remcos | 04a8ec81d470d779101a2a39ad5b801668cbec7f78176f89766fd966744a9c38

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
Size 186KB
Sample240429-rgpf8ach2v
SHA256 04a8ec81d470d779101a2a39ad5b801668cbec7f78176f89766fd966744a9c38
MD5 07d887ce0ba2736fa8fbc5139ad74c3d
SHA1 b818f67d4ac19b0c8fd2c167f4b48e188983a99d
SHA512 791df0198131e32ccf3ba4e18cd8612279e41d1223238222a589ce44614aa81bf8fe6d34fb9a6dc3d7c9126753e283df2d48107ae5cbb1a51a297bbd33a26056
SSDEEP 3072:xeJHgZQv2rZe6nPIkU79tlOOqJipg/jkFwhfbW10D39bDYKvNW:xebiBK9tld7KkSlg0r9bDJE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

79.172.242.28:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
xi3s.exe
copy_folder
xi3x
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%Temp%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-NL03Y0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
xi5w
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
3808	svhost.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
Token: 33	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87
PID 1748 wrote to memory of 3808	1748	07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07d887ce0ba2736fa8fbc5139ad74c3d_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:3808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 1.6MB
SHA256 e8b5da3394bbdd7868122ffd88d9d06afe31bd69d656857910d2f820c32d0efa
MD5 1c9ff7df71493896054a91bee0322ebf
SHA1 38f1c85965d58b910d8e8381b6b1099d5dfcbfe4
SHA512 aa0def62b663743e6c3c022182b35cff33cb9abf08453d5098f3c5d32b2a8b0cd1cc5de64b93e39680c1d1396fef1fd50b642ca3ea4ba1f6d1078321d96916ab
SSDEEP 24576:D2Jdi2osRvHJT8EZwpqy4JXxDsv6TRrgGdbG4VKMhyMvopZ:DMiQB8EZwmWv6TrGYXhyMvq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1748-0-0x00000000751D0000-0x0000000075781000-memory.dmp

Download

memory/1748-1-0x00000000751D0000-0x0000000075781000-memory.dmp

Download

memory/1748-2-0x0000000001700000-0x0000000001710000-memory.dmp

Download

memory/1748-12-0x00000000751D0000-0x0000000075781000-memory.dmp

Download

memory/3808-9-0x00000000001A0000-0x00000000001BB000-memory.dmp

Download