remcos | 6405a9735b373fd2002acc5a4ab9de329de90f96a3534f436e7e72fe20fbcabc

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe
Size 620KB
Sample240613-e39m3axgmn
SHA256 6405a9735b373fd2002acc5a4ab9de329de90f96a3534f436e7e72fe20fbcabc
MD5 a3d18ca85f3ba786e210679f68a78f93
SHA1 5bc903d85ae6dc20ddf45e347e087cea66f43c73
SHA512 38609f6314c324614218c2811cd131560d5e26b729bc999611a9afc92078cbeaed17c03ee28fade0d1baed7196c7ab50b0d1826ef42e2713893ef21f3a7675da
SSDEEP 6144:tpArQhM3xoaEPihIhpLGjU3AnIK7yGPw0Ysjjt8n788v/UD/QIntiCqmHQQQ444g:tpA0hNiueUPWyGPPHjtWv8hntiC1QQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4028	Trigonometria.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4872	schtasks.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe
4028	Trigonometria.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4872	4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe	84
PID 4120 wrote to memory of 4872	4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe	84
PID 4120 wrote to memory of 4872	4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe	84
PID 4120 wrote to memory of 840	4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe	86
PID 4120 wrote to memory of 840	4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe	86
PID 4120 wrote to memory of 840	4120	a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3d18ca85f3ba786e210679f68a78f93_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Debitumenize" /TR "\"C:\ProgramData\Trigonometria.exe\""
  2⤵
  - Creates scheduled task(s)
  PID:4872
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /run /tn "Debitumenize"
  2⤵
  PID:840

C:\ProgramData\Trigonometria.exe
C:\ProgramData\Trigonometria.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Trigonometria.exe

Path C:\ProgramData\Trigonometria.exe
Size 620KB
SHA256 c761453a2c692463bd1163ca38372fbe235f3786c786308f304ff670612e5b3e
MD5 f05c7c080a9214b2788bf5d796a21873
SHA1 13f74c767bc359d76442c3bc8ca9765e04c2fa34
SHA512 3a2c7c70dd5624e93a88665318e502ebe4e8273625ad12bd176814073a94b09fd2dd149064976224acbc83e707319081024083cf4b3d6bd2aab0466958ba332e
SSDEEP 6144:toArQhM3xoaEPihIhpLGjU3AnIK7yGPw0Ysjjt8n788v/UD/QIntiCqmHQQQ444g:toA0hNiueUPWyGPPHjtWv8hntiC1QQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4028-9-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4028-12-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4028-14-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/4028-17-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/4120-2-0x0000000077941000-0x0000000077A61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads