remcos | 590cdfa88046870ec0948a6efb65f31eaa51f9c6f70eab68e9caefd3fad37ee8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe
Size 245KB
Sample240520-sqf2wafb68
SHA256 590cdfa88046870ec0948a6efb65f31eaa51f9c6f70eab68e9caefd3fad37ee8
MD5 5fc8d37fffadc527ac83401e5fdf5778
SHA1 c0f852d45e3b10b72333d6a6ac3322fdbd820214
SHA512 a8a874eeda33409e91174c3b6d2c599e0b742335019b47f8357b39261f31f9cc22e5e70ee32cec6f926ba2a4202e040793ca8514d1f84d6d485980aa915df660
SSDEEP 3072:hPHtxYUgN/5/c7CtZP+FbQyA2WtqkO1gufKcQ48Ev5v5KkVvBfwenV6J9sHNW:hPIUoR3rPCpAFguXjjENB1pp6J98NW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1356	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
752	1464	WerFault.exe	81

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1356	remcos.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4164	1464	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe	85
PID 1464 wrote to memory of 4164	1464	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe	85
PID 1464 wrote to memory of 4164	1464	5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe	85
PID 4164 wrote to memory of 2748	4164	WScript.exe	89
PID 4164 wrote to memory of 2748	4164	WScript.exe	89
PID 4164 wrote to memory of 2748	4164	WScript.exe	89
PID 2748 wrote to memory of 1356	2748	cmd.exe	91
PID 2748 wrote to memory of 1356	2748	cmd.exe	91
PID 2748 wrote to memory of 1356	2748	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fc8d37fffadc527ac83401e5fdf5778_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Modifies WinLogon
      Suspicious use of SetWindowsHookEx
      PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1020
  2⤵
  - Program crash
  PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1464 -ip 1464
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
MD5 ff449f6f7bc5e2d800eb30e2d2c56611
SHA1 93419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA512 02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 32768a525bf8d1c03ab2ce8ab069c005730da06b54b92bcdba8c4bb8577d4437
MD5 61feedb36984df57b4598449a799509d
SHA1 243b694ab358734349c3a06b314062441b1c1955
SHA512 ce79debc3b82dedf9c96c4418b0818558725cbb9d9aafc1f8fa945765fdf52d6e18909475146964cededa655ed9947451e9a8e0e585fb02bd9e9c52b0192438b
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 245KB
SHA256 590cdfa88046870ec0948a6efb65f31eaa51f9c6f70eab68e9caefd3fad37ee8
MD5 5fc8d37fffadc527ac83401e5fdf5778
SHA1 c0f852d45e3b10b72333d6a6ac3322fdbd820214
SHA512 a8a874eeda33409e91174c3b6d2c599e0b742335019b47f8357b39261f31f9cc22e5e70ee32cec6f926ba2a4202e040793ca8514d1f84d6d485980aa915df660
SSDEEP 3072:hPHtxYUgN/5/c7CtZP+FbQyA2WtqkO1gufKcQ48Ev5v5KkVvBfwenV6J9sHNW:hPIUoR3rPCpAFguXjjENB1pp6J98NW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1356-14-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1356-16-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1356-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1356-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1356-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1356-34-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1356-40-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1464-9-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1464-8-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1464-1-0x0000000000730000-0x0000000000830000-memory.dmp

Download

memory/1464-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads