remcos | a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

General

Target

185rms.exe
Size

2.8MB
MD5

6cfceeb676d49151e8c2fec9c4209789
SHA1

42c87894f183c3612e1662f531003bbe7478f875
SHA256

a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e
SHA512

a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Score

10^/10

remcos rh1 evasion persistence rat themida trojan

Malware Config

Extracted

Family

remcos

Botnet

RH1

C2

185.29.9.125:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
itunes.exe
copy_folder
RMS
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Jd1985-XODZWD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Rms
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

185rms.exeitunes.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 185rms.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ itunes.exe
Executes dropped EXE 1 IoCs

Processes:

itunes.exe

pid process

4480 itunes.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	185rms.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	itunes.exe

pid	process
4480	itunes.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

185rms.exeitunes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	185rms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	185rms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	itunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	itunes.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe185rms.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	185rms.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/4676-130-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
behavioral2/memory/4676-131-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
behavioral2/memory/4676-132-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
behavioral2/memory/4676-133-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
behavioral2/memory/4676-135-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
behavioral2/memory/4676-136-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
behavioral2/memory/4676-141-0x00000000002D0000-0x00000000009EF000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
behavioral2/memory/4480-147-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida
behavioral2/memory/4480-148-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida
behavioral2/memory/4480-149-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida
behavioral2/memory/4480-151-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida
behavioral2/memory/4480-152-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida
behavioral2/memory/4480-150-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida
behavioral2/memory/4480-157-0x0000000000670000-0x0000000000D8F000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

itunes.exe185rms.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	itunes.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run\	185rms.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	185rms.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run\	itunes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

185rms.exeitunes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	185rms.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	itunes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

185rms.exeitunes.exe

pid process

4676 185rms.exe
4480 itunes.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

185rms.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings 185rms.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2680 reg.exe
1576 reg.exe

pid	process
4676	185rms.exe
4480	itunes.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	185rms.exe

pid	process
2680	reg.exe
1576	reg.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

185rms.execmd.exeWScript.execmd.exeitunes.execmd.exe

description	pid	process	target process
PID 4676 wrote to memory of 4640	4676	185rms.exe	cmd.exe
PID 4676 wrote to memory of 4640	4676	185rms.exe	cmd.exe
PID 4676 wrote to memory of 4640	4676	185rms.exe	cmd.exe
PID 4640 wrote to memory of 2680	4640	cmd.exe	reg.exe
PID 4640 wrote to memory of 2680	4640	cmd.exe	reg.exe
PID 4640 wrote to memory of 2680	4640	cmd.exe	reg.exe
PID 4676 wrote to memory of 3532	4676	185rms.exe	WScript.exe
PID 4676 wrote to memory of 3532	4676	185rms.exe	WScript.exe
PID 4676 wrote to memory of 3532	4676	185rms.exe	WScript.exe
PID 3532 wrote to memory of 2784	3532	WScript.exe	cmd.exe
PID 3532 wrote to memory of 2784	3532	WScript.exe	cmd.exe
PID 3532 wrote to memory of 2784	3532	WScript.exe	cmd.exe
PID 2784 wrote to memory of 4480	2784	cmd.exe	itunes.exe
PID 2784 wrote to memory of 4480	2784	cmd.exe	itunes.exe
PID 2784 wrote to memory of 4480	2784	cmd.exe	itunes.exe
PID 4480 wrote to memory of 1552	4480	itunes.exe	cmd.exe
PID 4480 wrote to memory of 1552	4480	itunes.exe	cmd.exe
PID 4480 wrote to memory of 1552	4480	itunes.exe	cmd.exe
PID 4480 wrote to memory of 1752	4480	itunes.exe	svchost.exe
PID 4480 wrote to memory of 1752	4480	itunes.exe	svchost.exe
PID 4480 wrote to memory of 1752	4480	itunes.exe	svchost.exe
PID 1552 wrote to memory of 1576	1552	cmd.exe	reg.exe
PID 1552 wrote to memory of 1576	1552	cmd.exe	reg.exe
PID 1552 wrote to memory of 1576	1552	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\185rms.exe
"C:\Users\Admin\AppData\Local\Temp\185rms.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- UAC bypass
- Modifies registry key
PID:2680

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\RMS\itunes.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
5⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
- Modifies registry key
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
536B

MD5
9f75de802bf74aeb51ff665f8d009420

SHA1
16bf08edffd90ff78e409e8461cc9b6b12ceb93b

SHA256
753ec32a971c16ea202a0f8ebb7bce551b5ff8d8c546f26bdf4a3069a5c50c48

SHA512
bf1df2ce961e0ddd2a741228cc9dafed88ffc447145e553a49f101e475cd99910c7d114c8cdd18d6ce05eb9684d28666d44ca2800d9f5d64e553372663f0242f

Download Submit
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
memory/1552-154-0x0000000000000000-mapping.dmp

Download
memory/1576-156-0x0000000000000000-mapping.dmp

Download
memory/1752-155-0x0000000000000000-mapping.dmp

Download
memory/2680-138-0x0000000000000000-mapping.dmp

Download
memory/2784-143-0x0000000000000000-mapping.dmp

Download
memory/3532-139-0x0000000000000000-mapping.dmp

Download
memory/4480-153-0x00000000779E0000-0x0000000077B83000-memory.dmp

Filesize
1.6MB

Download
memory/4480-152-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4480-157-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4480-158-0x00000000779E0000-0x0000000077B83000-memory.dmp

Filesize
1.6MB

Download
memory/4480-150-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4480-151-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4480-149-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4480-144-0x0000000000000000-mapping.dmp

Download
memory/4480-147-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4480-148-0x0000000000670000-0x0000000000D8F000-memory.dmp

Filesize
7.1MB

Download
memory/4640-137-0x0000000000000000-mapping.dmp

Download
memory/4676-134-0x00000000779E0000-0x0000000077B83000-memory.dmp

Filesize
1.6MB

Download
memory/4676-135-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-130-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-133-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-132-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-131-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-136-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-141-0x00000000002D0000-0x00000000009EF000-memory.dmp

Filesize
7.1MB

Download
memory/4676-142-0x00000000779E0000-0x0000000077B83000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads