remcos | 6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491

General

Target

50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
Size

588KB
MD5

50e8d1bfc6604c8dc05bd72b015bd1d0
SHA1

bf2f30a0b4d43fd24741a5fbb3830a1cf1846b6e
SHA256

6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491
SHA512

06cd20c661d2a9af4ffed4ce7223b2527a44438718a871312e2482a8290369633294aa94cdfe1b38c6d1d6f270d55b92eda83ceb170f6fce6e6eb47fe4277276
SSDEEP

6144:kJFynC0QKjmzzqWMQE2VCW5+Mf3exBEScTC8iIkS8p1PREc3g/rN0IyN:xnC0nKzQgVCc+MAB8mS82agTN07

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

Processes:

Remc.exe

pid process

4860 Remc.exe

pid	process
4860	Remc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exeRemc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Remc.exe

description pid process target process

PID 4860 set thread context of 2128 4860 Remc.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 4860 set thread context of 2128	4860	Remc.exe	svchost.exe

Modifies registry class 1 IoCs

Processes:

50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exeRemc.exe

pid process

436 50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
4860 Remc.exe
4860 Remc.exe

pid	process
436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
4860	Remc.exe
4860	Remc.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exeWScript.execmd.exeRemc.exe

description	pid	process	target process
PID 436 wrote to memory of 3708	436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe	WScript.exe
PID 436 wrote to memory of 3708	436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe	WScript.exe
PID 436 wrote to memory of 3708	436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe	WScript.exe
PID 3708 wrote to memory of 5072	3708	WScript.exe	cmd.exe
PID 3708 wrote to memory of 5072	3708	WScript.exe	cmd.exe
PID 3708 wrote to memory of 5072	3708	WScript.exe	cmd.exe
PID 5072 wrote to memory of 4860	5072	cmd.exe	Remc.exe
PID 5072 wrote to memory of 4860	5072	cmd.exe	Remc.exe
PID 5072 wrote to memory of 4860	5072	cmd.exe	Remc.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe
PID 4860 wrote to memory of 2128	4860	Remc.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
410B

MD5
837b54af2c8d285fb69d719cc9061206

SHA1
b31b75216a46b744eb0d89dd9885431a8ecde820

SHA256
353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46

SHA512
6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

Filesize
588KB

MD5
50e8d1bfc6604c8dc05bd72b015bd1d0

SHA1
bf2f30a0b4d43fd24741a5fbb3830a1cf1846b6e

SHA256
6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491

SHA512
06cd20c661d2a9af4ffed4ce7223b2527a44438718a871312e2482a8290369633294aa94cdfe1b38c6d1d6f270d55b92eda83ceb170f6fce6e6eb47fe4277276

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\logs.dat

Filesize
79B

MD5
467c728acd31bbec78cc7e3f17a05b21

SHA1
1df46b26b9fa2377ba6bb2cdda11bd3d95446e3d

SHA256
d85a2b32671d75f017dc51fa39721376db622e34697873badb07921be70d23d4

SHA512
22beafa7092fa5243d912c5d6c6eec976785eda30f6c247b57185ddf1e551d7ed7978c3164bac2a1fb4ae9e5b1112eef7732f7a37af9e4e83e2aee63d041a22e

Download Submit
memory/436-2-0x00000000778D1000-0x00000000779F1000-memory.dmp

Filesize
1.1MB

Download
memory/436-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/436-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/436-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2128-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4860-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4860-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads