remcos | af546dfa96da5ae43eac5a07a6639c3a420348d7029d279d20ec233b0003f470

General

Target

01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe
Size

132KB
MD5

01ae33c89615b8823ed30a3d9647b4b8
SHA1

23f589b6c81552cf693b0a5367f244085a169b5b
SHA256

af546dfa96da5ae43eac5a07a6639c3a420348d7029d279d20ec233b0003f470
SHA512

895723248fd83af42590924033024ba5c5f7866f5a60160f4d7592fde6bdc8cf0f95cd279d5de4d8a252fbc3dba23524aa7396dd396f1c9cf940678c2b207519
SSDEEP

1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKe:xPd4n/M+WLcilrpgGH/GwY87mVmIXxI

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

systemcontrol.ddns.net:45000

systemcontrol2.ddns.net:45000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
OfficeUpgrade.exe
copy_folder
OfficeUpgrade
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
Upgrader.dat
keylog_flag
false
keylog_folder
Upgrader
keylog_path
%AppData%
mouse_option
false
mutex
req_khauflaoyr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
OfficeUpgrade
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

wn2ra4ohzdr.exewn2ra4ohzdr.exe

pid process

3416 wn2ra4ohzdr.exe
4156 wn2ra4ohzdr.exe

pid	process
3416	wn2ra4ohzdr.exe
4156	wn2ra4ohzdr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe"	01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wn2ra4ohzdr.exe

description pid process target process

PID 3416 set thread context of 4156 3416 wn2ra4ohzdr.exe wn2ra4ohzdr.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wn2ra4ohzdr.exe

pid process

4156 wn2ra4ohzdr.exe

description	pid	process	target process
PID 3416 set thread context of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe

pid	process
4156	wn2ra4ohzdr.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exewn2ra4ohzdr.exe

description	pid	process	target process
PID 4828 wrote to memory of 3416	4828	01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe	wn2ra4ohzdr.exe
PID 4828 wrote to memory of 3416	4828	01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe	wn2ra4ohzdr.exe
PID 4828 wrote to memory of 3416	4828	01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe
PID 3416 wrote to memory of 4156	3416	wn2ra4ohzdr.exe	wn2ra4ohzdr.exe

C:\Users\Admin\AppData\Local\Temp\01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01ae33c89615b8823ed30a3d9647b4b8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4828

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4156

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
Filesize
132KB

MD5
707324b2aac1187e294571b16fcf6c6b

SHA1
57c6ef83e7dd33f87ee019e9a4b735cb5394d753

SHA256
f6fa3561b9dcb0a178a37832be6070ba3164aa0689cb32c7f9961a8d5454874a

SHA512
3b191591cccdce1628f66c593e7920e7edf8640ea7b9b57a5988c67386d777ebc3eb93cd361798c318be32562c4d1729b74c243b3b3caf6e89b88a88d9ff942a

Download Submit
memory/3416-36-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3416-21-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3416-22-0x00000000048D0000-0x00000000048E0000-memory.dmp

Filesize
64KB

Download
memory/4156-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4156-32-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4156-30-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4156-29-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4156-26-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4156-25-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4156-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4828-4-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/4828-20-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4828-6-0x0000000004D70000-0x0000000004D90000-memory.dmp

Filesize
128KB

Download
memory/4828-5-0x0000000004C10000-0x0000000004C1A000-memory.dmp

Filesize
40KB

Download
memory/4828-0-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4828-3-0x0000000004B50000-0x0000000004BE2000-memory.dmp

Filesize
584KB

Download
memory/4828-2-0x00000000051F0000-0x0000000005794000-memory.dmp

Filesize
5.6MB

Download
memory/4828-1-0x0000000000190000-0x00000000001B8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads