remcos | 08f15e4acb5af5b3095304fbfd9370d33ea57a561da66bc1239477cdc6530dc3

General

Target
z9ERDG51.exe
Size 92KB
Sample201125-325ac1dbax
SHA256 08f15e4acb5af5b3095304fbfd9370d33ea57a561da66bc1239477cdc6530dc3
MD5 cc6a463987484ace0a9f98e327c85c2b
SHA1 1867031e6a7d7057d7d96cfd4ad99eba14afde1e
SHA512 9e8286d422cb012826eeb390073cbeb58b8685b86befd3b620dfce0b5e489db04ce15f91682cd000ac8508ea54e474935eaad3ef6aeaf7d6f4de159609bc9e19
MD5 SHA1 SHA512

Score

10^/10

remcos evasion persistence rat

Malware Config

Extracted

Family

remcos

C2

185.185.3.40:2404

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	z9ERDG51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	z9ERDG51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	system32.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	z9ERDG51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\system32 = "\"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	z9ERDG51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\system32 = "\"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	system32.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	system32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	z9ERDG51.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	system32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	z9ERDG51.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Windows\\SysWOW64\\System32\\system32.exe\""	z9ERDG51.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	z9ERDG51.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	system32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	z9ERDG51.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System32\system32.exe	z9ERDG51.exe
File opened for modification	C:\Windows\SysWOW64\System32\system32.exe	z9ERDG51.exe
File opened for modification	C:\Windows\SysWOW64\System32	z9ERDG51.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2688	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2408	756	z9ERDG51.exe	74
PID 756 wrote to memory of 2408	756	z9ERDG51.exe	74
PID 756 wrote to memory of 2408	756	z9ERDG51.exe	74
PID 2408 wrote to memory of 2688	2408	cmd.exe	76
PID 2408 wrote to memory of 2688	2408	cmd.exe	76
PID 2408 wrote to memory of 2688	2408	cmd.exe	76
PID 2408 wrote to memory of 4060	2408	cmd.exe	78
PID 2408 wrote to memory of 4060	2408	cmd.exe	78
PID 2408 wrote to memory of 4060	2408	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\z9ERDG51.exe
"C:\Users\Admin\AppData\Local\Temp\z9ERDG51.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2688
- - C:\Windows\SysWOW64\System32\system32.exe
    "C:\Windows\SysWOW64\System32\system32.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    PID:4060