remcos | be485848a73ca50633d69b7ed7057db89900262d15bf20194cb24cf23f2571fd

General

Target
613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe
Size 108KB
Sample240520-2rhfrsac22
SHA256 be485848a73ca50633d69b7ed7057db89900262d15bf20194cb24cf23f2571fd
MD5 613091151d4816ba0815d98dcf9d6098
SHA1 766f1501461eff98a88f72f966cb056ce7c4fe09
SHA512 7aa0a14c28955c54887a9b9a5c9138cb3d38f45d529d69788bed6e2659273de3ec2fec9b71c02a0695c568a3f7de0bd35fe8e95d1aeaba55b320d7f8d52f9d2a
SSDEEP 3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnrvHI+zIcEbrb:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXr8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

C2

79.172.242.28:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
xi3s.exe
copy_folder
xi3x
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%Temp%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-NL03Y0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
xi5w
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1800	xi3s.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xi5w = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xi3x\\xi3s.exe\""	613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xi5w = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xi3x\\xi3s.exe\""	xi3s.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 444	4388	613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe	84
PID 4388 wrote to memory of 444	4388	613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe	84
PID 4388 wrote to memory of 444	4388	613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe	84
PID 444 wrote to memory of 4172	444	WScript.exe	87
PID 444 wrote to memory of 4172	444	WScript.exe	87
PID 444 wrote to memory of 4172	444	WScript.exe	87
PID 4172 wrote to memory of 1800	4172	cmd.exe	89
PID 4172 wrote to memory of 1800	4172	cmd.exe	89
PID 4172 wrote to memory of 1800	4172	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\613091151d4816ba0815d98dcf9d6098_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\xi3x\xi3s.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\xi3x\xi3s.exe
      C:\Users\Admin\AppData\Local\Temp\xi3x\xi3s.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 416B
SHA256 533afaf7f3b5f135c3c9cfa7dc71bba8452949c40ba0d8ffc56daf87fb306936
MD5 453f89e2c8f4e830ac8db7611532f1dd
SHA1 d1e4a30ec5fd1067ade5d4a806457829038131ad
SHA512 840c7af7dc1911f983a3f0005b9b0efa7b63161b62d53b859b29b3d2d313653d88a5e1db687f87fff1e47e233160fc96ed5067b4f11be6ef9f4bdf72c6b145df
MD5 SHA1 SHA512

Submit Download

xi3s.exe

Path C:\Users\Admin\AppData\Local\Temp\xi3x\xi3s.exe
Size 108KB
SHA256 be485848a73ca50633d69b7ed7057db89900262d15bf20194cb24cf23f2571fd
MD5 613091151d4816ba0815d98dcf9d6098
SHA1 766f1501461eff98a88f72f966cb056ce7c4fe09
SHA512 7aa0a14c28955c54887a9b9a5c9138cb3d38f45d529d69788bed6e2659273de3ec2fec9b71c02a0695c568a3f7de0bd35fe8e95d1aeaba55b320d7f8d52f9d2a
SSDEEP 3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnrvHI+zIcEbrb:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads