remcos | 94cf304b8f43a832feed0ac7d539035065dd09f51cb2be939f738e872edccdd8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe
Size 609KB
Sample240601-mp8gvaba88
SHA256 94cf304b8f43a832feed0ac7d539035065dd09f51cb2be939f738e872edccdd8
MD5 8a371db4cfeb51386f97345740523a46
SHA1 22d30984e6b4ae0188f5c267e7a0ac0d531e6256
SHA512 ffe2f86d14ee37f16fbf7ced00d0578c0dda8c73ab56cff37e8c28bd25dc22f5addec8cceb477eff07b2e302f873a7954c2fa69c8f6ac7e6efb780439727b5f6
SSDEEP 12288:CwNS+u4e+eMGyyRiDzh7/h+H8DcQQYqOkL0:Zhu4e+PQiDzzLD2YqpL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos goodluck rat

Malware Config

Extracted

Family

remcos

Version

2.1.0 Pro

Botnet

GOODLUCK

mickeyjones.ddns.net:2405

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
cos.exe
copy_folder
mcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Tmcos
keylog_path
%AppData%
mouse_option
false
mutex
emcos-UY4VDM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
rcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Botnet

GOODLUCK

mickeyjones.ddns.net:2405

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
cos.exe
copy_folder
mcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Tmcos
keylog_path
%AppData%
mouse_option
false
mutex
emcos-UY4VDM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
rcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	1456	WerFault.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92
PID 1240 wrote to memory of 1456	1240	8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8a371db4cfeb51386f97345740523a46_JaffaCakes118.exe"
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 500
    3⤵
    - Program crash
    PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1456 -ip 1456
1⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-6-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/1240-7-0x000000007528E000-0x000000007528F000-memory.dmp

Download

memory/1240-2-0x0000000005300000-0x00000000058A4000-memory.dmp

Download

memory/1240-3-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Download

memory/1240-4-0x00000000028D0000-0x00000000028FC000-memory.dmp

Download

memory/1240-5-0x0000000000DF0000-0x0000000000E0C000-memory.dmp

Download

memory/1240-8-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/1240-0-0x000000007528E000-0x000000007528F000-memory.dmp

Download

memory/1240-1-0x0000000000350000-0x00000000003F0000-memory.dmp

Download

memory/1240-9-0x0000000008000000-0x000000000809C000-memory.dmp

Download

memory/1240-20-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/1456-10-0x0000000000570000-0x0000000000590000-memory.dmp

Download

memory/1456-19-0x0000000000570000-0x0000000000590000-memory.dmp

Download

memory/1456-14-0x0000000000570000-0x0000000000590000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads