remcos | 6d22631a5f4c54c0a22b0f81f0fc2fa0ec414a8c3dbf6cba8b14fc7b0134263b

General

Target
94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe
Size 124KB
Sample240604-p3xzdagh82
SHA256 6d22631a5f4c54c0a22b0f81f0fc2fa0ec414a8c3dbf6cba8b14fc7b0134263b
MD5 94e80b4efc1b16b2afcadbf7f42b0618
SHA1 1a7f0078a7f6ec61f4c4b789a501e9742603d4bb
SHA512 30da13d28749599442eb3fde7e227d803c138dc701b2bc7b1d53461e43275325118929bc6bd5843f2d1b601add7d5725e92b004f7334b5241f6d15840bcebe33
SSDEEP 3072:djiTCiIMleBDfHllNUH80TCvRIdIYNGXm4OzOh6oErc+5:djiTCseB7HlPb0TyRIdIYNGX7OzOh6oo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.7 Pro

Botnet

RemoteHost

C2

185.244.31.10:1414

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-GAKAER
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4800	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 2864	4800	remcos.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3328	5048	94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe	82
PID 5048 wrote to memory of 3328	5048	94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe	82
PID 5048 wrote to memory of 3328	5048	94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe	82
PID 3328 wrote to memory of 4936	3328	WScript.exe	87
PID 3328 wrote to memory of 4936	3328	WScript.exe	87
PID 3328 wrote to memory of 4936	3328	WScript.exe	87
PID 4936 wrote to memory of 4800	4936	cmd.exe	89
PID 4936 wrote to memory of 4800	4936	cmd.exe	89
PID 4936 wrote to memory of 4800	4936	cmd.exe	89
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90
PID 4800 wrote to memory of 2864	4800	remcos.exe	90

C:\Users\Admin\AppData\Local\Temp\94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94e80b4efc1b16b2afcadbf7f42b0618_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
MD5 ff449f6f7bc5e2d800eb30e2d2c56611
SHA1 93419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA512 02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 fe0e75d0af48e711b6d3fec36d3a5f54ab24502d20444323a10b484088f0bcb6
MD5 5e48e1f88a2545c19915fd459ea35c89
SHA1 1857386c52726f30ffe5fc46d77ab281e143ce4a
SHA512 73d53e8e12760eb65dab66a9782a5dd6075affedc90fe91f181b4391cf7fc7e95fae90ed93d786383a705750af58d3367ed5e2084337cdde87a9a52e33c4fd80
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 124KB
SHA256 6d22631a5f4c54c0a22b0f81f0fc2fa0ec414a8c3dbf6cba8b14fc7b0134263b
MD5 94e80b4efc1b16b2afcadbf7f42b0618
SHA1 1a7f0078a7f6ec61f4c4b789a501e9742603d4bb
SHA512 30da13d28749599442eb3fde7e227d803c138dc701b2bc7b1d53461e43275325118929bc6bd5843f2d1b601add7d5725e92b004f7334b5241f6d15840bcebe33
SSDEEP 3072:djiTCiIMleBDfHllNUH80TCvRIdIYNGXm4OzOh6oErc+5:djiTCseB7HlPb0TyRIdIYNGX7OzOh6oo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2864-8-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads