remcos | 494e74c88fed50337a524e4e3c395fbf0cf1443691ef9ba11d22199c72add384

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
314162b42775491f40e45f230a66a951_JaffaCakes118.exe
Size 1.5MB
Sample240510-1yn2fsfb33
SHA256 494e74c88fed50337a524e4e3c395fbf0cf1443691ef9ba11d22199c72add384
MD5 314162b42775491f40e45f230a66a951
SHA1 8b69e81360caa7c644ff9d646ce707614d57f14b
SHA512 a33fe3f575c3d53f735a1ac30fdb2249d6ebb0df9828a495f34d28804a4932c3d4c75188ca478acb885d87137b2dbddb6b75b1fc66206d613f7fd7b5f91b6d71
SSDEEP 24576:w8IX/6BvJQOsb7DW9d9597vmQnbWPRqprGYRfVP2XvZ:qXShJQOsHS9d9597vmQnKpqpr/3P2/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	314162b42775491f40e45f230a66a951_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3492	AdobeReader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4208	schtasks.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe
4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe
3492	AdobeReader.exe
3492	AdobeReader.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe
4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe
3492	AdobeReader.exe
3492	AdobeReader.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe
3492	AdobeReader.exe
3492	AdobeReader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4208	4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe	96
PID 4992 wrote to memory of 4208	4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe	96
PID 4992 wrote to memory of 4208	4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe	96
PID 4992 wrote to memory of 4856	4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe	100
PID 4992 wrote to memory of 4856	4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe	100
PID 4992 wrote to memory of 4856	4992	314162b42775491f40e45f230a66a951_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\314162b42775491f40e45f230a66a951_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\314162b42775491f40e45f230a66a951_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "AdobeReader" /TR "\"C:\ProgramData\AdobeReader.exe\""
  2⤵
  - Creates scheduled task(s)
  PID:4208
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /run /tn "AdobeReader"
  2⤵
  PID:4856

C:\ProgramData\AdobeReader.exe
C:\ProgramData\AdobeReader.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeReader.exe

Path C:\ProgramData\AdobeReader.exe
Size 1.5MB
SHA256 73f7a66e9f030f01b9171a8e0776320de453043ce0bd47bb9c53c79d5473849f
MD5 a943181e6d69c99c1428d7a4b2474b7d
SHA1 e47deac6de97b97aa7298e80d426fefd777ea5cd
SHA512 5a1470e35295d2906e8b4e9f67ee754a3874375fa58c8ddf1a464758c2936dade45f56bac94d89037ee499554646d69c59924bf49e4d43af3fc14fad33326af0
SSDEEP 24576:28IX/6BvJQOsb7DW9d9597vmQnbWPRqprGYRfVP2Xvy:AXShJQOsHS9d9597vmQnKpqpr/3P2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 96ba7f3c99208dcc85e8336c459b1562caa5b270064442686ee59576084d905c
MD5 83b97265e21f56d5bd10048724ff6dae
SHA1 b94b9d9cc60b564568f90c84a1a50307150ca03e
SHA512 77e309fe0e561e69b4ae82eb5ded158ea26a36afce800063cbd8ae1c4cf857eeac87568168a6a61d78aca514c6aed1ba26d8f1efd93e80fd3564361faac9cb5f
MD5 SHA1 SHA512

Submit Download

memory/3492-9-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3492-12-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3492-13-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/3492-18-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3492-19-0x0000000000400000-0x0000000000575000-memory.dmp

Download

memory/4992-2-0x0000000076EB1000-0x0000000076FD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads