remcos | 93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c

Modify Existing Service

T1031

Processes:

serverbb.exeremcos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	remcos.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

serverbb.exeremcos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	remcos.exe

Windows security bypass 2 TTPs 12 IoCs

Disabling Security Tools

Modify Registry

Processes:

remcos.exeserverbb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	serverbb.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

serverbb.exeremcos.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	serverbb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	remcos.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 3 IoCs

Processes:

serverbb.sfx.exeserverbb.exeremcos.exe

pid process

1092 serverbb.sfx.exe
1436 serverbb.exe
1924 remcos.exe

pid	process
1092	serverbb.sfx.exe
1436	serverbb.exe
1924	remcos.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1436-69-0x0000000001E80000-0x0000000002F0E000-memory.dmp	upx
behavioral1/memory/1436-70-0x0000000001E80000-0x0000000002F0E000-memory.dmp	upx
behavioral1/memory/1436-79-0x0000000001E80000-0x0000000002F0E000-memory.dmp	upx
behavioral1/memory/1924-86-0x0000000001FB0000-0x000000000303E000-memory.dmp	upx
behavioral1/memory/1924-90-0x0000000001FB0000-0x000000000303E000-memory.dmp	upx
behavioral1/memory/1924-92-0x0000000001FB0000-0x000000000303E000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

cmd.exeserverbb.sfx.execmd.exe

pid process

2008 cmd.exe
1092 serverbb.sfx.exe
1092 serverbb.sfx.exe
1308 cmd.exe
1308 cmd.exe

pid	process
2008	cmd.exe
1092	serverbb.sfx.exe
1092	serverbb.sfx.exe
1308	cmd.exe
1308	cmd.exe

Windows security modification 2 TTPs 14 IoCs

Disabling Security Tools

Modify Registry

Processes:

remcos.exeserverbb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	serverbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	remcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

remcos.exeserverbb.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\	serverbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	serverbb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	serverbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	serverbb.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

Processes:

serverbb.exeremcos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	remcos.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

remcos.exe

description	ioc	process
File opened (read-only)	\??\I:	remcos.exe
File opened (read-only)	\??\R:	remcos.exe
File opened (read-only)	\??\S:	remcos.exe
File opened (read-only)	\??\U:	remcos.exe
File opened (read-only)	\??\H:	remcos.exe
File opened (read-only)	\??\N:	remcos.exe
File opened (read-only)	\??\P:	remcos.exe
File opened (read-only)	\??\X:	remcos.exe
File opened (read-only)	\??\F:	remcos.exe
File opened (read-only)	\??\L:	remcos.exe
File opened (read-only)	\??\Q:	remcos.exe
File opened (read-only)	\??\T:	remcos.exe
File opened (read-only)	\??\W:	remcos.exe
File opened (read-only)	\??\Z:	remcos.exe
File opened (read-only)	\??\Y:	remcos.exe
File opened (read-only)	\??\E:	remcos.exe
File opened (read-only)	\??\G:	remcos.exe
File opened (read-only)	\??\J:	remcos.exe
File opened (read-only)	\??\K:	remcos.exe
File opened (read-only)	\??\M:	remcos.exe
File opened (read-only)	\??\O:	remcos.exe
File opened (read-only)	\??\V:	remcos.exe

Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

remcos.exe

description ioc process

File opened for modification C:\autorun.inf remcos.exe

description	ioc	process
File opened for modification	C:\autorun.inf	remcos.exe

Drops file in Program Files directory 4 IoCs

Processes:

remcos.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	remcos.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	remcos.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	remcos.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	remcos.exe

Drops file in Windows directory 1 IoCs

Processes:

serverbb.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI serverbb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

616 PING.EXE

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	serverbb.exe

pid	process
616	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

serverbb.exeremcos.exe

pid	process
1436	serverbb.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe
1924	remcos.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

serverbb.exeremcos.exe

description	pid	process
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1436	serverbb.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe
Token: SeDebugPrivilege	1924	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

remcos.exe

pid process

1924 remcos.exe

pid	process
1924	remcos.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.execmd.exeserverbb.sfx.exeserverbb.execmd.exeremcos.exe

description	pid	process	target process
PID 1000 wrote to memory of 2008	1000	93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe	cmd.exe
PID 1000 wrote to memory of 2008	1000	93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe	cmd.exe
PID 1000 wrote to memory of 2008	1000	93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe	cmd.exe
PID 1000 wrote to memory of 2008	1000	93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe	cmd.exe
PID 2008 wrote to memory of 1092	2008	cmd.exe	serverbb.sfx.exe
PID 2008 wrote to memory of 1092	2008	cmd.exe	serverbb.sfx.exe
PID 2008 wrote to memory of 1092	2008	cmd.exe	serverbb.sfx.exe
PID 2008 wrote to memory of 1092	2008	cmd.exe	serverbb.sfx.exe
PID 1092 wrote to memory of 1436	1092	serverbb.sfx.exe	serverbb.exe
PID 1092 wrote to memory of 1436	1092	serverbb.sfx.exe	serverbb.exe
PID 1092 wrote to memory of 1436	1092	serverbb.sfx.exe	serverbb.exe
PID 1092 wrote to memory of 1436	1092	serverbb.sfx.exe	serverbb.exe
PID 1436 wrote to memory of 1184	1436	serverbb.exe	taskhost.exe
PID 1436 wrote to memory of 1292	1436	serverbb.exe	Dwm.exe
PID 1436 wrote to memory of 1364	1436	serverbb.exe	Explorer.EXE
PID 1436 wrote to memory of 1000	1436	serverbb.exe	93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe
PID 1436 wrote to memory of 1000	1436	serverbb.exe	93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe
PID 1436 wrote to memory of 2008	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 2008	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1932	1436	serverbb.exe	conhost.exe
PID 1436 wrote to memory of 1092	1436	serverbb.exe	serverbb.sfx.exe
PID 1436 wrote to memory of 1092	1436	serverbb.exe	serverbb.sfx.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1436 wrote to memory of 1308	1436	serverbb.exe	cmd.exe
PID 1308 wrote to memory of 616	1308	cmd.exe	PING.EXE
PID 1308 wrote to memory of 616	1308	cmd.exe	PING.EXE
PID 1308 wrote to memory of 616	1308	cmd.exe	PING.EXE
PID 1308 wrote to memory of 616	1308	cmd.exe	PING.EXE
PID 1308 wrote to memory of 1924	1308	cmd.exe	remcos.exe
PID 1308 wrote to memory of 1924	1308	cmd.exe	remcos.exe
PID 1308 wrote to memory of 1924	1308	cmd.exe	remcos.exe
PID 1308 wrote to memory of 1924	1308	cmd.exe	remcos.exe
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1932	1924	remcos.exe	conhost.exe
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe
PID 1924 wrote to memory of 1364	1924	remcos.exe	Explorer.EXE
PID 1924 wrote to memory of 1184	1924	remcos.exe	taskhost.exe
PID 1924 wrote to memory of 1292	1924	remcos.exe	Dwm.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

serverbb.exeremcos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	serverbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	remcos.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1364

C:\Users\Admin\AppData\Local\Temp\93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe
"C:\Users\Admin\AppData\Local\Temp\93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\xxawaeszfers43s3d43ec.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\RarSFX0\serverbb.sfx.exe
serverbb.sfx.exe -piiasedfdsegg09o0i8i0i -dC:\Users\Admin\AppData\Local\Temp
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\RarSFX1\serverbb.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\serverbb.exe"
5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1436

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
7⤵
- Runs ping.exe
PID:616

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
7⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1924

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1292

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1184

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-862730490-2094149816-1486834116-1973345168-863669718-251493061598777224898028814"
1⤵
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Bypass User Account Control

T1088

Disabling Security Tools