MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a11c83839b1379e794a24659adf6dd9515f5581c24e97aca7fe1f3fa19ce0d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a11c83839b1379e794a24659adf6dd9515f5581c24e97aca7fe1f3fa19ce0d6
SHA3-384 hash: 6927dd47e64970ec2f2609844b332775f5eb35d7fb5d518c98c45bc5dd0c5bf4a26229f6d55d7f8976773aa115ecda2f
SHA1 hash: a35b12f8a491dd01ff08118d12a8d795050becda
MD5 hash: 87282302229729369469ccd9a5addd6b
humanhash: harry-march-july-king
File name:Nuevo pedido _WJO-001.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:704'144 bytes
First seen:2021-05-17 06:01:38 UTC
Last seen:2021-05-17 20:12:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 98797fd290714fe0ff53f2e52217b1bd (2 x RemcosRAT, 2 x ParallaxRAT)
ssdeep 12288:1t6OQVbhOJAtV1ATM6/sLypTemDOVo3N+sm4PJd6nIFg:fPUhOJAtvATn/RTeCEaN2436l
Threatray 359 similar samples on MalwareBazaar
TLSH FAE48DE663D14C73D02E1E798C1B92646D26BD203D28547676F93D089F79AC03C2B6AF
Reporter lowmal3
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Nuevo pedido _WJO-001.exe
Verdict:
Malicious activity
Analysis date:
2021-05-17 06:02:41 UTC
Tags:
installer rat remcos keylogger
Link:
https://app.any.run/tasks/f8455cda-4474-49d4-bb1c-8f3adc618949

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Launching a process
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/783296
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files to the user root directory
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 415692 Sample: Nuevo pedido _WJO-001.exe Startdate: 17/05/2021 Architecture: WINDOWS Score: 100 61 poiarmex247.ddns.net 2->61 81 Found malware configuration 2->81 83 Malicious sample detected (through community Yara rule) 2->83 85 Multi AV Scanner detection for dropped file 2->85 87 5 other signatures 2->87 12 Nuevo pedido _WJO-001.exe 1 25 2->12         started        17 Tzhlrd.exe 16 2->17         started        19 Tzhlrd.exe 16 2->19         started        signatures3 process4 dnsIp5 65 onedrive.live.com 12->65 73 2 other IPs or domains 12->73 51 C:\Users\Public\Tzhlrd\Tzhlrd.exe, PE32 12->51 dropped 53 C:\Users\Public53etplwiz.exe, PE32+ 12->53 dropped 55 C:\Users\Public55ETUTILS.dll, PE32+ 12->55 dropped 103 Writes to foreign memory regions 12->103 105 Creates a thread in another existing process (thread injection) 12->105 107 Injects a PE file into a foreign processes 12->107 21 cmd.exe 1 12->21         started        23 dialer.exe 2 3 12->23         started        67 192.168.2.1 unknown unknown 17->67 69 onedrive.live.com 17->69 75 2 other IPs or domains 17->75 109 Multi AV Scanner detection for dropped file 17->109 111 Allocates memory in foreign processes 17->111 27 secinit.exe 17->27         started        71 onedrive.live.com 19->71 77 2 other IPs or domains 19->77 29 DpiScaling.exe 19->29         started        file6 signatures7 process8 dnsIp9 31 cmd.exe 5 21->31         started        35 conhost.exe 21->35         started        63 poiarmex247.ddns.net 79.134.225.7, 49725, 49728, 49730 FINK-TELECOM-SERVICESCH Switzerland 23->63 89 Contains functionality to steal Chrome passwords or cookies 23->89 91 Contains functionality to inject code into remote processes 23->91 93 Contains functionality to steal Firefox passwords or cookies 23->93 95 Delayed program exit found 23->95 signatures10 process11 file12 57 C:\Windows \System3257etplwiz.exe, PE32+ 31->57 dropped 59 C:\Windows \System3259ETUTILS.dll, PE32+ 31->59 dropped 79 Drops executables to the windows directory (C:\Windows) and starts them 31->79 37 Netplwiz.exe 31->37         started        39 conhost.exe 31->39         started        signatures13 process14 process15 41 cmd.exe 1 37->41         started        signatures16 97 Suspicious powershell command line found 41->97 99 Adds a directory exclusion to Windows Defender 41->99 44 powershell.exe 27 41->44         started        47 conhost.exe 41->47         started        process17 signatures18 101 DLL side loading technique detected 44->101 49 conhost.exe 44->49         started        process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a11c83839b1379e794a24659adf6dd9515f5581c24e97aca7fe1f3fa19ce0d6/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-05-17 06:02:10 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tii4qobzwe3z46kkerszvx3n3fiv6vmbyjhjplfh7ypt7im44dla._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0a049a6f200348e229ebaa13728cd0d19de4839c741d4faec3dd64207860153d
RemcosRAT
2e928af33de11fedaf5d0c388e96ac67509b64bd445a3f4a576f46ec2a0d5374
RemcosRAT
40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade
RemcosRAT
46d5443a4f41fb67709a7f323f12a2835d22167bb06447c72b9c5115fbd8a028
RemcosRAT
4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095
RemcosRAT
4fa4ab75bd8f5439907cadec8c16b8e006045e73bc45adbbd5ab368b20cf2c5f
RemcosRAT
7863e8d94d7f595345e13ed45b8600c86d3a8bea389ca25950dfae8a9d94195a
RemcosRAT
8acdca153a4e16a5ff668a0a5ad8c274d2307a88cda385575ee4fbb8374d2254
RemcosRAT
a2bbd3bc733fb3addfb364d282edcb686292889b5850fa3c913ddc287745ed4e
RemcosRAT
c3ce62a44812edeca97182d5f26639b222ebe684021e7a7b922a499bd32d7f95
RemcosRAT
+ 349 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos persistence rat trojan
Link:
https://tria.ge/reports/210517-h3qrajcfxa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
poiarmex247.ddns.net:8634
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a11c83839b1379e794a24659adf6dd9515f5581c24e97aca7fe1f3fa19ce0d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_56f008e69a7c4c3feb389c66eaf58259
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:MALWARE_Win_DLAgent07
Create hunting rule
Author:ditekSHen
Description:Detects delf downloader agent

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 9a11c83839b1379e794a24659adf6dd9515f5581c24e97aca7fe1f3fa19ce0d6

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-17 07:06:09 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
2) [F0002.002] Collection::Polling
4) [C0026.002] Data Micro-objective::XOR::Encode Data
6) [C0049] File System Micro-objective::Get File Attributes
7) [C0051] File System Micro-objective::Read File
8) [C0052] File System Micro-objective::Writes File
9) [E1510] Impact::Clipboard Modification
10) [C0007] Memory Micro-objective::Allocate Memory
11) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
12) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
13) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
14) [C0038] Process Micro-objective::Create Thread
15) [C0041] Process Micro-objective::Set Thread Local Storage Value
16) [C0018] Process Micro-objective::Terminate Process