remcos | f57baf38587fe0245e396c9b57664994be9a6f92e96d959fb251a6b7f00ddad5

General

Target

17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
Size

288KB
MD5

17aabf6d007520c94f8df8196c8066b6
SHA1

941456ee84371a09d11e4b15f3887f660e260d34
SHA256

f57baf38587fe0245e396c9b57664994be9a6f92e96d959fb251a6b7f00ddad5
SHA512

b78e80fe53080cfee4e75ac481f199243f68a6c662ff691604247fc06ae306ce65680b4f7d31e5f2d65795752508e6c1b63a1150a49a073d3adea57e72fb5cd9
SSDEEP

6144:AuBQ3fWB3qOyuBGrl3/8xhKqwX7oAGdb+bDt6GbkLgHp7Lm:AuielqAB0P5qMGmDtzALcp7

Score

10^/10

remcos zgrat remotehost agilenet rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.84.181.89:3363

185.84.181.89:3362

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-MRGC3E
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2336-3-0x0000000000390000-0x00000000003B8000-memory.dmp	family_zgrat_v1

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/2336-3-0x0000000000390000-0x00000000003B8000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

description	pid	process	target process
PID 2336 set thread context of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2336 17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

description	pid	process	target process
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
PID 2336 wrote to memory of 2552	2336	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe	17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17aabf6d007520c94f8df8196c8066b6_JaffaCakes118.exe"
2⤵
PID:2552

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-23-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-1-0x00000000003E0000-0x0000000000432000-memory.dmp

Filesize
328KB

Download
memory/2336-2-0x0000000004740000-0x00000000047B6000-memory.dmp

Filesize
472KB

Download
memory/2336-3-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download
memory/2336-4-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-5-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-6-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2336-7-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2552-8-0x0000000000080000-0x000000000009B000-memory.dmp

Filesize
108KB

Download
memory/2552-12-0x0000000000080000-0x000000000009B000-memory.dmp

Filesize
108KB

Download
memory/2552-14-0x0000000000080000-0x000000000009B000-memory.dmp

Filesize
108KB

Download
memory/2552-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-16-0x0000000000080000-0x000000000009B000-memory.dmp

Filesize
108KB

Download
memory/2552-21-0x0000000000080000-0x000000000009B000-memory.dmp

Filesize
108KB

Download
memory/2552-11-0x0000000000080000-0x000000000009B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads