Remcos is a commercial remote administration tool that criminals use as a RAT. The sample I looked at came from a phishing campaign that imitated a bank's executive remittance notice.
Chain
EML attachment: encrypted XLS (the password is in the mail)
-> macro writes and runs QAITB.vbs
-> VBS builds a PowerShell command (written reversed to confuse readers)
-> downloads harvest.vbs
-> self-deleting; copies itself into Startup; fetches pit.txt
-> pit.txt is encoded; decoded in PowerShell ISE
-> checks connectivity by pinging google.com
-> downloads kif.jpg (final payload)
-> PowerShell IEX runs it
-> Remcos injected into RegAsm.exe
The ping to a well-known host only exists to check internet access before the next C2 call.
A later variant
The workbook dropped a VBS file whose downloader address was stored as hexadecimal bytes. Converting them to ASCII revealed the link; the downloaded text file held a PowerShell script that fetched a PNG and ultimately delivered the same agent.
xls -> vbs -> ps1
Final payload
The last stage contains the Remcos agent initialisation. It starts through RegAsm.exe (a .NET registration tool), so the malicious code hides inside a Microsoft binary.
Network
C2 hostnames were registered under a dynamic DNS provider. Three used in this campaign:
shiestynerd[.]dvrlists[.]com
breakingsecurity[.]dvrlists[.]com
freshdirect[.]dvrlists[.]com
Checks
- RegAsm.exe or RegSvcs.exe with outbound traffic.
- VBS files created by Office, then copied to the Startup folder.
- Ping to a public host right after a script download.