Remcos RAT checking for geolocation through web
Remcos Rat Checking For Geolocation
Query
// Define browser executable filenames
let Browser = dynamic(["firefox.exe", "msedge.exe", "chrome.exe", "opera.exe", "brave.exe"]);
DeviceNetworkEvents
// Define timeframe
| where TimeGenerated > ago(30d)
| where not(InitiatingProcessFileName in (['Browser']))
// Define service used to locate geographical information
| where RemoteUrl contains 'geoplugin.net'
| project Timestamp, DeviceName, LocalIP, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessAccountUpn
| sort by Timestamp descAbout this query
Explanation
This query checks for attempts to connect to the website geoplugin[.]net by non-browser applications. It looks for instances where a Remcos RAT payload installed by ModiLoader checks for geolocation through the web. The query can be modified to fit different environments and browsers used. It provides information such as the timestamp, device name, local IP, remote URL, remote IP, remote port, initiating process file name, and initiating process account UPN. The query is useful for detecting potential malicious activity related to geolocation checks.
