Malware Analysis Report

2025-08-06 01:47

Sample ID 241031-caynzsxarp
Target 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN
SHA256 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0e
Tags
remcos host discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0e

Threat Level: Known bad

The file 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN was found to be: Known bad.

Malicious Activity Summary

remcos host discovery persistence rat

Remcos family

Remcos

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 01:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 01:53

Reported

2024-10-31 01:55

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"

Signatures

Remcos

rat remcos

Remcos family

remcos

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2724 set thread context of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2660 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2660 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2660 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2660 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2724 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Processes

C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe

"C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.73:80 crl.microsoft.com tcp

Files

memory/2660-0-0x0000000074971000-0x0000000074972000-memory.dmp

memory/2660-1-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2660-2-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2660-12-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2660-13-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2660-25-0x0000000074970000-0x0000000074F1B000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

MD5 b34dbb6ed63233fe7ea5c0146a2b5c23
SHA1 31b625ea0c4c97145607dd8122645e8321071857
SHA256 febbd77a8822294f32112f2ae1fa0043453922de0317a531489bccc9047f3c10
SHA512 158da7d247fc9d181578f2df385b8f8e9d6ae63fdc9e648f89ebea898892e8739f6264d36f5e210ed24963d4e37fcce0fa70fed51a7e4bcb790952a64325fa69

memory/2724-33-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2724-34-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2660-32-0x0000000074970000-0x0000000074F1B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c01e2beaf749cb3adf82fdc48f03a6ea
SHA1 55e7eccaeb91c3fd6fe11dada7b908fab873e908
SHA256 fd23f5aa5d36e9b4f682f5e235adf3216994f449b6f813060319757f819586c4
SHA512 18c587f0da748089ebdfe0dbadf28b5e01e1d9e49f7cec698bfba00a07bb5710bc8a5ef85c09e251bb9829e6d52cc468f9c8c456b95076ae090e5880671b30d5

C:\Users\Admin\AppData\Local\Temp\Cab1767.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2724-43-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/2724-44-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/1528-45-0x0000000000080000-0x0000000000097000-memory.dmp

memory/2724-58-0x0000000074970000-0x0000000074F1B000-memory.dmp

memory/1528-55-0x0000000000080000-0x0000000000097000-memory.dmp

memory/1528-52-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1528-50-0x0000000000080000-0x0000000000097000-memory.dmp

memory/1528-51-0x0000000000080000-0x0000000000097000-memory.dmp

memory/1528-48-0x0000000000080000-0x0000000000097000-memory.dmp

memory/1528-47-0x0000000000080000-0x0000000000097000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 01:53

Reported

2024-10-31 01:55

Platform

win10v2004-20241007-en

Max time kernel

107s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"

Signatures

Remcos

rat remcos

Remcos family

remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2128 set thread context of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 468 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 468 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 468 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
PID 2128 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Processes

C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe

"C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/468-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

memory/468-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/468-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/468-5-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/468-6-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/468-19-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/468-18-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

MD5 d179fc499f2a69c56bef590bc7d4cbfd
SHA1 c8547d79da66e25ca291e71b8331764931f34083
SHA256 93fd6290a6b69d69a9074f596cf2ae553e741e4be51adcec7733f4ca46249c2d
SHA512 551ddf99f0e28a9f703a792bf83fa3a6b2c5c8840a75b5e4d85dec0bc8698569c1af5e84eb8d68131feb1bf0f801fb645f59222dbec14f1ae4b2fb03b8546d9d

memory/468-30-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/2128-31-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/2128-32-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/2128-34-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/2128-33-0x0000000074EF0000-0x00000000754A1000-memory.dmp

memory/1308-37-0x0000000000540000-0x0000000000557000-memory.dmp

memory/2128-41-0x0000000074EF0000-0x00000000754A1000-memory.dmp