostname
    → "d****1"

Evidence: Procmon captured 47 registry reads in the first 15ms, fingerprinting the victim system.

Phase 2: Persistence Installation

Registry Operations (Procmon Logs):

Logs from Procmon

Persistence Mechanism:

Run Key (Auto-start):
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\-L67RHW
  → "C:\Users\p***\AppData\Roaming\Roaming\sysconf.exe"

Configuration Storage:
  HKCU\Software\-L67RHW\
  ├── licence: Campaign identifier (0E615A13...)
  ├── exepath: Encrypted installation path
  ├── time:    Installation timestamp
  └── UID:     Unique bot identifier

Phase 3: File System Operations

Procmon File Events:

CreateFile:
  C:\Users\p****\AppData\Roaming\Roaming\sysconf.exe
  (File copied from original location)

Attributes:
  Size:   527,872 bytes
  SHA-1:  ddcc45ea5d9298f140a3fe2cf60e050feb68b684 

Evidence: The malware copies itself to a persistent location.

Phase 4: Respawn, A New Process Emerges

Immediately After Termination:

Process Monitor captured a new process creation event:

Time:         ~2:18:05.75XX
Operation:    Process Create
Image:        C:\Users\p****\AppData\Roaming\Roaming\sysconf.exe
Parent PID:   (Likely original 5048 or Windows shell)
New PID:      [Different from 5048]
Command Line: sysconf.exe

Evidence:

Process Hacker’s process tree showed the new sysconf.exe instance loading from the persistent path

Why This Design?

1. Evasion: Original dropper exits quickly (< 100ms execution time)
2. Persistence: Even if dropper is caught, persistent copy survives
3. Clean State: New instance starts fresh, no dropper artifacts in memory
4. Resilience: Run key ensures auto-restart on reboot

Phase 5: Network Protocol, Cleartext Surprise

I had captured network traffic during a prior execution using Wireshark. The PCAP revealed Remcos’ complete C2 protocol — in unencrypted plaintext.

C2 Infrastructure

C2 Server:  45.151.81.138
Port:       24055/tcp

Registration Packet (TCP Stream Analysis)

Wireshark: Follow TCP Stream → Raw Data:

24055|...|d***1/p***|...|US|...|Windows 10 Enterprise (64 bit)|...|
8589463552|...|7.2.1 Pro|...|
C:\ProgramData\remcos\logs.dat|...|
C:\Users\p****\AppData\Roaming\Roaming\sysconf.exe|...|
C:\Users\p****\Downloads\e49412097e84021f9079b43e61f6d46b8a1737d8bda33d43398d1f366a4d7839|...|
45.151.81.138|...|-L67RHW|...|
Intel(R) Core(TM) Ultra 7 165H|...|

Decoded Fields:

decoded data from network connection

Surveillance Data Exfiltration

The same packet stream contained real-time window activity:

Window Monitoring Data:
  21717421$|sysconf.exe (5048) Properties|31|
  21741250$|Microsoft Network Monitor 3.4|63|
  21771265$|Process Hacker [D****1\p***]|172|
  21831281$|dirwatchlog.txt - Notepad++|16500|
  21891296$|x64dbg - [sysconf.exe]|10687|

The Two-Stage Architecture:

┌─────────────────────────────────────────┐
│ STAGE 1: DROPPER                        │
│ (Original: Downloads\...\sysconf.exe)   │
├─────────────────────────────────────────┤
│ Mission:                                │
│ - Create registry persistence           │
│ - Store configuration (campaign ID)     │
│ - Copy to %APPDATA%\Roaming\Roaming\    │
│ - Create verification threads           │
│ - Launch persistent copy                │
│ - ExitProcess(0) - Self-terminate       │
└─────────────────────────────────────────┘
                    ↓
┌─────────────────────────────────────────┐
│ STAGE 2: PERSISTENT INSTANCE            │
│ (Persistent: %APPDATA%\...\sysconf.exe) │
├─────────────────────────────────────────┤
│ Mission:                                │
│ - Read existing config from registry    │
│ - Skip re-installation (already done)   │
│ - Create surveillance thread            │
│ - Create network thread                 │
│ - Connect to C2 (45.151.81.138:24055)   │
│ - Send registration packet              │
│ - Enter command loop                    │
└─────────────────────────────────────────┘

The OPSEC Failure:

Remcos 7.2.1 Pro typically supports RC4 or AES encryption, yet this sample transmitted everything in cleartext. This operational security failure provided complete protocol visibility.

Possible Explanations:

• Operator disabled encryption for debugging
• Builder misconfiguration
• Cleartext handshake before encrypted session.

Network Monitoring Wins:

Even with encryption, Remcos’ use of persistent TCP connections to non-standard ports (24055, 2404, 5920) makes it detectable. Combined with beaconing patterns and data exfiltration volume, network signatures remain effective.

Final Thoughts

Every malware sample tells a story about its creator’s priorities, skills, and operational security practices. This Remcos variant revealed an operator who valued reliability and manageability over stealth — a common trade-off in volume-based campaigns where scale matters more than sophistication.

As commercial RATs continue to dominate the threat landscape, understanding their architectural patterns, operational phases, and inevitable mistakes remains our best defense.