remcos | 098fd9d5eb438af073651243c07bedcf9e1a1363f682bdefc124588d0cbf356a

General

Target
384aaa214d78f738940194fb363e1898_JaffaCakes118.exe
Size 120KB
Sample240512-e82veacb42
SHA256 098fd9d5eb438af073651243c07bedcf9e1a1363f682bdefc124588d0cbf356a
MD5 384aaa214d78f738940194fb363e1898
SHA1 5106b7555c4340eda60742654f403ac73e36cd01
SHA512 4d4c505d6401a9f2a9f1c79dffa83c352911c0ca0d71e08799063ae91daed54bc48babc352532709fff9035de747f3b78f8232fad18d2a414ba64e1c8364e27a
SSDEEP 3072:tWekZYhHkjCVS1Mfg7EzCkM/Am1jhGjkFguLWzI+z4c4hr0ZE7N:tWezhHkj6S1Mfg7YCknE1GjkFguLWk+G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remc1 persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.4 Pro

Botnet

Remc1

C2

civita2.no-ip.biz:2442

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
15
connect_interval
5
copy_file
Remc.exe
copy_folder
Remc
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Remc
keylog_path
%AppData%
mouse_option
false
mutex
ophjgkjfmv-8RQED1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
erwfguyhjnxcj
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	384aaa214d78f738940194fb363e1898_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	Remc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	384aaa214d78f738940194fb363e1898_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 1772	1232	Remc.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	384aaa214d78f738940194fb363e1898_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	Remc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 976	1560	384aaa214d78f738940194fb363e1898_JaffaCakes118.exe	90
PID 1560 wrote to memory of 976	1560	384aaa214d78f738940194fb363e1898_JaffaCakes118.exe	90
PID 1560 wrote to memory of 976	1560	384aaa214d78f738940194fb363e1898_JaffaCakes118.exe	90
PID 976 wrote to memory of 3828	976	WScript.exe	94
PID 976 wrote to memory of 3828	976	WScript.exe	94
PID 976 wrote to memory of 3828	976	WScript.exe	94
PID 3828 wrote to memory of 1232	3828	cmd.exe	96
PID 3828 wrote to memory of 1232	3828	cmd.exe	96
PID 3828 wrote to memory of 1232	3828	cmd.exe	96
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97
PID 1232 wrote to memory of 1772	1232	Remc.exe	97

C:\Users\Admin\AppData\Local\Temp\384aaa214d78f738940194fb363e1898_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\384aaa214d78f738940194fb363e1898_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1748,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:8
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 410B
SHA256 353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46
MD5 837b54af2c8d285fb69d719cc9061206
SHA1 b31b75216a46b744eb0d89dd9885431a8ecde820
SHA512 6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311
MD5 SHA1 SHA512

Submit Download

Remc.exe

Path C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
Size 120KB
SHA256 098fd9d5eb438af073651243c07bedcf9e1a1363f682bdefc124588d0cbf356a
MD5 384aaa214d78f738940194fb363e1898
SHA1 5106b7555c4340eda60742654f403ac73e36cd01
SHA512 4d4c505d6401a9f2a9f1c79dffa83c352911c0ca0d71e08799063ae91daed54bc48babc352532709fff9035de747f3b78f8232fad18d2a414ba64e1c8364e27a
SSDEEP 3072:tWekZYhHkjCVS1Mfg7EzCkM/Am1jhGjkFguLWzI+z4c4hr0ZE7N:tWezhHkj6S1Mfg7YCknE1GjkFguLWk+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\Remc\logs.dat
Size 79B
SHA256 1f453aa240f04833adff038adf84a619f0120b5730222ab6c378e712c02590a6
MD5 e85f4908bf5440cdd69e619fdc7a417d
SHA1 6152af3a3302d52e28f7c6015bd7f46087d48043
SHA512 cc64b64fccd9fe4dcf29f8fe1c7eb26d3453e7d2aac5a0f13b6b0d94641e6a4cce379c59e6279222d1c8f00b54de45cd71eb352b78de732403207d0815abd583
MD5 SHA1 SHA512

Submit Download

memory/1772-8-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1772-10-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1772-11-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads