remcos | a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

General

Target

185rms.exe
Size

2.8MB
MD5

6cfceeb676d49151e8c2fec9c4209789
SHA1

42c87894f183c3612e1662f531003bbe7478f875
SHA256

a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e
SHA512

a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Score

10^/10

remcos rh1 evasion persistence rat themida trojan

Malware Config

Extracted

Family

remcos

Botnet

RH1

C2

185.29.9.125:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
itunes.exe
copy_folder
RMS
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Jd1985-XODZWD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Rms
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

185rms.exeitunes.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 185rms.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ itunes.exe
Executes dropped EXE 1 IoCs

Processes:

itunes.exe

pid process

428 itunes.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	185rms.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	itunes.exe

pid	process
428	itunes.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

itunes.exe185rms.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	itunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	185rms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	185rms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	itunes.exe

Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

1724 WScript.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

580 cmd.exe
580 cmd.exe

pid	process
1724	WScript.exe

pid	process
580	cmd.exe
580	cmd.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1420-55-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
behavioral1/memory/1420-57-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
behavioral1/memory/1420-56-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
behavioral1/memory/1420-59-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
behavioral1/memory/1420-60-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
behavioral1/memory/1420-61-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
behavioral1/memory/1420-65-0x0000000000FF0000-0x000000000170F000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
behavioral1/memory/428-77-0x0000000000020000-0x000000000073F000-memory.dmp	themida
behavioral1/memory/428-76-0x0000000000020000-0x000000000073F000-memory.dmp	themida
behavioral1/memory/428-78-0x0000000000020000-0x000000000073F000-memory.dmp	themida
behavioral1/memory/428-80-0x0000000000020000-0x000000000073F000-memory.dmp	themida
behavioral1/memory/428-79-0x0000000000020000-0x000000000073F000-memory.dmp	themida
behavioral1/memory/428-85-0x0000000000020000-0x000000000073F000-memory.dmp	themida
behavioral1/memory/428-87-0x0000000000020000-0x000000000073F000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

185rms.exeitunes.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	185rms.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	185rms.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	itunes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	itunes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

185rms.exeitunes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	185rms.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	itunes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

185rms.exeitunes.exe

pid process

1420 185rms.exe
428 itunes.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2000 reg.exe
520 reg.exe

pid	process
1420	185rms.exe
428	itunes.exe

pid	process
2000	reg.exe
520	reg.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

185rms.execmd.exeWScript.execmd.exeitunes.execmd.exe

description	pid	process	target process
PID 1420 wrote to memory of 2028	1420	185rms.exe	cmd.exe
PID 1420 wrote to memory of 2028	1420	185rms.exe	cmd.exe
PID 1420 wrote to memory of 2028	1420	185rms.exe	cmd.exe
PID 1420 wrote to memory of 2028	1420	185rms.exe	cmd.exe
PID 2028 wrote to memory of 2000	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 2000	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 2000	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 2000	2028	cmd.exe	reg.exe
PID 1420 wrote to memory of 1724	1420	185rms.exe	WScript.exe
PID 1420 wrote to memory of 1724	1420	185rms.exe	WScript.exe
PID 1420 wrote to memory of 1724	1420	185rms.exe	WScript.exe
PID 1420 wrote to memory of 1724	1420	185rms.exe	WScript.exe
PID 1724 wrote to memory of 580	1724	WScript.exe	cmd.exe
PID 1724 wrote to memory of 580	1724	WScript.exe	cmd.exe
PID 1724 wrote to memory of 580	1724	WScript.exe	cmd.exe
PID 1724 wrote to memory of 580	1724	WScript.exe	cmd.exe
PID 580 wrote to memory of 428	580	cmd.exe	itunes.exe
PID 580 wrote to memory of 428	580	cmd.exe	itunes.exe
PID 580 wrote to memory of 428	580	cmd.exe	itunes.exe
PID 580 wrote to memory of 428	580	cmd.exe	itunes.exe
PID 428 wrote to memory of 1508	428	itunes.exe	cmd.exe
PID 428 wrote to memory of 1508	428	itunes.exe	cmd.exe
PID 428 wrote to memory of 1508	428	itunes.exe	cmd.exe
PID 428 wrote to memory of 1508	428	itunes.exe	cmd.exe
PID 428 wrote to memory of 1784	428	itunes.exe	svchost.exe
PID 428 wrote to memory of 1784	428	itunes.exe	svchost.exe
PID 428 wrote to memory of 1784	428	itunes.exe	svchost.exe
PID 428 wrote to memory of 1784	428	itunes.exe	svchost.exe
PID 1508 wrote to memory of 520	1508	cmd.exe	reg.exe
PID 1508 wrote to memory of 520	1508	cmd.exe	reg.exe
PID 1508 wrote to memory of 520	1508	cmd.exe	reg.exe
PID 1508 wrote to memory of 520	1508	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\185rms.exe
"C:\Users\Admin\AppData\Local\Temp\185rms.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- UAC bypass
- Modifies registry key
PID:2000

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\RMS\itunes.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- UAC bypass
- Modifies registry key
PID:520

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
5⤵
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
536B

MD5
9f75de802bf74aeb51ff665f8d009420

SHA1
16bf08edffd90ff78e409e8461cc9b6b12ceb93b

SHA256
753ec32a971c16ea202a0f8ebb7bce551b5ff8d8c546f26bdf4a3069a5c50c48

SHA512
bf1df2ce961e0ddd2a741228cc9dafed88ffc447145e553a49f101e475cd99910c7d114c8cdd18d6ce05eb9684d28666d44ca2800d9f5d64e553372663f0242f

Download Submit
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
memory/428-80-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/428-73-0x0000000000000000-mapping.dmp

Download
memory/428-87-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/428-86-0x00000000779A0000-0x0000000077B20000-memory.dmp

Filesize
1.5MB

Download
memory/428-85-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/428-79-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/428-78-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/428-76-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/428-77-0x0000000000020000-0x000000000073F000-memory.dmp

Filesize
7.1MB

Download
memory/520-82-0x0000000000000000-mapping.dmp

Download
memory/580-84-0x0000000002090000-0x00000000027AF000-memory.dmp

Filesize
7.1MB

Download
memory/580-83-0x0000000002090000-0x00000000027AF000-memory.dmp

Filesize
7.1MB

Download
memory/580-69-0x0000000000000000-mapping.dmp

Download
memory/1420-55-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-65-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-58-0x00000000779A0000-0x0000000077B20000-memory.dmp

Filesize
1.5MB

Download
memory/1420-57-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-56-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-61-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1420-60-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-59-0x0000000000FF0000-0x000000000170F000-memory.dmp

Filesize
7.1MB

Download
memory/1420-67-0x00000000779A0000-0x0000000077B20000-memory.dmp

Filesize
1.5MB

Download
memory/1508-81-0x0000000000000000-mapping.dmp

Download
memory/1724-64-0x0000000000000000-mapping.dmp

Download
memory/2000-63-0x0000000000000000-mapping.dmp

Download
memory/2028-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads