Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/07/2024, 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b077d22d646da1f217ab922ac25b3b8_JaffaCakes118.dll
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
- Target 1b077d22d646da1f217ab922ac25b3b8_JaffaCakes118.dll
- Size 3.5MB
- Sample240701-m2kasaxeqg
- SHA256 1be71450bb7ccc0bb07bc0247a951a07568d0077b4ad025771993cfce4a4e886
- MD5 1b077d22d646da1f217ab922ac25b3b8
- SHA1 0b253513d20c1333e48aad14ea2ade38a285bf03
- SHA512 d5e4f7c1e5c6f090675829e0166b5dcac732a94ad50f3ea0f4d942ebb9b98f5a483153d60e52f653250dffd7ec4572aef5baeaa0a7ccb8abe318a56c98c57218
- SSDEEP 49152:aNpFPhoSpEUccKaLJDuQncCghrbwnddqLTVee3SG:aZDDuQcCgBcdI1x
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
remcos
Version
-
2.6.0 Pro
Botnet
-
�����
C2
-
37.252.11.23:7878
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Temp
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
132123dsaasd-Q14G2Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Defender
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
- Blocklisted process makes network request 26 IoCs
flow pid Process 51 4632 cmd.exe 52 4632 cmd.exe 53 4632 cmd.exe 54 4632 cmd.exe 55 4632 cmd.exe 58 4632 cmd.exe 59 4632 cmd.exe 60 4632 cmd.exe 61 4632 cmd.exe 62 4632 cmd.exe 63 4632 cmd.exe 65 4632 cmd.exe 71 4632 cmd.exe 72 4632 cmd.exe 73 4632 cmd.exe 74 4632 cmd.exe 75 4632 cmd.exe 76 4632 cmd.exe 77 4632 cmd.exe 78 4632 cmd.exe 79 4632 cmd.exe 80 4632 cmd.exe 81 4632 cmd.exe 82 4632 cmd.exe 83 4632 cmd.exe 84 4632 cmd.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3084 rundll32.exe 2984 notepad.exe 2984 notepad.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2984 notepad.exe 2984 notepad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3084 rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3084 4532 rundll32.exe 80 PID 4532 wrote to memory of 3084 4532 rundll32.exe 80 PID 4532 wrote to memory of 3084 4532 rundll32.exe 80 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81 PID 3084 wrote to memory of 2984 3084 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b077d22d646da1f217ab922ac25b3b8_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b077d22d646da1f217ab922ac25b3b8_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:4536
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Blocklisted process makes network request
PID:4632
-
-
-