remcos | 40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a

General

Target

5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe
Size

108KB
MD5

5c52234cf35ab8d08b10fcc3c2a9d32b
SHA1

3e23ce69fb61612642346d42ed9cb2d790c4e94c
SHA256

40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a
SHA512

ba562cfc4038a72bc20730c9e31035f1d2a37cf6153fee3c04c291ec942034a50fe99d1a5dabec1495bd4f829efc56dc1c5711568e55b457f4926be8c4900112
SSDEEP

3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnr+vHI+zIcdPr6:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXqs

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

C2

vitlop.ddns.net:1337

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-Z7MCJS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

remcos.exe

pid process

2860 remcos.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2656 cmd.exe
2656 cmd.exe

pid	process
2860	remcos.exe

pid	process
2656	cmd.exe
2656	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

remcos.exe

pid process

2860 remcos.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

remcos.exe

pid process

2860 remcos.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

remcos.exe

pid process

2860 remcos.exe

pid	process
2860	remcos.exe

pid	process
2860	remcos.exe

pid	process
2860	remcos.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exeWScript.execmd.exeremcos.exe

description	pid	process	target process
PID 2168 wrote to memory of 1880	2168	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 2168 wrote to memory of 1880	2168	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 2168 wrote to memory of 1880	2168	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 2168 wrote to memory of 1880	2168	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 1880 wrote to memory of 2656	1880	WScript.exe	cmd.exe
PID 1880 wrote to memory of 2656	1880	WScript.exe	cmd.exe
PID 1880 wrote to memory of 2656	1880	WScript.exe	cmd.exe
PID 1880 wrote to memory of 2656	1880	WScript.exe	cmd.exe
PID 2656 wrote to memory of 2860	2656	cmd.exe	remcos.exe
PID 2656 wrote to memory of 2860	2656	cmd.exe	remcos.exe
PID 2656 wrote to memory of 2860	2656	cmd.exe	remcos.exe
PID 2656 wrote to memory of 2860	2656	cmd.exe	remcos.exe
PID 2860 wrote to memory of 2392	2860	remcos.exe	iexplore.exe
PID 2860 wrote to memory of 2392	2860	remcos.exe	iexplore.exe
PID 2860 wrote to memory of 2392	2860	remcos.exe	iexplore.exe
PID 2860 wrote to memory of 2392	2860	remcos.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
418B

MD5
ff449f6f7bc5e2d800eb30e2d2c56611

SHA1
93419ea805b9ce35a766e5c56db50d54c2d3f94b

SHA256
655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416

SHA512
02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
112B

MD5
f51f7f042db4717cff93159f88ea51b1

SHA1
641c65ff8983172b793466c05f70dd3107d52ce2

SHA256
1922d7b683f391cba9c38cbc0a6217ff14b97f1a6bd889e9ca2efc96efcc3d2f

SHA512
9cc7db73b191248cb31d4e613dc45adc2dbb44ed628c711746998c98ab9bc1f828dfecef3fb6ee02150eee0984cb303f9c3fda7ef4de263dea4db59e12793dbc

Download Submit
\Users\Admin\AppData\Roaming\remcos\remcos.exe

Filesize
108KB

MD5
5c52234cf35ab8d08b10fcc3c2a9d32b

SHA1
3e23ce69fb61612642346d42ed9cb2d790c4e94c

SHA256
40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a

SHA512
ba562cfc4038a72bc20730c9e31035f1d2a37cf6153fee3c04c291ec942034a50fe99d1a5dabec1495bd4f829efc56dc1c5711568e55b457f4926be8c4900112

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads