remcos | a6d4e2706d45af6be3a6bd264ac95d7b5e6e60dbbcbce01a498dd3b8f9ccb3f6

Modify Registry

T1112

Processes:

main.exeflutter.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	main.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	main.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	flutter.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	flutter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	iexplore.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

main.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation main.exe
Deletes itself 1 IoCs

Processes:

iexplore.exe

pid process

2224 iexplore.exe
Executes dropped EXE 1 IoCs

Processes:

flutter.exe

pid process

2132 flutter.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	main.exe

pid	process
2224	iexplore.exe

pid	process
2132	flutter.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

iexplore.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	iexplore.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

main.exeflutter.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	flutter.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	flutter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mot-P379YE = "\"C:\\Windows\\SysWOW64\\Flutter\\flutter.exe\""	main.exe

Drops file in System32 directory 3 IoCs

Processes:

main.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Flutter\flutter.exe	main.exe
File opened for modification	C:\Windows\SysWOW64\Flutter\flutter.exe	main.exe
File opened for modification	C:\Windows\SysWOW64\Flutter	main.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

flutter.exeiexplore.exe

description	pid	process	target process
PID 2132 set thread context of 2224	2132	flutter.exe	iexplore.exe
PID 2224 set thread context of 3580	2224	iexplore.exe	svchost.exe
PID 2224 set thread context of 1692	2224	iexplore.exe	iexplore.exe
PID 2224 set thread context of 3636	2224	iexplore.exe	iexplore.exe
PID 2224 set thread context of 4528	2224	iexplore.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

main.exeflutter.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flutter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Modifies registry class 1 IoCs

Processes:

main.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ main.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

flutter.exeiexplore.exeiexplore.exe

pid process

2132 flutter.exe
2132 flutter.exe
1692 iexplore.exe
1692 iexplore.exe
4528 iexplore.exe
4528 iexplore.exe
1692 iexplore.exe
1692 iexplore.exe
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

flutter.exeiexplore.exe

pid process

2132 flutter.exe
2224 iexplore.exe
2224 iexplore.exe
2224 iexplore.exe
2224 iexplore.exe
2224 iexplore.exe
2224 iexplore.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iexplore.exe

description pid process

Token: SeDebugPrivilege 4528 iexplore.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2224 iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	main.exe

pid	process
2132	flutter.exe
2132	flutter.exe
1692	iexplore.exe
1692	iexplore.exe
4528	iexplore.exe
4528	iexplore.exe
1692	iexplore.exe
1692	iexplore.exe

pid	process
2132	flutter.exe
2224	iexplore.exe
2224	iexplore.exe
2224	iexplore.exe
2224	iexplore.exe
2224	iexplore.exe
2224	iexplore.exe

description	pid	process
Token: SeDebugPrivilege	4528	iexplore.exe

pid	process
2224	iexplore.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

main.exeflutter.exeiexplore.exe

description	pid	process	target process
PID 3552 wrote to memory of 2132	3552	main.exe	flutter.exe
PID 3552 wrote to memory of 2132	3552	main.exe	flutter.exe
PID 3552 wrote to memory of 2132	3552	main.exe	flutter.exe
PID 2132 wrote to memory of 2224	2132	flutter.exe	iexplore.exe
PID 2132 wrote to memory of 2224	2132	flutter.exe	iexplore.exe
PID 2132 wrote to memory of 2224	2132	flutter.exe	iexplore.exe
PID 2132 wrote to memory of 2224	2132	flutter.exe	iexplore.exe
PID 2224 wrote to memory of 3580	2224	iexplore.exe	svchost.exe
PID 2224 wrote to memory of 3580	2224	iexplore.exe	svchost.exe
PID 2224 wrote to memory of 3580	2224	iexplore.exe	svchost.exe
PID 2224 wrote to memory of 3580	2224	iexplore.exe	svchost.exe
PID 2224 wrote to memory of 1984	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 1984	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 1984	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 1692	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 1692	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 1692	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 1692	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 60	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 60	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 60	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 3636	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 3636	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 3636	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 3636	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 4528	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 4528	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 4528	2224	iexplore.exe	iexplore.exe
PID 2224 wrote to memory of 4528	2224	iexplore.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\Flutter\flutter.exe
  "C:\Windows\SysWOW64\Flutter\flutter.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2132
- - \??\c:\program files (x86)\internet explorer\iexplore.exe
    "c:\program files (x86)\internet explorer\iexplore.exe"
    3⤵
    - Windows security bypass
    - Adds policy Run key to start application
    - Deletes itself
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3580
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fwynumjwtmyh"
      4⤵
      PID:1984
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fwynumjwtmyh"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1692
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hqdgnfuqhuqmfls"
      4⤵
      PID:60
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hqdgnfuqhuqmfls"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:3636
  - - \??\c:\program files (x86)\internet explorer\iexplore.exe
      "c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ssiqnxekvciyirodhq"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection