remcos | 21f9efa2dc23445571bc45df18b359a12282e44af4f33fcdb5b2ced6df8b9db5

General

Target

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
Size

1.4MB
MD5

f28a8b7fc8c60cb1327b4983a5bf7816
SHA1

ff32ef5aca0a1005ad1871205bf33a1b4a9a6fbd
SHA256

21f9efa2dc23445571bc45df18b359a12282e44af4f33fcdb5b2ced6df8b9db5
SHA512

d240e93296aa32091bd7e15fc4b7c58a8296c1f169dcbe2123fe10ba1f041ac19a14a898ce24417f654c11315fd8226a8cc2f5239094d5be309d9ee9bbe4ab34
SSDEEP

24576:g/Vq04F2xa0yetrA9XFfCRtCtqTbVzPNC+ydQDhgCDCwYXX0YNIc/IFP898uEwN5:6w2LrqVC2tebVzVC+ydQdgCDKUE393N5

Score

10^/10

remcos zgrat remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.1.3 Pro

Botnet

RemoteHost

C2

duck50501.hopto.org:50501

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-QZ529O
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2124-0-0x0000000000C20000-0x0000000000D96000-memory.dmp	family_zgrat_v1

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2124-5-0x00000000004C0000-0x00000000004D2000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description	pid	process	target process
PID 2124 set thread context of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2484 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

pid process

2124 f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2124 f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

pid	process
2484	schtasks.exe

pid	process
2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\irAyyl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6D8.tmp"
2⤵
- Creates scheduled task(s)
PID:2484

C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe"
2⤵
PID:2516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC6D8.tmp
Filesize
1KB

MD5
6b9f9c1e9507a98f0ad9af425c6e9d33

SHA1
7474e1c18d9857c2f4f22eb23b8d5d386a728967

SHA256
2a512ec27509e45132dfb3425838229c84bac8409e07a6cab42898f33b263325

SHA512
74d41d92ce5f4ee197192f31cc79fb28941f2649f926d974a9f41a31c8d9122b4aa1ed985093c154bfc6e709db18071472fbb635add1c48be13b90707893992f

Download Submit
memory/2124-1-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-0-0x0000000000C20000-0x0000000000D96000-memory.dmp

Filesize
1.5MB

Download
memory/2124-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2124-2-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2124-4-0x0000000005340000-0x0000000005472000-memory.dmp

Filesize
1.2MB

Download
memory/2124-5-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2124-6-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-7-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2124-8-0x0000000005B00000-0x0000000005BC0000-memory.dmp

Filesize
768KB

Download
memory/2124-9-0x0000000005D00000-0x0000000005D78000-memory.dmp

Filesize
480KB

Download
memory/2124-36-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-17-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-21-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-23-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-25-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-27-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-29-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-19-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-33-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-35-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-15-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-38-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-37-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2516-39-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

description	pid	process	target process
PID 2124 wrote to memory of 2484	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 2124 wrote to memory of 2484	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 2124 wrote to memory of 2484	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 2124 wrote to memory of 2484	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 2124 wrote to memory of 2516	2124	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads