Analysis
- max time kernel
2s - max time network
124s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
06/06/2024, 04:05
General
- Target 99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe
- Size 263KB
- Sample240606-en2c5shc39
- SHA256 2c0fa3a9dab65c98761b885d2196580af6605c7a9677608fb807758efb8f4786
Malware Config
Extracted
-
remcos
-
2.3.0 Pro
-
RemoteHost
-
top.smartphonesjo.waw.pl:2404
-
sub.josmartphones.waw.pl:2405
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
windowsupdater.exe
-
copy_folder
AppData
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
updaterwin.dat
-
keylog_flag
false
-
keylog_folder
System32
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
Remcos-3YHS56
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
WindowsAUD
-
screenshot_path
%WinDir%\System32
-
screenshot_time
10
-
startup_value
WIndows
-
take_screenshot_option
true
-
take_screenshot_time
2
-
take_screenshot_title
checkout,cart,shopping,credit card;bank;carte credit;banque;facture;bill;bitcoin; wallet; royal bank of canada; bank of montreal; cibc; td; rbc; bmo; scotia bank; banque scotia; monero; ltc; cryptowallet;binance;ltc;btc;ethereum;eth;litecoin;credit union;payment;cvv;exp;expiration;card number;desjardins;scotia;scotia bank;rbc;royal;royal bank;royalbank;security code,info,
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Deletes itself
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exeC:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exe4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
install.vbs
windowsupdater.exe
memory/1132-0-0x0000000000400000-0x0000000002028000-memory.dmp
memory/1132-2-0x0000000002110000-0x0000000002210000-memory.dmp
memory/1132-6-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1132-10-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1132-9-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-24-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-28-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-23-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-15-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-25-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-26-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-27-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-20-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-29-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-30-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-31-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-32-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-33-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-34-0x0000000000400000-0x0000000002028000-memory.dmp
memory/2572-35-0x0000000000400000-0x0000000002028000-memory.dmp