remcos | 2c0fa3a9dab65c98761b885d2196580af6605c7a9677608fb807758efb8f4786

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe
Size 263KB
Sample240606-en2c5shc39
SHA256 2c0fa3a9dab65c98761b885d2196580af6605c7a9677608fb807758efb8f4786
MD5 99ee0418de617c85ea8215ce2ae8a164
SHA1 a03a07762a91d2262bc1be363cad44736beadd8e
SHA512 08a1e6e8ff8c4069a74a0600952999666dd564234ccfb81fcbf5cf671f9e6b87bb1599f87173900b08e5f59b6264a5deb96d2dcaece679fba69586915ad84667
SSDEEP 6144:DQvhTfZItvz876mr07IGYgfLQqDBNsiG:0FetY7DuI5gzXNs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.3.0 Pro

Botnet

RemoteHost

top.smartphonesjo.waw.pl:2404
sub.josmartphones.waw.pl:2405

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
windowsupdater.exe
copy_folder
AppData
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
updaterwin.dat
keylog_flag
false
keylog_folder
System32
keylog_path
%Temp%
mouse_option
false
mutex
Remcos-3YHS56
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
WindowsAUD
screenshot_path
%WinDir%\System32
screenshot_time
10
startup_value
WIndows
take_screenshot_option
true
take_screenshot_time
2
take_screenshot_title
checkout,cart,shopping,credit card;bank;carte credit;banque;facture;bill;bitcoin; wallet; royal bank of canada; bank of montreal; cibc; td; rbc; bmo; scotia bank; banque scotia; monero; ltc; cryptowallet;binance;ltc;btc;ethereum;eth;litecoin;credit union;payment;cvv;exp;expiration;card number;desjardins;scotia;scotia bank;rbc;royal;royal bank;royalbank;security code,info,

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
2032	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	windowsupdater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIndows = "\"C:\\Users\\Admin\\AppData\\Roaming\\AppData\\windowsupdater.exe\""	99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIndows = "\"C:\\Users\\Admin\\AppData\\Roaming\\AppData\\windowsupdater.exe\""	windowsupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	3564	WerFault.exe	80

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	windowsupdater.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3048	windowsupdater.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2032	3564	99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe	84
PID 3564 wrote to memory of 2032	3564	99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe	84
PID 3564 wrote to memory of 2032	3564	99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe	84
PID 2032 wrote to memory of 1732	2032	WScript.exe	88
PID 2032 wrote to memory of 1732	2032	WScript.exe	88
PID 2032 wrote to memory of 1732	2032	WScript.exe	88
PID 1732 wrote to memory of 3048	1732	cmd.exe	90
PID 1732 wrote to memory of 3048	1732	cmd.exe	90
PID 1732 wrote to memory of 3048	1732	cmd.exe	90
PID 3048 wrote to memory of 2924	3048	windowsupdater.exe	95
PID 3048 wrote to memory of 2924	3048	windowsupdater.exe	95
PID 3048 wrote to memory of 2924	3048	windowsupdater.exe	95
PID 3048 wrote to memory of 2556	3048	windowsupdater.exe	96
PID 3048 wrote to memory of 2556	3048	windowsupdater.exe	96
PID 3048 wrote to memory of 2556	3048	windowsupdater.exe	96

C:\Users\Admin\AppData\Local\Temp\99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\99ee0418de617c85ea8215ce2ae8a164_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exe
      C:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2924
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1204
  2⤵
  - Program crash
  PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3564 -ip 3564
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 640B
SHA256 c87e2761ba5e53889eac72552926423f77332ad0d040fc2611e4462d8a744c1c
MD5 f0a9df746ce36e2447b756f910efadac
SHA1 45c2535d13ea168990487fc6ecdf74b7b2b67fb4
SHA512 9ddbd728d18991fb9fbd0a69f2681a5d0182e6b50c8adf0bbb8bb64ba1f450ee1440beae87fa567a015fa60cae7e65e8c639f27a1af5d2846f8779773fb26eb2
MD5 SHA1 SHA512

Submit Download

windowsupdater.exe

Path C:\Users\Admin\AppData\Roaming\AppData\windowsupdater.exe
Size 128KB
SHA256 0ba14aaec7a9649a121fed72e8f8697f69bbf0dd8b263f7e9787f048ec2d3aa0
MD5 18394648a6ce53efbc5a6d70fba62c55
SHA1 ea63975efb9612a8ee4e4e0d63af6f02f4342058
SHA512 dc55fd98988ae27005a87613ba38364ddd68997026440c4e61aed89d7f61dec5f2720323ac66c2db169b6d82cc818c22ab3fe4f5144d7a5cef4992169e552e49
SSDEEP 1536:mQh/I5wAQ0BhT4g57Iag55hD7vZWKMKLaJtRv5Lwc4A6j9kVQKl9Ki8KboTy1qqm:D/IvhT4g57IagvzZWKq76mfsOMT+r2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-27-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-23-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-32-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-31-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-30-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-17-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-20-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-21-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-22-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-29-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-24-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-25-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-26-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3048-28-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3564-0-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3564-2-0x0000000002290000-0x0000000002390000-memory.dmp

Download

memory/3564-6-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3564-10-0x0000000000400000-0x0000000002028000-memory.dmp

Download

memory/3564-11-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads