remcos | 40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a

General

Target

5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe
Size

108KB
MD5

5c52234cf35ab8d08b10fcc3c2a9d32b
SHA1

3e23ce69fb61612642346d42ed9cb2d790c4e94c
SHA256

40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a
SHA512

ba562cfc4038a72bc20730c9e31035f1d2a37cf6153fee3c04c291ec942034a50fe99d1a5dabec1495bd4f829efc56dc1c5711568e55b457f4926be8c4900112
SSDEEP

3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnr+vHI+zIcdPr6:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXqs

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

C2

vitlop.ddns.net:1337

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-Z7MCJS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

remcos.exe

pid process

2688 remcos.exe

pid	process
2688	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

remcos.exe5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

remcos.exe

description pid process target process

PID 2688 set thread context of 2328 2688 remcos.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2688 set thread context of 2328	2688	remcos.exe	iexplore.exe

Modifies registry class 1 IoCs

Processes:

5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2328 iexplore.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

iexplore.exe

pid process

2328 iexplore.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2328 iexplore.exe

pid	process
2328	iexplore.exe

pid	process
2328	iexplore.exe

pid	process
2328	iexplore.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exeWScript.execmd.exeremcos.exe

description	pid	process	target process
PID 4388 wrote to memory of 2296	4388	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 4388 wrote to memory of 2296	4388	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 4388 wrote to memory of 2296	4388	5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe	WScript.exe
PID 2296 wrote to memory of 2140	2296	WScript.exe	cmd.exe
PID 2296 wrote to memory of 2140	2296	WScript.exe	cmd.exe
PID 2296 wrote to memory of 2140	2296	WScript.exe	cmd.exe
PID 2140 wrote to memory of 2688	2140	cmd.exe	remcos.exe
PID 2140 wrote to memory of 2688	2140	cmd.exe	remcos.exe
PID 2140 wrote to memory of 2688	2140	cmd.exe	remcos.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe
PID 2688 wrote to memory of 2328	2688	remcos.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c52234cf35ab8d08b10fcc3c2a9d32b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
418B

MD5
ff449f6f7bc5e2d800eb30e2d2c56611

SHA1
93419ea805b9ce35a766e5c56db50d54c2d3f94b

SHA256
655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416

SHA512
02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
117B

MD5
c260ba4d0fd5f3542886ddde16c174ec

SHA1
a5bb5734721bff91a791401276c5a2f8b3a1f6c8

SHA256
995eff8d0d32be587ed5b13bf5fd2a7e553cfed631208c910966f848a177408e

SHA512
e6ab6b928ad40abab71bf9f0ce77315c1d7fd5cb9aef3b3147a63e12415692633e31bc2e99463857e630878276823e9f39007c74738231396c1ca65837653ed7

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe

Filesize
108KB

MD5
5c52234cf35ab8d08b10fcc3c2a9d32b

SHA1
3e23ce69fb61612642346d42ed9cb2d790c4e94c

SHA256
40784da7bd130c13b57f200f45174bde52d5cab25695ba259a0fa205514f823a

SHA512
ba562cfc4038a72bc20730c9e31035f1d2a37cf6153fee3c04c291ec942034a50fe99d1a5dabec1495bd4f829efc56dc1c5711568e55b457f4926be8c4900112

Download Submit
memory/2328-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads