remcos | d338f6946cd36d7d216945bf63e07ed0cda1983a2296b6f4f1a8b4e9a892346a

General

Target

f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
Size

1.3MB
MD5

f1a4ef4fbce540f67061dbe829ceb5d3
SHA1

44fcab47b0ccc49ff0ede26322abcf977ab9e204
SHA256

d338f6946cd36d7d216945bf63e07ed0cda1983a2296b6f4f1a8b4e9a892346a
SHA512

597c2202d8edd7d33a97497ad4ae90e5419d6cc96a99849cc153dd203be711d46ffe251cd333ea13434dc69f548fe61b11b3219c036ba45e148d45abe1e3a488
SSDEEP

24576:aWOUJmUty0V17eIKZh7UgwcEU0JYxi4WMq:aWlJmCvhiw1HYxi9Mq

Score

10^/10

remcos remotehost agilenet rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

RemoteHost

C2

wealthlyblessed.ddns.net:39200

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-83QLZO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4872-7-0x0000000006E80000-0x0000000006EA8000-memory.dmp	agile_net
behavioral2/memory/4872-10-0x0000000005540000-0x0000000005550000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

description	pid	process	target process
PID 4872 set thread context of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

pid process

4872 f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
4872 f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4872 f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

pid process

4148 f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

pid	process
4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

pid	process
4148	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

description	pid	process	target process
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
PID 4872 wrote to memory of 4148	4872	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe	f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872

C:\Users\Admin\AppData\Local\Temp\f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1a4ef4fbce540f67061dbe829ceb5d3_JaffaCakes118.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
148B

MD5
66062e00f7ffb74d10b3d2a84f927440

SHA1
54e5098aeebf8b83fa8c995813a87e5746473827

SHA256
ceffb8888b728269178211077567b1312c8a0f8a98ed0852da1a442a28eebeb3

SHA512
2305f242d52231b9567befe4bac9b959f2017fbea09b1b316a0f270a10784a2b2da71f93e65e6eb44a7478266dac7fa75b6a8ce8406193496fa2b65f9d72163a

Download Submit
memory/4148-13-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4148-26-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4148-21-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4148-20-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4148-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4148-16-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4148-15-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4872-10-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/4872-17-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/4872-0-0x0000000000A70000-0x0000000000BB8000-memory.dmp

Filesize
1.3MB

Download
memory/4872-11-0x0000000007AB0000-0x0000000007AC4000-memory.dmp

Filesize
80KB

Download
memory/4872-12-0x000000000A0E0000-0x000000000A0E6000-memory.dmp

Filesize
24KB

Download
memory/4872-8-0x0000000006F30000-0x0000000006F96000-memory.dmp

Filesize
408KB

Download
memory/4872-7-0x0000000006E80000-0x0000000006EA8000-memory.dmp

Filesize
160KB

Download
memory/4872-9-0x0000000006EF0000-0x0000000006F12000-memory.dmp

Filesize
136KB

Download
memory/4872-6-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/4872-5-0x0000000005740000-0x0000000005A94000-memory.dmp

Filesize
3.3MB

Download
memory/4872-4-0x00000000056A0000-0x000000000573C000-memory.dmp

Filesize
624KB

Download
memory/4872-3-0x0000000005560000-0x00000000055F2000-memory.dmp

Filesize
584KB

Download
memory/4872-2-0x0000000005B10000-0x00000000060B4000-memory.dmp

Filesize
5.6MB

Download
memory/4872-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads