remcos | 133e21e07ea5741c212b8ca181b61e6255cc5c9412d7f83baa18d7eb90c2db18

General

Target

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
Size

204KB
MD5

68da20c81fba9c4c59b2979f38894352
SHA1

4a1a2640746caafbf84e804142a7b6368b2c1338
SHA256

133e21e07ea5741c212b8ca181b61e6255cc5c9412d7f83baa18d7eb90c2db18
SHA512

18ce9e01bb07567602cd43c834f43d63f20881b9f02dcda86139abed013959d8a8990b4df7ad1992ac375a93658b663ad37a312f0ecbf5be102a2151fb66dfce
SSDEEP

6144:BpG4ONMNrtop6hoKNSyJD3O+Uk9qjE4k:BU7NMNr+GNZJDDUk9mb

Score

10^/10

remcos marzo2019 rat

Malware Config

Extracted

Family

remcos

Version

2.2.2 Pro

Botnet

MARZO2019

C2

casillas.hicam.net:2404

casillasmx.chickenkiller.com:2404

casillas.libfoobar.so:2404

du4alr0ute.sendsmtp.com:2404

settings.wifizone.org:2404

wifi.con-ip.com:2404

rsaupdatr.jumpingcrab.com:2404

activate.office-on-the.net:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
REM20
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
EQHR
keylog_path
%AppData%
mouse_option
false
mutex
MARZ02019-RDUOXY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

Processes:

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\awgtuhngicrjhjw.eu.url	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

description	pid	process	target process
PID 2404 set thread context of 2212	2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

pid	process
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

pid process

2404 68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

pid process

2212 68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

pid	process
2212	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

description	pid	process	target process
PID 2404 wrote to memory of 2212	2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
PID 2404 wrote to memory of 2212	2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
PID 2404 wrote to memory of 2212	2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
PID 2404 wrote to memory of 2212	2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
PID 2404 wrote to memory of 2212	2404	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe	68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2404

C:\Users\Admin\AppData\Local\Temp\68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EQHR\logs.dat
Filesize
79B

MD5
34b73d973c333c65f8c48473b8e451d6

SHA1
7601bfbdd0a938f0603592f359d616afe357a971

SHA256
1748a30dec7c7602202f810437097c898499dbacc577c102ae3643fae41b643d

SHA512
0c1a2acca0e66a86dc88d4a2d35be12f9a1a28d420af7b42707c923d6f85d6a42f4090c8d30ae7429b631f687613f1d7a93a2da0b2d621bcd0c136a3063b0f7a

Download Submit
memory/2212-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2212-37-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2404-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2404-1-0x000000000040A000-0x0000000000410000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads