Remcos RAT Targets Korean Users in Ongoing Distribution Campaign

Ruslan Mikhalov Chief of Threat Research at SOC Prime

Remcos RAT Targets Korean Users in Ongoing Distribution Campaign

Detection stack

AIDR
Alert
ETL
Query

Attack Flow
Detections
Simulations

Summary

AhnLab’s Security Intelligence Center reported ongoing distribution of the Remcos remote access trojan targeting users in South Korea. The payload is presented as legitimate VeraCrypt installers or as utilities promoted by illegal gambling sites, with delivery occurring through standard web browsing and Telegram channels. The infection flow is staged: a sequence of VBS and PowerShell scripts retrieves, drops, and launches components that culminate in Remcos execution. In the final step, the RAT is loaded and injected into AddInProcess32.exe, helping the activity blend into normal-looking process behavior.

Investigation

Analysts identified multiple malicious filenames associated with the campaign and confirmed that VBS dropper scripts are written and executed from the TEMP directory as part of the early-stage chain. The researchers also observed a .NET-based injector that leverages Discord webhooks for attacker communications. Configuration artifacts include mutex names and encrypted settings used to control runtime behavior. For collection, Remcos stores captured keystrokes under %ALLUSERSPROFILE%\remcos. Network telemetry highlighted three TLS endpoints tied to the operation, supporting scoping and blocking efforts.

Mitigation

Reduce exposure by blocking or tightly restricting execution of untrusted VBS and PowerShell—especially from user-writable locations—and by enforcing application control policies for scripting engines. Monitor for the campaign’s known filenames and hashes, and prioritize alerting for script-driven execution chains that transition into injector behavior. At the network layer, restrict outbound TLS connectivity to the identified IP addresses and add detections for suspicious beaconing patterns. On endpoints, watch for creation of the referenced mutexes and for code-injection activity targeting AddInProcess32.exe.

Response

If indicators are detected, immediately isolate the affected host, capture volatile evidence (including running processes and network connections), and preserve relevant artifacts for analysis. Perform focused forensics on the TEMP directory and %ALLUSERSPROFILE%\remcos to identify droppers, configuration data, and keylogging output. Remove malicious files, stop and remediate the injected AddInProcess32.exe process, and rotate potentially exposed credentials. Finally, update SIEM/EDR content with extracted IOCs and hunt across the environment for matching filenames, mutexes, and TLS destination indicators.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#cccccc %% Nodes action_initial_access["Action – T1204.002 User Execution: Victims download malicious executables masquerading as VeraCrypt installers or gambling blocklist lookup tools."] class action_initial_access action tool_malicious_installer["Tool – Name: Fake VeraCrypt Installer Description: Executable disguised to entice user execution."] class tool_malicious_installer tool action_execution_vbs["Action – T1059.005 Visual Basic: VBS scripts written to %TEMP% and executed."] class action_execution_vbs action tool_vbs_script["Tool – Name: VBS Script Location: %TEMP%"] class tool_vbs_script tool action_execution_powershell["Action – T1059.001 PowerShell: PowerShell downloader scripts retrieve additional payloads."] class action_execution_powershell action tool_ps_downloader["Tool – Name: PowerShell Downloader Function: Retrieves payloads from remote server."] class tool_ps_downloader tool action_obfuscation["Action – Obfuscation Techniques: Base64 encoding, junk code, polymorphic sections, dynamic API resolution (T1027.008, T1027.014, T1027.016, T1027.007)."] class action_obfuscation action action_defense_evasion["Action – T1055 Process Injection: .NET injector injects Remcos RAT into trusted process AddInProcess32.exe."] class action_defense_evasion action tool_dotnet_injector["Tool – Name: .NET Injector Purpose: Injects malicious code into other processes."] class tool_dotnet_injector tool process_addinprocess["Process – Name: AddInProcess32.exe Legitimacy: Trusted Microsoft Office process."] class process_addinprocess process malware_remcos["Malware – Name: Remcos RAT Capabilities: Remote control, credential harvesting, keylogging, media capture."] class malware_remcos malware action_browser_cred["Action – T1555.003 Credentials In Browsers: Harvests saved browser credentials."] class action_browser_cred action action_keylogging["Action – T1056.001 Keylogging: Captures keystrokes."] class action_keylogging action action_collection["Action – Collection of user data via screen, audio, and video."] class action_collection action action_screenshot["Action – T1113 Screen Capture: Captures screenshots."] class action_screenshot action action_audio["Action – T1123 Audio Capture: Records microphone audio."] class action_audio action action_video["Action – T1125 Video Capture: Captures webcam video."] class action_video action action_c2["Action – T1071.001 Web Protocols: TLS web communication and Discord webhook usage."] class action_c2 action tool_discord_webhook["Tool – Name: Discord Webhook Use: Logging and exfiltration channel."] class tool_discord_webhook tool action_exfiltration["Action – T1567.004 Exfiltration Over Web Services: Data sent to attacker via Discord webhook."] class action_exfiltration action %% Connections action_initial_access –>|uses| tool_malicious_installer tool_malicious_installer –>|delivers| action_execution_vbs action_execution_vbs –>|writes_and_executes| tool_vbs_script action_execution_vbs –>|triggers| action_execution_powershell tool_ps_downloader –>|downloads_payloads| action_obfuscation action_obfuscation –>|enables| action_defense_evasion action_defense_evasion –>|injects| tool_dotnet_injector tool_dotnet_injector –>|targets| process_addinprocess process_addinprocess –>|hosts| malware_remcos malware_remcos –>|harvests| action_browser_cred malware_remcos –>|records| action_keylogging malware_remcos –>|captures| action_collection action_collection –>|screenshots| action_screenshot action_collection –>|audio| action_audio action_collection –>|video| action_video malware_remcos –>|communicates| action_c2 action_c2 –>|uses| tool_discord_webhook action_c2 –>|sends_data| action_exfiltration action_exfiltration –>|via| tool_discord_webhook "

Attack Flow

View

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

Ingress (T1105): The attacker hosts a malicious usercon.exe (Remcos RAT) on a C2 server disguised as a “blocklist‑lookup” utility.
Download: The victim clicks a link and the file is saved to %USERPROFILE%DownloadsProgramsusercon.exe.
Execution (T1059): The attacker leverages a PowerShell one‑liner to silently launch the payload from the download path, evading user interaction.
Post‑execution: The RAT establishes outbound C2 over HTTP (T1071) and creates persistence via registry autorun (T1547) – these later stages are outside the scope of the current rule but illustrate the full kill‑chain.

Regression Test Script

# ---------------------------------------------------------
# Remcos RAT simulation – triggers the Sigma rule
# ---------------------------------------------------------

# 1. Define the malicious payload path (matches rule)
$maliciousPath = "$env:USERPROFILEDownloadsProgramsusercon.exe"

# 2. Create a dummy executable payload (PE header only – safe for testing)
Set-Content -Path $maliciousPath -Value ([Byte[]]@(0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0xFF,0xFF,0x00,0x00,0xB8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)) -Encoding Byte

# 3. Execute the payload silently (simulating attacker’s command‑line launch)
Start-Process -FilePath $maliciousPath -WindowStyle Hidden -PassThru

# 4. Optional: emit a fake network connection to illustrate later stages
# (not required for triggering the Sigma rule)
# Invoke-WebRequest -Uri "http://malicious.c2.example.com/ping" -UseBasicParsing

Write-Host "Simulation executed – check SIEM for rule trigger."

Cleanup Commands

# ---------------------------------------------------------
# Remove artifacts produced by the simulation
# ---------------------------------------------------------
$maliciousPath = "$env:USERPROFILEDownloadsProgramsusercon.exe"
if (Test-Path $maliciousPath) {
    Remove-Item -Path $maliciousPath -Force
    Write-Host "Removed $maliciousPath"
} else {
    Write-Host "No artifact found at $maliciousPath"
}

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.