remcos | b22aa813b223ea1300d79472b45d28bec5eef803fd86598c3f9d2ce2aae30a74

Analysis

max time kernel
142s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
Size 1.3MB
Sample240512-vntlasae63
SHA256 b22aa813b223ea1300d79472b45d28bec5eef803fd86598c3f9d2ce2aae30a74
MD5 3b324a37f139d7d4ef82cee02bfb7ab9
SHA1 ed92348bc52b3235909935d6d5a72b005c81ae7c
SHA512 1787616b44b57118b51844bb1a8e31d5aeee5a4a84df1e9436c5acce055406e046ce82ae1f9aa38ee89da79a7ec59538d4ecf9aa78cda3ada37b9a9cff3fb1a3
SSDEEP 24576:JcDqWP/5QY9AvMLFbC7oYVkzTRv2RqroAO+7IelB4Zx/AO9SXiFwGae:JgZQYeMo/GzVKqrDO+F4vlSXi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos 3404 evasion persistence rat

Malware Config

Extracted

Family

remcos

Botnet

3404

194.40.242.22:3404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
2
connect_interval
15
copy_file
msos.exe
copy_folder
Msos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
MSOS
keylog_path
%AppData%
mouse_option
false
mutex
support-9DOJNT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
msos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	msos.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	msos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	msos.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	msos.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine	msos.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\msos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Msos\\msos.exe\""	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\msos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Msos\\msos.exe\""	msos.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3016	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
2748	msos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
2748	msos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	msos.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2092	3016	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe	28
PID 3016 wrote to memory of 2092	3016	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe	28
PID 3016 wrote to memory of 2092	3016	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe	28
PID 3016 wrote to memory of 2092	3016	3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe	28
PID 2092 wrote to memory of 2724	2092	WScript.exe	29
PID 2092 wrote to memory of 2724	2092	WScript.exe	29
PID 2092 wrote to memory of 2724	2092	WScript.exe	29
PID 2092 wrote to memory of 2724	2092	WScript.exe	29
PID 2724 wrote to memory of 2748	2724	cmd.exe	31
PID 2724 wrote to memory of 2748	2724	cmd.exe	31
PID 2724 wrote to memory of 2748	2724	cmd.exe	31
PID 2724 wrote to memory of 2748	2724	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b324a37f139d7d4ef82cee02bfb7ab9_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Msos\msos.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Roaming\Msos\msos.exe
      C:\Users\Admin\AppData\Roaming\Msos\msos.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 410B
SHA256 a461e3a4eb06fb7a885e2e9f6e0faee3692018365a1645cda2d2209cb6a5bddf
MD5 ffc5481bf624ad66edb74a4c5beaf486
SHA1 d0a108d67daca4147752bb8a383a3d046a8ec9c2
SHA512 c5c17dde61dfc80eb0e7a31fd30d143b7e8bc8b42d1c2848e27e7a5861c8c98d5441e7ebc1b8b90779ebf59f09b4f76e8b81da0a802b2d206a7b961e39f61b02
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\Msos\logs.dat
Size 79B
SHA256 66740b36b460b815b865fb147b8a0c407aab47fe6dc9b5f7f7ec66389add1c6d
MD5 622bb19f6f05dcd070f0d3acd4bf7c80
SHA1 c27eab67689919053885076b69868c645e1bb964
SHA512 37c685e943da27c447f4c2b57ab4482d4a0dd9b274c4f89b1de45aee4faaa3992f18e5ec712100a8bec2ab073a91e95e0a0366a3fbfbf163215718a514862267
MD5 SHA1 SHA512

Submit Download

msos.exe

Path \Users\Admin\AppData\Roaming\Msos\msos.exe
Size 1.3MB
SHA256 b22aa813b223ea1300d79472b45d28bec5eef803fd86598c3f9d2ce2aae30a74
MD5 3b324a37f139d7d4ef82cee02bfb7ab9
SHA1 ed92348bc52b3235909935d6d5a72b005c81ae7c
SHA512 1787616b44b57118b51844bb1a8e31d5aeee5a4a84df1e9436c5acce055406e046ce82ae1f9aa38ee89da79a7ec59538d4ecf9aa78cda3ada37b9a9cff3fb1a3
SSDEEP 24576:JcDqWP/5QY9AvMLFbC7oYVkzTRv2RqroAO+7IelB4Zx/AO9SXiFwGae:JgZQYeMo/GzVKqrDO+F4vlSXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2748-27-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-31-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-42-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-39-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-14-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-17-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-20-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-34-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2748-25-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/3016-0-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/3016-9-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/3016-1-0x0000000077180000-0x0000000077182000-memory.dmp

Download

memory/3016-4-0x0000000000401000-0x000000000040A000-memory.dmp

Download

memory/3016-5-0x0000000000400000-0x000000000070C000-memory.dmp

Download