remcos | 12d9f001d16635ca670e45cb584894b6c57f7d048cb8b615c619eb060c84eb2b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Size 1.1MB
Sample240504-zt42faeb99
SHA256 12d9f001d16635ca670e45cb584894b6c57f7d048cb8b615c619eb060c84eb2b
MD5 14775a14508a75a96e0f73691507971c
SHA1 2e556d4f74f2b4902ac07bfb4467a526ef37119a
SHA512 acef1f80b2defef843724afb0eab9363a78fa6e5c4b53c3069a81fd31df96bf6e7201eb7ed602835d21f44a0bf87634c565a85d741ce0f4b0c49e4c93f13d732
SSDEEP 24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaAke4JewldkqXZ5:Uh+ZkldoPK8YaAhqT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

RemoteHost

213.184.126.134:1337

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-RLVNOS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
872	remcos.exe
3376	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	remcos.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b000000023ba5-15.dat	autoit_exe
behavioral2/memory/1588-25-0x0000000000400000-0x0000000000524000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4400 set thread context of 4332	4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	88
PID 872 set thread context of 3376	872	remcos.exe	99
PID 3376 set thread context of 1588	3376	remcos.exe	100
PID 1588 set thread context of 3356	1588	iexplore.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
872	remcos.exe
872	remcos.exe
872	remcos.exe
1588	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
872	remcos.exe
872	remcos.exe
872	remcos.exe
1588	iexplore.exe
1588	iexplore.exe
1588	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3356	iexplore.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4332	4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	88
PID 4400 wrote to memory of 4332	4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	88
PID 4400 wrote to memory of 4332	4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	88
PID 4400 wrote to memory of 4332	4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	88
PID 4400 wrote to memory of 4332	4400	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	88
PID 4332 wrote to memory of 1608	4332	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	89
PID 4332 wrote to memory of 1608	4332	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	89
PID 4332 wrote to memory of 1608	4332	14775a14508a75a96e0f73691507971c_JaffaCakes118.exe	89
PID 1608 wrote to memory of 1840	1608	WScript.exe	94
PID 1608 wrote to memory of 1840	1608	WScript.exe	94
PID 1608 wrote to memory of 1840	1608	WScript.exe	94
PID 1840 wrote to memory of 872	1840	cmd.exe	96
PID 1840 wrote to memory of 872	1840	cmd.exe	96
PID 1840 wrote to memory of 872	1840	cmd.exe	96
PID 872 wrote to memory of 3376	872	remcos.exe	99
PID 872 wrote to memory of 3376	872	remcos.exe	99
PID 872 wrote to memory of 3376	872	remcos.exe	99
PID 872 wrote to memory of 3376	872	remcos.exe	99
PID 872 wrote to memory of 3376	872	remcos.exe	99
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 3376 wrote to memory of 1588	3376	remcos.exe	100
PID 1588 wrote to memory of 3356	1588	iexplore.exe	102
PID 1588 wrote to memory of 3356	1588	iexplore.exe	102
PID 1588 wrote to memory of 3356	1588	iexplore.exe	102
PID 1588 wrote to memory of 3356	1588	iexplore.exe	102
PID 1588 wrote to memory of 3356	1588	iexplore.exe	102

C:\Users\Admin\AppData\Local\Temp\14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14775a14508a75a96e0f73691507971c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\14775a14508a75a96e0f73691507971c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\14775a14508a75a96e0f73691507971c_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies WinLogon
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:872
      - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        6⤵
        Modifies WinLogon for persistence
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
MD5 ff449f6f7bc5e2d800eb30e2d2c56611
SHA1 93419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA512 02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 77def85cd2aab20815fd7c3a84b9702c44396b944e215af32c504e59836eb16f
MD5 1b3617438e1b9fea6c95e4e430904f45
SHA1 9a43484ff70d3c755840dbed4ddc5cf244cf1619
SHA512 3bc276da410e39eb6706288690e9178c3177875f40db31a17f28c320dc9a38a21003e558f1229900ca08690da8cbbd9de3a85bc4ea88b7297d651ac9f7c548a2
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 1.1MB
SHA256 12d9f001d16635ca670e45cb584894b6c57f7d048cb8b615c619eb060c84eb2b
MD5 14775a14508a75a96e0f73691507971c
SHA1 2e556d4f74f2b4902ac07bfb4467a526ef37119a
SHA512 acef1f80b2defef843724afb0eab9363a78fa6e5c4b53c3069a81fd31df96bf6e7201eb7ed602835d21f44a0bf87634c565a85d741ce0f4b0c49e4c93f13d732
SSDEEP 24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaAke4JewldkqXZ5:Uh+ZkldoPK8YaAhqT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1588-25-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/3376-24-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4332-1-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4332-8-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4400-0-0x0000000003460000-0x0000000003461000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads