remcos | 5e391cc6458beee90eec3bae94feb2ab9d2030921cd0653b9627711544723181

General

Target
ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
Size 1.2MB
Sample240618-h9g36sshpa
SHA256 5e391cc6458beee90eec3bae94feb2ab9d2030921cd0653b9627711544723181
MD5 ba70f37cdc64dce6e8e10b35e44f2d4c
SHA1 06649141cf945596d46e6adaf8775dbe0d035ad8
SHA512 4dafdb6e18bdff1bbf7090f3333674aed2eab01b1f842d21d648ed50b65a93c7cd6774f4baac7c540ac86cc28bc0bf8823f0e896047ca92063e6cb20dff63331
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHaLejo29584w/6T5:/h+ZkldoPK8YaLLu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos bz persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

bz

C2

91.192.100.62:9003

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
win43.exe
copy_folder
win73
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
bz-ANALTK
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
win43
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemSettingsBroker.url	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	win43.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win43 = "\"C:\\Users\\Admin\\AppData\\Roaming\\win73\\win43.exe\""	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0009000000023386-16.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 2516	748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	win43.exe
3628	win43.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
3628	win43.exe
3628	win43.exe
3628	win43.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
3628	win43.exe
3628	win43.exe
3628	win43.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2516	748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	90
PID 748 wrote to memory of 2516	748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	90
PID 748 wrote to memory of 2516	748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	90
PID 748 wrote to memory of 2516	748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	90
PID 748 wrote to memory of 2516	748	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	90
PID 2516 wrote to memory of 2260	2516	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	91
PID 2516 wrote to memory of 2260	2516	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	91
PID 2516 wrote to memory of 2260	2516	ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe	91
PID 2260 wrote to memory of 1344	2260	WScript.exe	92
PID 2260 wrote to memory of 1344	2260	WScript.exe	92
PID 2260 wrote to memory of 1344	2260	WScript.exe	92
PID 1344 wrote to memory of 3628	1344	cmd.exe	94
PID 1344 wrote to memory of 3628	1344	cmd.exe	94
PID 1344 wrote to memory of 3628	1344	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ba70f37cdc64dce6e8e10b35e44f2d4c_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win73\win43.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Roaming\win73\win43.exe
        
        C:\Users\Admin\AppData\Roaming\win73\win43.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 414B
SHA256 66f36202369031a7aa440e266b105ecd77986e499634c9228e45144fb61511db
MD5 e915c64cda4614e3eb5a26bba5f3c4c3
SHA1 9820b9036b26265d7ec98f5807b412ea3094b88e
SHA512 95fb3cab9e88ff72f2078ef900561bb7f1bc5b7d7e5d2263b0099f377c8c6168bcbc9f4fdc9fa7b2a7ca32ff788551f1c6b68f345c7c56239149c6067b28681f
MD5 SHA1 SHA512

Submit Download

win43.exe

Path C:\Users\Admin\AppData\Roaming\win73\win43.exe
Size 1.2MB
SHA256 5e391cc6458beee90eec3bae94feb2ab9d2030921cd0653b9627711544723181
MD5 ba70f37cdc64dce6e8e10b35e44f2d4c
SHA1 06649141cf945596d46e6adaf8775dbe0d035ad8
SHA512 4dafdb6e18bdff1bbf7090f3333674aed2eab01b1f842d21d648ed50b65a93c7cd6774f4baac7c540ac86cc28bc0bf8823f0e896047ca92063e6cb20dff63331
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHaLejo29584w/6T5:/h+ZkldoPK8YaLLu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/748-7-0x00000000003C0000-0x00000000003C1000-memory.dmp

Download

memory/2516-1-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2516-8-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads