remcos | 181e4423a1bec894471cf972cac0f4d297838621f97a3fdba1392534919b9eac

General

Target

5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
Size

624KB
MD5

5c51795853e77f806174a130eaf39694
SHA1

0dcd2f714f81ec0c166f5f0f8f65fa6c7da4ae3e
SHA256

181e4423a1bec894471cf972cac0f4d297838621f97a3fdba1392534919b9eac
SHA512

0b790b63f92ea3c6477cf212ac125d10d5f09588d7036b0c4cc2c27ede7d237d508b9ccdc47d49695c711d857ffa20d9d236f49526cf283772a0eeec4662a4ef
SSDEEP

12288:xZJlHuFhjaXQ8goculZ4/Hfvuxw0f9wyMzzstdpwifaha2jjj6FqgCw4JW:xNuWgx0pUW

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\´34p5roi7ymjero = "C:\\Users\\Admin\\0p9riy6t290wueporiy'u4prhmt.exe"	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

description pid process target process

PID 1936 set thread context of 3040 1936 5c51795853e77f806174a130eaf39694_JaffaCakes118.exe vbc.exe

description	pid	process	target process
PID 1936 set thread context of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

pid	process
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1936 5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

3040 vbc.exe

description	pid	process
Token: SeDebugPrivilege	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

pid	process
3040	vbc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

description	pid	process	target process
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe
PID 1936 wrote to memory of 3040	1936	5c51795853e77f806174a130eaf39694_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c51795853e77f806174a130eaf39694_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\VFGRBTR\logs.dat

Filesize
79B

MD5
2025d212174039e3c75186de5d9c0205

SHA1
4bd819b2156c87c07424f579b792db7dbb5505d6

SHA256
7b94b1002eda1d3040ef828bd633fda53a0e5ed1fa41437aefacff9e2ac8355b

SHA512
2beeb5d6611bb9bd422f2c8db53593ee9dc74177d0f251a12791eb0955d99f245445ae28cafe68c5ccfa122fb9810f479e92425e1a886f18eaee0fd6d66bf610

Download Submit
memory/1936-0-0x000000007407E000-0x000000007407F000-memory.dmp

Filesize
4KB

Download
memory/1936-1-0x0000000000F50000-0x0000000000FDA000-memory.dmp

Filesize
552KB

Download
memory/1936-2-0x0000000000360000-0x0000000000396000-memory.dmp

Filesize
216KB

Download
memory/1936-3-0x0000000000240000-0x0000000000254000-memory.dmp

Filesize
80KB

Download
memory/1936-14-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-23-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-22-0x000000007407E000-0x000000007407F000-memory.dmp

Filesize
4KB

Download
memory/3040-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3040-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-25-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads