remcos | b260da3f89c57b47e5c68a4d3afc9b6c394260bc03b7a000ba6df5f6f7fab1dd

Analysis

max time kernel
148s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
Size

469KB
MD5

68089ff28524b4b4a5e15158d50d6f4c
SHA1

3f294a9bf981d6c5d566cb0d6c86014decb5206f
SHA256

b260da3f89c57b47e5c68a4d3afc9b6c394260bc03b7a000ba6df5f6f7fab1dd
SHA512

681456f53907becd0e3efacf6fe571b2601c8ab76f65a04c35fd93059d89cd4b3179e6a5777bad22b595337a67acfe9305261fb2eebe9a21260c38ac9c347e88
SSDEEP

12288:zcYx81TA3aasbCL9ovZI6md1AxLHBWvSlguG1wVA:4XhHas+yGt1CLBW6swV

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

description	pid	process	target process
PID 2340 set thread context of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2340 68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

pid process

2872 68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

pid	process
2872	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

description	pid	process	target process
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
PID 2340 wrote to memory of 2872	2340	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe	68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340

C:\Users\Admin\AppData\Local\Temp\68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68089ff28524b4b4a5e15158d50d6f4c_JaffaCakes118.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
79B

MD5
9e3f4e2cacfa389ac63b70dfd39f945a

SHA1
aa12f7bc168c0e2dd252c1bc08620148610a5aaa

SHA256
01db70636345774970b4d55aab27727b5acd2984f9909ccde3324e3e109c0dd5

SHA512
8cf03326b8d2f8e6e6c6c7ba33a4e4ea0282a1d447d6b4cc8af0fbf48f242747db060a57c810a9b8985e25d8b2492cad9e3c0c07c9e7fd6181a6ef3ebb454e5d

Download Submit
memory/2340-6-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-15-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-3-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-4-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/2340-5-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-0-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x0000000000C90000-0x0000000000D0C000-memory.dmp

Filesize
496KB

Download
memory/2340-2-0x0000000000340000-0x000000000035E000-memory.dmp

Filesize
120KB

Download
memory/2872-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2872-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2872-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2872-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2872-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2872-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download