Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2024 08:26

General

  • Target

    2e38119954558630507e341fe03f2022_JaffaCakes118.exe

  • Size

    338KB

  • MD5

    2e38119954558630507e341fe03f2022

  • SHA1

    20cb37e9d62a093333d6e678b8763ad4e2197907

  • SHA256

    4e6c3f32c4ef36e69182e054a01645694a113c1c039d2a33e3059801de002ad6

  • SHA512

    008a6cff3046ece3326b9e41fcb34cce5efa56ba300e47e048bc7bab15acac1ac519e418c3c483dbc2b21e409d30df7371006e31832388d3a67682d66af9c5bd

  • SSDEEP

    6144:VseEVxpKTp7HAIlbzeDoqPoBzKy0DtplL/T3zlcmRsC5JLOvzObPQaHNs33m:qeRTpTAIcoqEOFP1olaHmH

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.2.0 Pro

Botnet

Surge

C2

shellgang.gleeze.com:2112

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-CEXU81

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

remcos

Botnet

Surge

C2

shellgang.gleeze.com:2112

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-CEXU81

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e38119954558630507e341fe03f2022_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2e38119954558630507e341fe03f2022_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
        3⤵
          PID:2116
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe

      Filesize

      338KB

      MD5

      2e38119954558630507e341fe03f2022

      SHA1

      20cb37e9d62a093333d6e678b8763ad4e2197907

      SHA256

      4e6c3f32c4ef36e69182e054a01645694a113c1c039d2a33e3059801de002ad6

      SHA512

      008a6cff3046ece3326b9e41fcb34cce5efa56ba300e47e048bc7bab15acac1ac519e418c3c483dbc2b21e409d30df7371006e31832388d3a67682d66af9c5bd

    • C:\Users\Admin\AppData\Roaming\remcos\logs.dat

      Filesize

      79B

      MD5

      8b78f6ef0a399c80c9d87f690549cfe8

      SHA1

      ca8bda54270fdb0ac874aaa406d3a2807b43cc5e

      SHA256

      3c6738caa4b90ee91e0888ce5f3f1f7d131c826d0a8e2f427345206c23f6ce6f

      SHA512

      35a30f7237ed8d9c27c1777df0ffcc943e483708ed942e61bc9a62f02df8388f66ac6bdc11b7b90c7934e39f0fa38e1c8bb9a2ac67f845afd83cb7dfb8a5f589

    • \Users\Admin\AppData\Local\Temp\svhost.exe

      Filesize

      1.6MB

      MD5

      32827e69b293b99013bbbe37d029245d

      SHA1

      bc9f80a38f09354d71467a05b0c5a82c3f7dac53

      SHA256

      9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

      SHA512

      58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

    • memory/2572-23-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-19-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-15-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-14-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-27-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-35-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2572-32-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-18-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-17-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-16-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2572-31-0x0000000000080000-0x00000000000A0000-memory.dmp

      Filesize

      128KB

    • memory/2712-2-0x0000000074C70000-0x000000007521B000-memory.dmp

      Filesize

      5.7MB

    • memory/2712-0-0x0000000074C71000-0x0000000074C72000-memory.dmp

      Filesize

      4KB

    • memory/2712-37-0x0000000074C70000-0x000000007521B000-memory.dmp

      Filesize

      5.7MB

    • memory/2712-1-0x0000000074C70000-0x000000007521B000-memory.dmp

      Filesize

      5.7MB