remcos | f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015

Modify Registry

Processes:

test.exeJavaUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdater\\JavaUpdate.exe\""	test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdater\\JavaUpdate.exe\""	JavaUpdate.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exetest.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	test.exe

Executes dropped EXE 2 IoCs

Processes:

test.exeJavaUpdate.exe

pid process

3960 test.exe
2804 JavaUpdate.exe

pid	process
3960	test.exe
2804	JavaUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

test.exeJavaUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdater\\JavaUpdate.exe\""	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdater\\JavaUpdate.exe\""	JavaUpdate.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

Modify Registry

Processes:

test.exeJavaUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	test.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	JavaUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

5084 reg.exe
2836 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2500 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4104 powershell.exe
4104 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4104 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

JavaUpdate.exe

pid process

2804 JavaUpdate.exe

pid	process
5084	reg.exe
2836	reg.exe

pid	process
2500	PING.EXE

pid	process
4104	powershell.exe
4104	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4104	powershell.exe

pid	process
2804	JavaUpdate.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exetest.execmd.execmd.exeJavaUpdate.execmd.exe

description	pid	process	target process
PID 3016 wrote to memory of 4104	3016	f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe	powershell.exe
PID 3016 wrote to memory of 4104	3016	f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe	powershell.exe
PID 3016 wrote to memory of 3960	3016	f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe	test.exe
PID 3016 wrote to memory of 3960	3016	f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe	test.exe
PID 3016 wrote to memory of 3960	3016	f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe	test.exe
PID 3960 wrote to memory of 1332	3960	test.exe	cmd.exe
PID 3960 wrote to memory of 1332	3960	test.exe	cmd.exe
PID 3960 wrote to memory of 1332	3960	test.exe	cmd.exe
PID 1332 wrote to memory of 5084	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 5084	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 5084	1332	cmd.exe	reg.exe
PID 3960 wrote to memory of 4488	3960	test.exe	cmd.exe
PID 3960 wrote to memory of 4488	3960	test.exe	cmd.exe
PID 3960 wrote to memory of 4488	3960	test.exe	cmd.exe
PID 4488 wrote to memory of 2500	4488	cmd.exe	PING.EXE
PID 4488 wrote to memory of 2500	4488	cmd.exe	PING.EXE
PID 4488 wrote to memory of 2500	4488	cmd.exe	PING.EXE
PID 4488 wrote to memory of 2804	4488	cmd.exe	JavaUpdate.exe
PID 4488 wrote to memory of 2804	4488	cmd.exe	JavaUpdate.exe
PID 4488 wrote to memory of 2804	4488	cmd.exe	JavaUpdate.exe
PID 2804 wrote to memory of 3448	2804	JavaUpdate.exe	cmd.exe
PID 2804 wrote to memory of 3448	2804	JavaUpdate.exe	cmd.exe
PID 2804 wrote to memory of 3448	2804	JavaUpdate.exe	cmd.exe
PID 2804 wrote to memory of 4060	2804	JavaUpdate.exe	iexplore.exe
PID 2804 wrote to memory of 4060	2804	JavaUpdate.exe	iexplore.exe
PID 2804 wrote to memory of 4060	2804	JavaUpdate.exe	iexplore.exe
PID 3448 wrote to memory of 2836	3448	cmd.exe	reg.exe
PID 3448 wrote to memory of 2836	3448	cmd.exe	reg.exe
PID 3448 wrote to memory of 2836	3448	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe
"C:\Users\Admin\AppData\Local\Temp\f8057382d9ad7e73bf3c6a89ab5d523c6c01c90ad5ade386c01b1a4ffcfc0015.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAaAB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AeQB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYwByACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAcABzACMAPgA="
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- UAC bypass
- Modifies registry key
PID:5084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4488

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:2500

C:\Users\Admin\AppData\Roaming\JavaUpdater\JavaUpdate.exe
"C:\Users\Admin\AppData\Roaming\JavaUpdater\JavaUpdate.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- UAC bypass
- Modifies registry key
PID:2836

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
5⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4280 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

2

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

2

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

5

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

2

T1082

Remote System Discovery