SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)

Summary

The SmartApeSG campaign relies on a fake CAPTCHA page combined with a ClickFix script to distribute several remote access threats, including Remcos RAT, NetSupport RAT, StealC, and Sectop RAT. The initial compromise sets off a staged infection chain in which each payload reaches out to its own command-and-control server. Delivery occurs through archive files that abuse DLL side-loading to launch the malware. The report also includes supporting indicators such as domains, IP addresses, file paths, and file hashes.

Investigation

The analyst first recorded traffic from the ClickFix script at 17:11 UTC, with Remcos RAT communications beginning one minute later at 17:12 UTC. NetSupport RAT traffic appeared four minutes after that, StealC was observed roughly an hour later, and Sectop RAT emerged about one hour and eighteen minutes after StealC. Investigators recovered file artifacts from both user and system directories and mapped them back to the specific malicious archives used in the chain.

Mitigation

Defenders should block the known malicious domains and IP addresses, while watching for execution of HTA files and suspicious archive extraction in user profile paths. Browser and email protections should be strengthened to reduce exposure to click-jacking and fake CAPTCHA delivery. Endpoint detection rules should also be tuned to identify DLL side-loading behavior and unexpected RAT processes.

Response

If any of the listed indicators are found, isolate the impacted host, stop malicious processes, and collect memory and disk images for forensic analysis. Conduct a broad IOC sweep across the environment, update firewall controls to block the identified C2 endpoints, and reset any potentially compromised credentials.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands

The adversary, having gained a foothold on the victim workstation, launches the Remcos RAT component of the SmartApeSG campaign. The RAT is configured to use 95.142.45.231:443 as its primary C2 endpoint. It first resolves the embedded domain fresicrto.top (fallback) and then opens a persistent HTTPS tunnel to the IP address. The traffic is generated by remcos.exe via the Windows WinHTTP API, which produces a Sysmon NetworkConnect event and a Windows Firewall log entry.

Steps:

1. Drop the RAT binary (remcos.exe) to %TEMP%.
2. Execute the binary with the C2 argument -c 95.142.45.231:443.
3. Verify the outbound connection (via netstat).

These actions map to T1102 (Web Service) for C2 communication and T1584.001 (Domain acquisition) as the domain is part of the payload.

Regression Test Script

# --------------------------------------------------------------
# SmartApeSG C2 Simulation – triggers detection rule
# --------------------------------------------------------------

# 1. Write a minimal Remcos‑like stub (for demo, use PowerShell to open TCP)
$c2Ip   = "95.142.45.231"
$c2Port = 443
$payloadFile = "$env:TEMPremcos_stub.exe"

# Create a simple .NET executable that opens a TCP connection (simulates RAT)
Add-Type -TypeDefinition @"
using System;
using System.Net.Sockets;
public class Stub {
    public static void Main(string[] args) {
        try {
            var client = new TcpClient();
            client.Connect("$c2Ip", $c2Port);
            System.Threading.Thread.Sleep(5000); // keep connection alive
            client.Close();
        } catch (Exception ex) {
            Console.Error.WriteLine(ex.Message);
        }
    }
}
"@ -OutputAssembly $payloadFile -CompilerOptions "/target:exe"

# 2. Execute the stub (this generates the network connection)
Start-Process -FilePath $payloadFile -WindowStyle Hidden

# 3. Optional: Resolve the fallback domain to prove DNS activity
Resolve-DnsName -Name "fresicrto.top" -Type A | Out-Null

# 4. Pause for observation
Start-Sleep -Seconds 10

# 5. Cleanup – kill the stub if still running
Get-Process -Name "remcos_stub" -ErrorAction SilentlyContinue | Stop-Process -Force
Remove-Item -Path $payloadFile -Force

Cleanup Commands

# Terminate any lingering connections from the stub
Get-NetTCPConnection -RemotePort 443 -RemoteAddress 95.142.45.231 -State Established |
    ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }

# Remove temporary files (already done in script, but ensure clean state)
Remove-Item -Path "$env:TEMPremcos_stub.exe" -ErrorAction SilentlyContinue