Malware Analysis Report

2024-12-07 22:47

Sample ID 240512-kqbs6agg6v
Target 3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118
SHA256 80f6104926429d0109f63d8181997c1a9baac48a9386c617d3958321631e2f62
Tags
remcos persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

80f6104926429d0109f63d8181997c1a9baac48a9386c617d3958321631e2f62

Threat Level: Known bad

The file 3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

remcos persistence rat

Remcos

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-12 08:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-12 08:47

Reported

2024-05-12 08:50

Platform

win7-20240221-en

Max time kernel

148s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe"

Signatures

Remcos

rat remcos

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\"" C:\Users\Admin\AppData\Roaming\Remc\Remc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\"" C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2372 set thread context of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 2904 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 2904 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 2904 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 3032 wrote to memory of 2612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 2612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 2612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 2612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 2612 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 2612 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 2612 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 2372 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"

C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 civita2.no-ip.biz udp

Files

memory/2904-2-0x0000000077330000-0x0000000077406000-memory.dmp

memory/2904-3-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2904-4-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2904-7-0x0000000072940000-0x0000000072A60000-memory.dmp

memory/2904-10-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2904-11-0x0000000072940000-0x0000000072A60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 837b54af2c8d285fb69d719cc9061206
SHA1 b31b75216a46b744eb0d89dd9885431a8ecde820
SHA256 353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46
SHA512 6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311

\Users\Admin\AppData\Roaming\Remc\Remc.exe

MD5 3941ba2f0f8d6c62b9931714c992c76e
SHA1 2ae4da950a5b71047bf2b67f7b76b9044375d1f9
SHA256 80f6104926429d0109f63d8181997c1a9baac48a9386c617d3958321631e2f62
SHA512 bac1e9e84473cfd4dc01ea5e72160613f80e5e17826c1a842ac84f2e83c7e2bad9a898478f72351f990bc06c68a71ee091b88f98a2d7c8268bb3b506972a5976

memory/2372-22-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2372-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-37-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2532-34-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-32-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-30-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-26-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2532-24-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Remc\logs.dat

MD5 ca2ab9eb164b61575471e781fe645480
SHA1 4fc23def925f950dfd9c3be906a3e6c3181b11eb
SHA256 5d6a52d0a3beabe5556d0a1a139b2199d29c6121ca3b6ee5c62b629b94ce9542
SHA512 ee3a7344f85dfdb73c7ff0b97b4d9d3cd909bcbbb47246453e8c20749ac6b41c1d6936db845a1ea9eeea24e7be364570216a127918fef44a43dc292e330324c4

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-12 08:47

Reported

2024-05-12 08:50

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe"

Signatures

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\"" C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\"" C:\Users\Admin\AppData\Roaming\Remc\Remc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4400 set thread context of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 692 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 692 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 692 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 3688 wrote to memory of 1744 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3688 wrote to memory of 1744 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3688 wrote to memory of 1744 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1744 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 1744 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 1744 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe
PID 4400 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Remc\Remc.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3941ba2f0f8d6c62b9931714c992c76e_JaffaCakes118.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"

C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
NL 23.62.61.88:443 www.bing.com tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
NL 23.62.61.88:443 www.bing.com tcp
US 8.8.8.8:53 88.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 civita2.no-ip.biz udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 99.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

memory/692-2-0x0000000077771000-0x0000000077891000-memory.dmp

memory/692-5-0x0000000000400000-0x000000000041E000-memory.dmp

memory/692-7-0x0000000000400000-0x000000000048A000-memory.dmp

memory/692-10-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 837b54af2c8d285fb69d719cc9061206
SHA1 b31b75216a46b744eb0d89dd9885431a8ecde820
SHA256 353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46
SHA512 6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311

C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

MD5 3941ba2f0f8d6c62b9931714c992c76e
SHA1 2ae4da950a5b71047bf2b67f7b76b9044375d1f9
SHA256 80f6104926429d0109f63d8181997c1a9baac48a9386c617d3958321631e2f62
SHA512 bac1e9e84473cfd4dc01ea5e72160613f80e5e17826c1a842ac84f2e83c7e2bad9a898478f72351f990bc06c68a71ee091b88f98a2d7c8268bb3b506972a5976

memory/4400-21-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4400-18-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1696-23-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Remc\logs.dat

MD5 89cc2b10ffd306bb22b45e6c3c5b4cc7
SHA1 bab6162011273cb2ff6ad3c65376c66e69172e6c
SHA256 a9d3fca0d90d17956bd2f45dad917a683ea1df88197f517afd31799b5d39bbc1
SHA512 626c6d4856d60832df04823ea6103ca046945171f3516e6613c1282dfe047065bd06473d2452dd57a5c78e99b9cf60ea9c7818091895fdcd4df4e58825d09069