remcos | e87c200bfbd4def75783b5c18a468c36e770251daf0e7fe8a07da5ff678bd9ac

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe
Size 548KB
Sample240618-pdfzkasgmc
SHA256 e87c200bfbd4def75783b5c18a468c36e770251daf0e7fe8a07da5ff678bd9ac
MD5 bbde4820e8d04cd4f3c3e18c85303d21
SHA1 a07d9bdc90513d43b17a06c0281ae6293fb7d031
SHA512 a1e285f1491886e440487d77d9081ab27130990787cbecbf031266854d51b55315960df7e7a7535becc14f3755b7229de0686ac9934ca799c097bb8e14c90f86
SSDEEP 12288:jr9xtDIO2VdUG3dpsh5pp01r7O9/LBicrQM:jr9xmldVdS/ppWO1LQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1344	Remc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 2568	1344	Remc.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4184	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe
1344	Remc.exe
1344	Remc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4280	4184	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe	85
PID 4184 wrote to memory of 4280	4184	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe	85
PID 4184 wrote to memory of 4280	4184	bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe	85
PID 4280 wrote to memory of 4664	4280	WScript.exe	86
PID 4280 wrote to memory of 4664	4280	WScript.exe	86
PID 4280 wrote to memory of 4664	4280	WScript.exe	86
PID 4664 wrote to memory of 1344	4664	cmd.exe	88
PID 4664 wrote to memory of 1344	4664	cmd.exe	88
PID 4664 wrote to memory of 1344	4664	cmd.exe	88
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89
PID 1344 wrote to memory of 2568	1344	Remc.exe	89

C:\Users\Admin\AppData\Local\Temp\bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bbde4820e8d04cd4f3c3e18c85303d21_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 410B
SHA256 353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46
MD5 837b54af2c8d285fb69d719cc9061206
SHA1 b31b75216a46b744eb0d89dd9885431a8ecde820
SHA512 6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311
MD5 SHA1 SHA512

Submit Download

Remc.exe

Path C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
Size 548KB
SHA256 e87c200bfbd4def75783b5c18a468c36e770251daf0e7fe8a07da5ff678bd9ac
MD5 bbde4820e8d04cd4f3c3e18c85303d21
SHA1 a07d9bdc90513d43b17a06c0281ae6293fb7d031
SHA512 a1e285f1491886e440487d77d9081ab27130990787cbecbf031266854d51b55315960df7e7a7535becc14f3755b7229de0686ac9934ca799c097bb8e14c90f86
SSDEEP 12288:jr9xtDIO2VdUG3dpsh5pp01r7O9/LBicrQM:jr9xmldVdS/ppWO1LQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\Remc\logs.dat
Size 79B
SHA256 dfbccc031d24e638895e9ecfb6b8fdb3a1dde8370ee6cdcd0cbee2f284d27734
MD5 3e5a009b6512c673f17eb01013973a0f
SHA1 5215eae55ed051391916db8ed7acb99282fc7548
SHA512 34ed8f2fe0589fd5cd314dd1bdbee989ed594c5abc636674bd6a473ff646194f8a85cee55f2cd5af33259bc3164ebc346969b3927b6716951b0e375c7593a892
MD5 SHA1 SHA512

Submit Download

memory/1344-18-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1344-21-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2568-23-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4184-2-0x00000000773C1000-0x00000000774E1000-memory.dmp

Download

memory/4184-7-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/4184-6-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4184-10-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads