remcos | 6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491

Analysis

max time kernel
148s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
Size 588KB
Sample240517-xap23ada98
SHA256 6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491
MD5 50e8d1bfc6604c8dc05bd72b015bd1d0
SHA1 bf2f30a0b4d43fd24741a5fbb3830a1cf1846b6e
SHA512 06cd20c661d2a9af4ffed4ce7223b2527a44438718a871312e2482a8290369633294aa94cdfe1b38c6d1d6f270d55b92eda83ceb170f6fce6e6eb47fe4277276
SSDEEP 6144:kJFynC0QKjmzzqWMQE2VCW5+Mf3exBEScTC8iIkS8p1PREc3g/rN0IyN:xnC0nKzQgVCc+MAB8mS82agTN07
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	Remc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 2128	4860	Remc.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
4860	Remc.exe
4860	Remc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3708	436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe	89
PID 436 wrote to memory of 3708	436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe	89
PID 436 wrote to memory of 3708	436	50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe	89
PID 3708 wrote to memory of 5072	3708	WScript.exe	91
PID 3708 wrote to memory of 5072	3708	WScript.exe	91
PID 3708 wrote to memory of 5072	3708	WScript.exe	91
PID 5072 wrote to memory of 4860	5072	cmd.exe	93
PID 5072 wrote to memory of 4860	5072	cmd.exe	93
PID 5072 wrote to memory of 4860	5072	cmd.exe	93
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95
PID 4860 wrote to memory of 2128	4860	Remc.exe	95

C:\Users\Admin\AppData\Local\Temp\50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50e8d1bfc6604c8dc05bd72b015bd1d0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 410B
SHA256 353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46
MD5 837b54af2c8d285fb69d719cc9061206
SHA1 b31b75216a46b744eb0d89dd9885431a8ecde820
SHA512 6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311
MD5 SHA1 SHA512

Submit Download

Remc.exe

Path C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
Size 588KB
SHA256 6a8e333328928f8497741e03ae829a86587b9005cccb2a33a6062c20cb759491
MD5 50e8d1bfc6604c8dc05bd72b015bd1d0
SHA1 bf2f30a0b4d43fd24741a5fbb3830a1cf1846b6e
SHA512 06cd20c661d2a9af4ffed4ce7223b2527a44438718a871312e2482a8290369633294aa94cdfe1b38c6d1d6f270d55b92eda83ceb170f6fce6e6eb47fe4277276
SSDEEP 6144:kJFynC0QKjmzzqWMQE2VCW5+Mf3exBEScTC8iIkS8p1PREc3g/rN0IyN:xnC0nKzQgVCc+MAB8mS82agTN07
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\Remc\logs.dat
Size 79B
SHA256 d85a2b32671d75f017dc51fa39721376db622e34697873badb07921be70d23d4
MD5 467c728acd31bbec78cc7e3f17a05b21
SHA1 1df46b26b9fa2377ba6bb2cdda11bd3d95446e3d
SHA512 22beafa7092fa5243d912c5d6c6eec976785eda30f6c247b57185ddf1e551d7ed7978c3164bac2a1fb4ae9e5b1112eef7732f7a37af9e4e83e2aee63d041a22e
MD5 SHA1 SHA512

Submit Download

memory/436-2-0x00000000778D1000-0x00000000779F1000-memory.dmp

Download

memory/436-6-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/436-7-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/436-10-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2128-23-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4860-18-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4860-21-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads