remcos | 21f9efa2dc23445571bc45df18b359a12282e44af4f33fcdb5b2ced6df8b9db5

General

Target

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
Size

1.4MB
MD5

f28a8b7fc8c60cb1327b4983a5bf7816
SHA1

ff32ef5aca0a1005ad1871205bf33a1b4a9a6fbd
SHA256

21f9efa2dc23445571bc45df18b359a12282e44af4f33fcdb5b2ced6df8b9db5
SHA512

d240e93296aa32091bd7e15fc4b7c58a8296c1f169dcbe2123fe10ba1f041ac19a14a898ce24417f654c11315fd8226a8cc2f5239094d5be309d9ee9bbe4ab34
SSDEEP

24576:g/Vq04F2xa0yetrA9XFfCRtCtqTbVzPNC+ydQDhgCDCwYXX0YNIc/IFP898uEwN5:6w2LrqVC2tebVzVC+ydQdgCDKUE393N5

Score

10^/10

remcos zgrat remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.1.3 Pro

Botnet

RemoteHost

C2

duck50501.hopto.org:50501

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-QZ529O
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4348-0-0x0000000000290000-0x0000000000406000-memory.dmp	family_zgrat_v1

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/4348-10-0x0000000005150000-0x0000000005162000-memory.dmp	CustAttr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description	pid	process	target process
PID 4348 set thread context of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4880 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

pid process

4348 f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4348 f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

pid	process
4880	schtasks.exe

pid	process
4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\irAyyl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp134.tmp"
2⤵
- Creates scheduled task(s)
PID:4880

C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe"
2⤵
PID:1740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp134.tmp
Filesize
1KB

MD5
04439eb1d059fcd915cf345971827668

SHA1
edb95c90c23bcfa3023f5b4e4506aa671c83c8e5

SHA256
57ac38f71f253a6d881bd82a303c130b361fc1ce9e3b7ea64ef932ec3b4f9cf8

SHA512
37363441b68223a0eb7318e36d6ee3a0954e35ca852c08f9e8ccc49bb7fbfe25d8a1138287eca529b47d13ea3abc0a54f96d23b94ef8e93667463e5a2df1c769

Download Submit
memory/1740-26-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1740-25-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1740-23-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1740-21-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1740-20-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4348-5-0x0000000005590000-0x0000000005B34000-memory.dmp

Filesize
5.6MB

Download
memory/4348-13-0x0000000006B70000-0x0000000006C30000-memory.dmp

Filesize
768KB

Download
memory/4348-8-0x00000000050D0000-0x0000000005126000-memory.dmp

Filesize
344KB

Download
memory/4348-9-0x0000000005200000-0x0000000005332000-memory.dmp

Filesize
1.2MB

Download
memory/4348-10-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4348-11-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/4348-12-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/4348-7-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Filesize
40KB

Download
memory/4348-14-0x0000000006C40000-0x0000000006CB8000-memory.dmp

Filesize
480KB

Download
memory/4348-6-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Filesize
584KB

Download
memory/4348-0-0x0000000000290000-0x0000000000406000-memory.dmp

Filesize
1.5MB

Download
memory/4348-4-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/4348-3-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/4348-24-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/4348-2-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

Filesize
624KB

Download
memory/4348-1-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download

description	pid	process	target process
PID 4348 wrote to memory of 4880	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 4348 wrote to memory of 4880	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 4348 wrote to memory of 4880	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	schtasks.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe
PID 4348 wrote to memory of 1740	4348	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe	f28a8b7fc8c60cb1327b4983a5bf7816_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads