remcos | da250da3b237fd0acf29d52066c84d56da4f92e5e854c71b5d6a4d7b121dae9c

Virtualization/Sandbox Evasion

T1497

Processes:

110bc33bdd915c5738f427019eaacf53.exeitunes.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	110bc33bdd915c5738f427019eaacf53.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	itunes.exe

Executes dropped EXE 1 IoCs

Processes:

itunes.exe

pid process

4704 itunes.exe

pid	process
4704	itunes.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

itunes.exe110bc33bdd915c5738f427019eaacf53.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	itunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	itunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	110bc33bdd915c5738f427019eaacf53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	110bc33bdd915c5738f427019eaacf53.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

110bc33bdd915c5738f427019eaacf53.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	110bc33bdd915c5738f427019eaacf53.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1264-130-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
behavioral2/memory/1264-131-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
behavioral2/memory/1264-132-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
behavioral2/memory/1264-133-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
behavioral2/memory/1264-135-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
behavioral2/memory/1264-136-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
behavioral2/memory/1264-140-0x0000000000A70000-0x00000000011A8000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
behavioral2/memory/4704-147-0x0000000000940000-0x0000000001078000-memory.dmp	themida
behavioral2/memory/4704-148-0x0000000000940000-0x0000000001078000-memory.dmp	themida
behavioral2/memory/4704-149-0x0000000000940000-0x0000000001078000-memory.dmp	themida
behavioral2/memory/4704-151-0x0000000000940000-0x0000000001078000-memory.dmp	themida
behavioral2/memory/4704-152-0x0000000000940000-0x0000000001078000-memory.dmp	themida
behavioral2/memory/4704-156-0x0000000000940000-0x0000000001078000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

110bc33bdd915c5738f427019eaacf53.exeitunes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	110bc33bdd915c5738f427019eaacf53.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run\	itunes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	itunes.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run\	110bc33bdd915c5738f427019eaacf53.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

110bc33bdd915c5738f427019eaacf53.exeitunes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	110bc33bdd915c5738f427019eaacf53.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	itunes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

110bc33bdd915c5738f427019eaacf53.exeitunes.exe

pid process

1264 110bc33bdd915c5738f427019eaacf53.exe
4704 itunes.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1264	110bc33bdd915c5738f427019eaacf53.exe
4704	itunes.exe

Modifies registry class 1 IoCs

Processes:

110bc33bdd915c5738f427019eaacf53.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	110bc33bdd915c5738f427019eaacf53.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

4240 reg.exe
2824 reg.exe

pid	process
4240	reg.exe
2824	reg.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

110bc33bdd915c5738f427019eaacf53.execmd.exeWScript.execmd.exeitunes.execmd.exe

description	pid	process	target process
PID 1264 wrote to memory of 5076	1264	110bc33bdd915c5738f427019eaacf53.exe	cmd.exe
PID 1264 wrote to memory of 5076	1264	110bc33bdd915c5738f427019eaacf53.exe	cmd.exe
PID 1264 wrote to memory of 5076	1264	110bc33bdd915c5738f427019eaacf53.exe	cmd.exe
PID 5076 wrote to memory of 4240	5076	cmd.exe	reg.exe
PID 5076 wrote to memory of 4240	5076	cmd.exe	reg.exe
PID 5076 wrote to memory of 4240	5076	cmd.exe	reg.exe
PID 1264 wrote to memory of 1488	1264	110bc33bdd915c5738f427019eaacf53.exe	WScript.exe
PID 1264 wrote to memory of 1488	1264	110bc33bdd915c5738f427019eaacf53.exe	WScript.exe
PID 1264 wrote to memory of 1488	1264	110bc33bdd915c5738f427019eaacf53.exe	WScript.exe
PID 1488 wrote to memory of 4940	1488	WScript.exe	cmd.exe
PID 1488 wrote to memory of 4940	1488	WScript.exe	cmd.exe
PID 1488 wrote to memory of 4940	1488	WScript.exe	cmd.exe
PID 4940 wrote to memory of 4704	4940	cmd.exe	itunes.exe
PID 4940 wrote to memory of 4704	4940	cmd.exe	itunes.exe
PID 4940 wrote to memory of 4704	4940	cmd.exe	itunes.exe
PID 4704 wrote to memory of 1048	4704	itunes.exe	cmd.exe
PID 4704 wrote to memory of 1048	4704	itunes.exe	cmd.exe
PID 4704 wrote to memory of 1048	4704	itunes.exe	cmd.exe
PID 1048 wrote to memory of 2824	1048	cmd.exe	reg.exe
PID 1048 wrote to memory of 2824	1048	cmd.exe	reg.exe
PID 1048 wrote to memory of 2824	1048	cmd.exe	reg.exe
PID 4704 wrote to memory of 2660	4704	itunes.exe	svchost.exe
PID 4704 wrote to memory of 2660	4704	itunes.exe	svchost.exe
PID 4704 wrote to memory of 2660	4704	itunes.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\110bc33bdd915c5738f427019eaacf53.exe
"C:\Users\Admin\AppData\Local\Temp\110bc33bdd915c5738f427019eaacf53.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- UAC bypass
- Modifies registry key
PID:4240

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\RMS\itunes.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- UAC bypass
- Modifies registry key
PID:2824

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
5⤵
PID:2660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

3

System Information Discovery

4

Virtualization/Sandbox Evasion