Trojan.Win32.REMCOS.EONJ

July 17, 2023
 Analysis by: John Rainier Navato
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

709,103 bytes

File Type:

EXE

Initial Samples Received Date:

13 Jul 2023

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\birkesenes.pac
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\ledvist.Roc157
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\radsaar.fri
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\rejekllingens.plo
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\annektere.uno
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\shivering.chr
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\torchman.not
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic\zapas.lys
  • %User Profile%\angelo\julebuffet\cosmoid\Aregeneratory\dovendyrets\Forbrugerbevidstes\Antithet.Erh
  • %User Temp%\{6-alphanumeric characters}.tmp\System.dll
  • %All Users Profile%\remcos\logs.dat
  • %User Temp%\{6-alphanumeric characters 1}.tmp
  • %User Temp%\{6-alphanumeric characters 2}.tmp
  • %Temporary Internet Files%\Content.IE5\YEFGVF95\json[1].gp

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

It adds the following processes:

  • {Malware File Path}\{Malware File Name}.exe

It creates the following folders:

  • %User Profile%\angelo\julebuffet\cosmoid\Aregeneratory\dovendyrets\Forbrugerbevidstes
  • %User Profile%\angelo\julebuffet\cosmoid\Kabinepersonalet125\Nonmaterialistic
  • %All Users Profile%\remcos
  • %User Temp%\{6-alphanumeric characters}.tmp

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
udkld
murray = 0x00000000

HKEY_CURRENT_USER\Software\Rmc-OB0RTV
exepath = {Hex Values}

HKEY_CURRENT_USER\Software\Rmc-OB0RTV
licence = {Hex Value}

HKCU\Software\Rmc-OB0RTV
time = {10-digit value}

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.52/IMBapQOoMPYrOmixJkLO29.bin
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.50
  • https://{BLOCKED}gin.net