remcos | 5d94b24f251b4fd9b9a59a3d60b86512528add9c95a880d8e32e76b1f54b8eea

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/04/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe
Size 1.1MB
Sample240407-c5p1bsbd97
SHA256 5d94b24f251b4fd9b9a59a3d60b86512528add9c95a880d8e32e76b1f54b8eea
MD5 e3ded559a419a2ffadc6d56fa4884a6f
SHA1 f720e9da8352f2f55c30716ed5f0a5df1dd9c5db
SHA512 89bc06cc26a4f839f8cb52dfea48b36a70d2071ff57bf6f36d1683c51d911321927acb7f7b4e7ac118a8368991802beb4d63a5ddece6e220acce803db6dea72b
SSDEEP 12288:IqTu8SiOOBCPWhbBKodreeALL/1ULV6SIFV9BIWca6KFi3mCeUhkvkJ5d1O:IqTutOBCP2rJALZkmlFcdKQp1R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

RemoteHost

172.111.234.10:8088

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-ANDQBQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2636	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2636	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	28
PID 1984 wrote to memory of 2636	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	28
PID 1984 wrote to memory of 2636	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	28
PID 1984 wrote to memory of 2636	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	28
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2604	1984	e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3ded559a419a2ffadc6d56fa4884a6f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XeTozECCRX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp98E5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2636
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp98E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp98E5.tmp
Size 1KB
SHA256 be7b32c1d7a9caae5ccef4cd54318acb3427143662b4b78c0c090c47fad59b59
MD5 e65c566553729bc6f398e62bb8c7267d
SHA1 2b10d77726aa58a7f88eb55bb48af1b5b50ae898
SHA512 c627941baf1c689858ed197033e6a51fdacc35b6a1a1db095aff552291fbb37f9ad40540af787b7b90039e5e6ce572d11a9d31f65159ad80c0299b102b4567ed
MD5 SHA1 SHA512

Submit Download

memory/1984-2-0x00000000007D0000-0x0000000000810000-memory.dmp

Download

memory/1984-1-0x0000000074120000-0x00000000746CB000-memory.dmp

Download

memory/1984-0-0x0000000074120000-0x00000000746CB000-memory.dmp

Download

memory/1984-3-0x0000000074120000-0x00000000746CB000-memory.dmp

Download

memory/1984-4-0x00000000007D0000-0x0000000000810000-memory.dmp

Download

memory/1984-22-0x0000000074120000-0x00000000746CB000-memory.dmp

Download

memory/2604-15-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-8-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-12-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-14-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-10-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-16-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2604-19-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-11-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-23-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-21-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-24-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-25-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-26-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-27-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2604-28-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads