Detecting indicators of Remcos RAT malware
Malware attacks sometimes begin with a phishing email that contains a malicious macro code or malicious URL link that downloads either the actual loader or the next stager to download the actual payload. Malware loader scripts are very flexible in terms of updates, encryption, and code obfuscation to bypass detections. The most prevalent loaders are window scripting languages, JScript (.js), and VBScript (.vbs).
Remcos, or Remote Control and Surveillance, is marketed as a legitimate software for remotely managing Windows systems. It is now widely used in malicious campaigns by threat actors. Remcos loader that utilizes DynamicWrapperX (dynwrapx.dll) to execute shellcode and inject Remcos RAT into the target process.
You need to design and deploy effective monitoring capabilities for Remcos exploitation activities, including searches that find file writes associated with its payload, screen capture, registry modification, UAC bypass, persistence, and data collection.
Data required
- Endpoint data
- Sysmon for Microsoft or Linux
How to use Splunk software for this use case
- Add or set Windows Defender exclusion
- Disabling remote user account control
- Executables or script creation in suspicious path
- Jscript execution using Cscript app
- Loading of Dynwrapx module
- Malicious InProcServer32 modification
- Non Chrome process accessing Chrome default dir
- Non Firefox process access Firefox profile dir
- Office document executing macro code
- Office product spawn CMD process
- Office product spawning Windows script host
- Possible browser pass view parameter
- Powershell Windows Defender exclusion commands
- Process deleting its process file path
- Process writing DynamicWrapperX
- Registry keys used for persistence
- Regsvr32 silent and install param Dll loading
- Regsvr32 with known silent switch Cmdline
- Remcos RAT file creation in Remcos folder
- Remcos client registry install entry
- Suspicious image creation in appdata folder
- Suspicious process DNS query known abuse web services
- Suspicious process file path
- Suspicious WAV file in appdata folder
- System info gathering using Dxdiag application
- Vbscript execution using Wscript app
- Windows Defender exclusion registry entry
- Windows ISO LNK file creation
- Windows phishing recent ISO exec registry
- Winhlp32 spawning a process
- Wscript or Cscript suspicious child process
Next steps
During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.
If your results indicate an attack has occurred, the host or computer where the vulnerability is detected needs to be further investigated and remediated according to your response plan. This involves a final step of re-imaging the system with a known good system build after investigation.
In addition, these Splunk resources might help you understand and implement this use case: