remcos | f34d0fc179176e79df5d07f006a1dc5627b2ec79a87b45c5599963eb6cb0d09a

General

Target

ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.exe
Size

1.7MB
MD5

ef845fe1ff4db32be6636d5a97f2199e
SHA1

bc574543770d13c353598e2331c99dca06f63432
SHA256

f34d0fc179176e79df5d07f006a1dc5627b2ec79a87b45c5599963eb6cb0d09a
SHA512

8bc31cd79b6cb6d4950fde1fd1f7e06dceea69d2f2430a94ebf4a15c8059838b41ecff360f7198d711c66308e34ba0efa02e1cd2d33ef145448bf8c41fec63f5
SSDEEP

49152:0Z/JOew+by5HTXHJWFUrUrFvXAmUn6hRvIDtl+nQLB54shSvzsXLa:0Z/JVw+ITw9FYmUn69IDSnQLBPhrba

Score

10^/10

remcos host persistence rat upx

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

185.140.53.37:1900

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_ewbkendenhpkpep
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

test.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation test.exe
Executes dropped EXE 4 IoCs

Processes:

test.exetest.exeremcos.exeremcos.exe

pid process

212 test.exe
1896 test.exe
4776 remcos.exe
2104 remcos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation	test.exe

pid	process
212	test.exe
1896	test.exe
4776	remcos.exe
2104	remcos.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4076-0-0x0000000000400000-0x0000000000780000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\test.exe	upx
behavioral2/memory/212-5-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/212-11-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral2/memory/4076-18-0x0000000000400000-0x0000000000780000-memory.dmp	upx
behavioral2/memory/4776-32-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

test.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

test.exeremcos.exe

description pid process target process

PID 212 set thread context of 1896 212 test.exe test.exe
PID 4776 set thread context of 2104 4776 remcos.exe remcos.exe
Drops file in Windows directory 2 IoCs

Processes:

test.exe

description ioc process

File created C:\Windows\remcos\remcos.exe test.exe
File opened for modification C:\Windows\remcos\remcos.exe test.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3320 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

test.exeremcos.exe

pid process

212 test.exe
212 test.exe
4776 remcos.exe
4776 remcos.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

test.exeremcos.exe

pid process

212 test.exe
4776 remcos.exe

description	pid	process	target process
PID 212 set thread context of 1896	212	test.exe	test.exe
PID 4776 set thread context of 2104	4776	remcos.exe	remcos.exe

description	ioc	process
File created	C:\Windows\remcos\remcos.exe	test.exe
File opened for modification	C:\Windows\remcos\remcos.exe	test.exe

pid	process
3320	PING.EXE

pid	process
212	test.exe
212	test.exe
4776	remcos.exe
4776	remcos.exe

pid	process
212	test.exe
4776	remcos.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.execmd.exetest.exetest.execmd.exeremcos.exe

description	pid	process	target process
PID 4076 wrote to memory of 1948	4076	ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.exe	cmd.exe
PID 4076 wrote to memory of 1948	4076	ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.exe	cmd.exe
PID 4076 wrote to memory of 1948	4076	ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.exe	cmd.exe
PID 1948 wrote to memory of 212	1948	cmd.exe	test.exe
PID 1948 wrote to memory of 212	1948	cmd.exe	test.exe
PID 1948 wrote to memory of 212	1948	cmd.exe	test.exe
PID 212 wrote to memory of 1896	212	test.exe	test.exe
PID 212 wrote to memory of 1896	212	test.exe	test.exe
PID 212 wrote to memory of 1896	212	test.exe	test.exe
PID 1896 wrote to memory of 3344	1896	test.exe	cmd.exe
PID 1896 wrote to memory of 3344	1896	test.exe	cmd.exe
PID 1896 wrote to memory of 3344	1896	test.exe	cmd.exe
PID 3344 wrote to memory of 3320	3344	cmd.exe	PING.EXE
PID 3344 wrote to memory of 3320	3344	cmd.exe	PING.EXE
PID 3344 wrote to memory of 3320	3344	cmd.exe	PING.EXE
PID 3344 wrote to memory of 4776	3344	cmd.exe	remcos.exe
PID 3344 wrote to memory of 4776	3344	cmd.exe	remcos.exe
PID 3344 wrote to memory of 4776	3344	cmd.exe	remcos.exe
PID 4776 wrote to memory of 2104	4776	remcos.exe	remcos.exe
PID 4776 wrote to memory of 2104	4776	remcos.exe	remcos.exe
PID 4776 wrote to memory of 2104	4776	remcos.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef845fe1ff4db32be6636d5a97f2199e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c test.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:212

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
6⤵
- Runs ping.exe
PID:3320

C:\Windows\remcos\remcos.exe
"C:\Windows\remcos\remcos.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\remcos\remcos.exe
"C:\Windows\remcos\remcos.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2104

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat
Filesize
79B

MD5
e31c5298e512a57c08e540781b438406

SHA1
518d7fceb915e513207e90e9881f732b38cdaddc

SHA256
90c22d29540b16f794cd58a9153c03dd96a0541851f875b549273c2ffdc63a36

SHA512
828530316d7fce6f44b91f026878b0d46cc55a4d8cb6d5c2aa7e7d1f00b3f442578acd1b2ed1199b1ca70177bf08a3ed235508aa0bedfe079d13349c1619e8b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
402KB

MD5
36184baad191dcb3f2d077119535109a

SHA1
3fd953cdb314408845bbd587b77eb47c1db31720

SHA256
b47adb5a41cc1bfa622199a3e3a5213ab6668f32028fa0ecaa95b383597e1c0e

SHA512
fe049d0623c23a68b6a7d8efbdb935365bbc597998feb5cc6d089c202bcd37f24b45c64edc5370b05f67542efd544937d049551f6a085b1fae2afcb3f7277e98

Download Submit
memory/212-5-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/212-6-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/212-11-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/212-9-0x00000000007A0000-0x00000000007AB000-memory.dmp

Filesize
44KB

Download
memory/212-12-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/1896-22-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1896-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1896-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1896-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-41-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-39-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-48-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-47-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-33-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-34-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-35-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-36-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-37-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-38-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-45-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-40-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-44-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-42-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2104-43-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4076-0-0x0000000000400000-0x0000000000780000-memory.dmp

Filesize
3.5MB

Download
memory/4076-18-0x0000000000400000-0x0000000000780000-memory.dmp

Filesize
3.5MB

Download
memory/4776-32-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4776-31-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/4776-27-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads