-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – svchost Injection via Native API Calls

The following Binary Ninja snippet reveals the core injection mechanism used by Remcos to inject its payload into svchost.exe.

What This Code Does:

• CreateProcessW with the CREATE_SUSPENDED flag starts a new svchost process in a suspended state.
• VirtualAlloc allocates memory inside the target process using MEM_COMMIT and PAGE_READWRITE flags, allowing the payload to be written directly into the process memory.
• WriteProcessMemory writes the payload into the allocated memory region of the suspended svchost process.
• ReadProcessMemory reads the target process's memory, likely to retrieve the original entry point or to validate the injection.
• TerminateProcess is used to terminate the suspended svchost process if the injection fails, preventing it from being left in an unstable state.

Why This Matters:

Visual Reference:

Binary Ninja view of Remcos' injection routine using Native APIs, showing MEM_COMMIT, PAGE_READWRITE, ReadProcessMemory, and TerminateProcess.

2. Registry Persistence – Remcos Persistence Mechanism

Remcos adds a key to the Windows registry to establish a permanent presence on the system. This key ensures the malware re-executes every time the system starts up.

Detected Registry Key:

HKEY_USERS\S-1-5-21-3807688912-2840792520-522192237-1001\Software\kamolprf-CFKPWC

Values ​​Within the Key:

Why Is This Important?

• Persistence: Thanks to this key, Remcos runs automatically whenever the system boots up.
• Stealth: Since the exepath value is stored as REG_BINARY, it cannot be read directly. This makes detection more difficult. - Identity: The UID and licence values ​​allow the attacker to identify the victim and perform a license check.
• Timestamp: The time value provides information about when the malware was installed or last executed.

Visual Reference:

*Registry keys and the exepath, licence, time, and UID values ​​within them.

3. Svchost – Trampoline & API Hook Detection (WinDbg)

The following WinDbg snippet shows a trampoline function found inside the injected svchost.exe process. This code appears to be part of Remcos' API hooking or payload execution mechanism.

What This Code Does:

• jmp qword ptr [svchost+0x9758] – Likely a hook or trampoline jumping to an API or function.
• mov / movdqa instructions – Save and restore registers (xmm0-xmm3, rcx, rdx, r8, r9) to preserve the calling context.
• call svchost+0x3e50 – Calls a core function, possibly part of the payload or hook handler.
• jmp rax – Final jump to the original function or next stage.
• INT3 traps – Anti-debugging instructions to break execution if a debugger is attached.

Why This Matters:

This structure is typical of API hooking or detour functions, where Remcos intercepts calls to critical Windows APIs. The use of xmm registers (for floating-point or SIMD operations) suggests this hook may be placed on functions that use SSE instructions.

Visual Reference:

WinDbg view of the trampoline function inside svchost.exe, showing jmp and call instructions with INT3 traps.

4. Svchost – Obfuscated Hex Payload (Binary Ninja)

The following hex dump was extracted from a PAGE_READWRITE memory region inside the injected svchost.exe process. This region does not contain any direct call or jmp instructions, confirming that the data is not executable code but rather an obfuscated or encrypted payload.

Key Observations:

• The hex block consists of seemingly random bytes, with no clear disassembly structure.
• Despite the obfuscation, recognizable strings such as RPC Control and PC- are embedded within the data.
• Additional fragments like ctk, m, and mafasakaaam appear to be part of a structured configuration, possibly containing encryption keys, API names, or registry paths.
• The presence of these strings aligns with known Remcos obfuscation patterns, where configuration data is XOR-encrypted and embedded in memory.

Visual Reference:

Binary Ninja view of the obfuscated hex dump from svchost.exe's PAGE_READWRITE region, showing embedded strings like RPC Control and PC-.

5. Svchost – Obfuscated Hex Payload (Binary Ninja Strings View)

The obfuscated hex payload extracted from the PAGE_READWRITE region was further analyzed using Binary Ninja's string view. Despite the heavy obfuscation, several readable strings and patterns emerged.

Key Observations:

• PC- prefixed strings (e.g., PC-475ce3d749612b, PC-4a757962f31b84) – Likely MachineGuid or unique system identifiers used for victim tracking.
• svchost.exe – The target process name, confirming the injection vector.
• .dll extensions – Indicate that Remcos either loads or searches for specific DLLs, possibly for API hooking or persistence.
• ontroll\ – Likely a fragment of a registry path (Control\), indicating persistence or configuration storage.
• EEF931 and 1AA81C6FD0CF04A816B – These appear to be GUIDs or encryption keys, possibly used for XOR/AES decryption of the payload.
• TEMP – Suggests temporary file creation or execution from the temp directory.

Visual Reference:

Binary Ninja strings view of the obfuscated hex payload, showing readable fragments like PC-, svchost.exe, .dll, and EEF931.

Conclusion

This analysis uncovered a highly sophisticated, fileless variant of Remcos RAT that operates with minimal disk footprint and advanced evasion techniques. The malware injects its core payload into svchost.exe using Native API calls such as ZwCreateSection and ZwMapViewOfSection, ensuring persistence and stealth.

Key Takeaways:

• Fileless Execution: Remcos runs entirely in memory, leaving no executable file on disk.
• Svchost Injection: The payload is injected into a trusted Windows process, making detection difficult.
• Obfuscated Payload: The injected code is heavily obfuscated, preventing static analysis and revealing only fragmented strings like PC-, svchost.exe, .dll, and EEF931.
• Registry Persistence: Remcos maintains persistence via registry keys under HKEY_USERS\...\Software\kamolprf-CFKPWC, storing encrypted exepath, licence, time, and UID values.
• API Hooking & Trampolines: The malware hooks critical Windows APIs, intercepting function calls to redirect execution flow.
• Additional Capabilities: Clipboard monitoring, UAC bypass, and potential credential harvesting were also observed.

Detection Recommendations:

• Monitor svchost.exe for abnormal memory regions (PAGE_READWRITE).
• Track registry keys under Software\kamolprf-CFKPWC.
• Look for ZwCreateSection and ZwMapViewOfSection calls originating from non-system processes.
• Analyze process memory for obfuscated strings like PC- and EEF931.

Final Thoughts

This Remcos variant demonstrates a high level of professionalism and is clearly designed to evade traditional security solutions. Its combination of fileless execution, process injection, and registry-based persistence makes it a significant threat that requires advanced detection strategies.

Tools Used: Ghidra, Binary Ninja, WinDbg, Process Hacker

Sample Information

Sample Download

The analyzed Remcos RAT sample is available on MalwareBazaar for those who wish to conduct their own analysis:

🔗 Remcos RAT Sample on MalwareBazaar