Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 10:38
Static task
static1
Behavioral task
behavioral1
Sample
3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
3d0807aa99589883f5dc7cb8fb6490d5
-
SHA1
40e1d6397069aa7a02d04878df48a75ae0031c1f
-
SHA256
cda3c2f396a4e635e9b1021a9bce498172e893e38af0de9790b682d0ca925f63
-
SHA512
fb332eb89421a6925b04565bf22919b0fe73549314dc9855b4119bcf22d594bdd4e4918f4aebdf252c89fb48c3a5e6678d59852b49d3904af67d8557dc01440c
-
SSDEEP
24576:lmGohjnimx7shSysvR0RhZPpFYDHvGABsTn57Rv1bVpf/GH0gIq:av4yCRMH+JJRJ1M
Malware Config
Extracted
remcos
2.6.0 Pro
�����
37.252.11.23:7878
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Temp
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
132123dsaasd-Q14G2Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Defender
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Blocklisted process makes network request 31 IoCs
Processes:
cmd.exeflow pid process 37 4868 cmd.exe 38 4868 cmd.exe 39 4868 cmd.exe 40 4868 cmd.exe 41 4868 cmd.exe 44 4868 cmd.exe 45 4868 cmd.exe 46 4868 cmd.exe 47 4868 cmd.exe 48 4868 cmd.exe 49 4868 cmd.exe 50 4868 cmd.exe 51 4868 cmd.exe 52 4868 cmd.exe 54 4868 cmd.exe 57 4868 cmd.exe 59 4868 cmd.exe 60 4868 cmd.exe 61 4868 cmd.exe 62 4868 cmd.exe 63 4868 cmd.exe 64 4868 cmd.exe 65 4868 cmd.exe 66 4868 cmd.exe 67 4868 cmd.exe 68 4868 cmd.exe 69 4868 cmd.exe 70 4868 cmd.exe 71 4868 cmd.exe 72 4868 cmd.exe 73 4868 cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\ctmon.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exenotepad.exepid process 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe 3732 notepad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
notepad.exepid process 3732 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exedescription pid process target process PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe PID 4968 wrote to memory of 3732 4968 3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d0807aa99589883f5dc7cb8fb6490d5_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
PID:4868