remcos | f851ccd89ef8f8e28648ff600789364e9caf5c522a5e7238cee619a229cc821d

System Information Discovery

Processes:

RFQ 2290.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RFQ 2290.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RFQ 2290.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

RFQ 2290.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	RFQ 2290.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

RFQ 2290.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RFQ 2290.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RFQ 2290.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ 2290.exe

description pid process target process

PID 3868 set thread context of 2040 3868 RFQ 2290.exe RFQ 2290.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1488 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

RFQ 2290.exepowershell.exepowershell.exe

pid process

3868 RFQ 2290.exe
4476 powershell.exe
2804 powershell.exe
4476 powershell.exe
2804 powershell.exe
3868 RFQ 2290.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RFQ 2290.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3868 RFQ 2290.exe
Token: SeDebugPrivilege 4476 powershell.exe
Token: SeDebugPrivilege 2804 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RFQ 2290.exe

pid process

2040 RFQ 2290.exe

description	pid	process	target process
PID 3868 set thread context of 2040	3868	RFQ 2290.exe	RFQ 2290.exe

pid	process
1488	schtasks.exe

pid	process
3868	RFQ 2290.exe
4476	powershell.exe
2804	powershell.exe
4476	powershell.exe
2804	powershell.exe
3868	RFQ 2290.exe

description	pid	process
Token: SeDebugPrivilege	3868	RFQ 2290.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe

pid	process
2040	RFQ 2290.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

RFQ 2290.exe

description	pid	process	target process
PID 3868 wrote to memory of 4476	3868	RFQ 2290.exe	powershell.exe
PID 3868 wrote to memory of 4476	3868	RFQ 2290.exe	powershell.exe
PID 3868 wrote to memory of 4476	3868	RFQ 2290.exe	powershell.exe
PID 3868 wrote to memory of 2804	3868	RFQ 2290.exe	powershell.exe
PID 3868 wrote to memory of 2804	3868	RFQ 2290.exe	powershell.exe
PID 3868 wrote to memory of 2804	3868	RFQ 2290.exe	powershell.exe
PID 3868 wrote to memory of 1488	3868	RFQ 2290.exe	schtasks.exe
PID 3868 wrote to memory of 1488	3868	RFQ 2290.exe	schtasks.exe
PID 3868 wrote to memory of 1488	3868	RFQ 2290.exe	schtasks.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe
PID 3868 wrote to memory of 2040	3868	RFQ 2290.exe	RFQ 2290.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 2290.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 2290.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ 2290.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iDKZenUzizmrGT.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDKZenUzizmrGT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA9F.tmp"
2⤵
- Creates scheduled task(s)
PID:1488

C:\Users\Admin\AppData\Local\Temp\RFQ 2290.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 2290.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

5

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

4

Peripheral Device Discovery