remcos | 5e891fc28ecc282029766227008759eaf1ebab30e087f42ccfb5a09090086d36

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe
Size 505KB
Sample240720-ehgfsayepg
SHA256 5e891fc28ecc282029766227008759eaf1ebab30e087f42ccfb5a09090086d36
MD5 5ef00991d84da3671f588e95b8fdefba
SHA1 5536cd41b9e74139af36e6bca7949555f4549e77
SHA512 a52f5a8bdbccd785ca4fcb9a24335104a0a6529db0913980717d7f6345dbb1e83b9c45fa752dbb3094fbd9aab1f7b36e9f519e5b2c6f2a68c02a9105d8c47204
SSDEEP 12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbMQxbNUOMR7k0NrpTxwu:U2G/nvxW3Ww0tMQXUty0NdTxh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos host evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

192.168.0.129:80

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
windowssecurity
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_ptwiwbxxhueblxr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
windowssecurity
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Backdoor.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	backdoor.exe

Executes dropped EXE 3 IoCs

pid	Process
4112	Backdoor.sfx.exe
5024	backdoor.exe
3612	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssecurity = "\"C:\\Windows\\SysWOW64\\windowssecurity\\remcos.exe\""	backdoor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssecurity = "\"C:\\Windows\\SysWOW64\\windowssecurity\\remcos.exe\""	remcos.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windowssecurity\remcos.exe	backdoor.exe
File opened for modification	C:\Windows\SysWOW64\windowssecurity\remcos.exe	backdoor.exe
File opened for modification	C:\Windows\SysWOW64\windowssecurity	backdoor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3700	reg.exe
2980	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1584	PING.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4860	2700	5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe	87
PID 2700 wrote to memory of 4860	2700	5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe	87
PID 2700 wrote to memory of 4860	2700	5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe	87
PID 4860 wrote to memory of 4112	4860	cmd.exe	90
PID 4860 wrote to memory of 4112	4860	cmd.exe	90
PID 4860 wrote to memory of 4112	4860	cmd.exe	90
PID 4112 wrote to memory of 5024	4112	Backdoor.sfx.exe	91
PID 4112 wrote to memory of 5024	4112	Backdoor.sfx.exe	91
PID 4112 wrote to memory of 5024	4112	Backdoor.sfx.exe	91
PID 5024 wrote to memory of 1760	5024	backdoor.exe	92
PID 5024 wrote to memory of 1760	5024	backdoor.exe	92
PID 5024 wrote to memory of 1760	5024	backdoor.exe	92
PID 1760 wrote to memory of 3700	1760	cmd.exe	94
PID 1760 wrote to memory of 3700	1760	cmd.exe	94
PID 1760 wrote to memory of 3700	1760	cmd.exe	94
PID 5024 wrote to memory of 4460	5024	backdoor.exe	95
PID 5024 wrote to memory of 4460	5024	backdoor.exe	95
PID 5024 wrote to memory of 4460	5024	backdoor.exe	95
PID 4460 wrote to memory of 1584	4460	cmd.exe	97
PID 4460 wrote to memory of 1584	4460	cmd.exe	97
PID 4460 wrote to memory of 1584	4460	cmd.exe	97
PID 4460 wrote to memory of 3612	4460	cmd.exe	98
PID 4460 wrote to memory of 3612	4460	cmd.exe	98
PID 4460 wrote to memory of 3612	4460	cmd.exe	98
PID 3612 wrote to memory of 3472	3612	remcos.exe	99
PID 3612 wrote to memory of 3472	3612	remcos.exe	99
PID 3612 wrote to memory of 3472	3612	remcos.exe	99
PID 3472 wrote to memory of 2980	3472	cmd.exe	101
PID 3472 wrote to memory of 2980	3472	cmd.exe	101
PID 3472 wrote to memory of 2980	3472	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ef00991d84da3671f588e95b8fdefba_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Backdoor.sfx.exe
    backdoor.sfx.exe -pasdfghjkl!321 -dC:\Users\Admin\AppData\Local\Temp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\backdoor.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\backdoor.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1760
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:3700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\Windows\SysWOW64\PING.EXE
        
        PING 127.0.0.1 -n 2
        6⤵
        Runs ping.exe
        
        PID:1584
      - C:\Windows\SysWOW64\windowssecurity\remcos.exe
        
        "C:\Windows\SysWOW64\windowssecurity\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Backdoor.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Backdoor.sfx.exe
Size 342KB
SHA256 544eeb457a63e60dff6c7b321336e669093797ab8f9292a99acf69c877fbc78b
MD5 9335b5c46b97a2619012b4df81ddf288
SHA1 e09bcc885a2067634c344758bf5362fe47fbd1b8
SHA512 430b78d75b25584cc8d0a9f8a550ab947db1a5a8549e9367cfdcf6a033dc22cf66438cbeacb7827f5ea58eaa5fa90d854a4b2bd7c1527f06715b327ca12fc038
SSDEEP 6144:ajT5Zh17eWxoG/+ov/2OIQ4wW3OBsCeAW32X+t4Rbx5EZvx:aRZ+IoG/n9IQxW3OBsee2X+t4RbxGZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fud.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat
Size 41B
SHA256 baa43ea6137a5bfd8ce7cf085c17060fb70ffe2c26608f295eb0378aa7393062
MD5 4d37add0df5a7d8f74ab7f6b5718a89d
SHA1 f34c3a72d6aaa75e745f5d40f04e3a7dd08da095
SHA512 aa92a40e3e34c2554960fc1006e2b0b36a20aeb2cea752bbe80a639bdd183b4b2f9d7574373616c37678a44bbd0bde9d5cb44181233580dbba6255d965e0d182
MD5 SHA1 SHA512

Submit Download

Backdoor.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\Backdoor.exe
Size 36KB
SHA256 d74c0282ff56f5f3923aea20542b026c3d675033bfaca3e0a1c6cfc8777fbeba
MD5 8f37e6c2bc95a7c717139870c733f52f
SHA1 ac5356db66a410126044516748a18eec758d0976
SHA512 2e3aa0c360989ce66c5d260f57a0b69863fccd29613fdc725a1a873158eb7539ca5f4062f0cfcbaad3b9051fa1ed085e97423983493146ab965c3232a30bbf38
SSDEEP 768:6NnmZ/8vPlLUdhfJ8v6utFpVsOHjPgpG5N7D11yr1:snwu4DejVdiG5jcr
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 97B
SHA256 19f1154b00d2d8e0d373e5557a38827a51f91c3b7ef09733b3e5e44f025178dd
MD5 2ed2577035731957278d43cf7d57264a
SHA1 52909718f9753d8ba6be214c63481148c821b4f9
SHA512 42c0cba73844a4dbbd44ad80abefe57997f7bd7dec6f4816766f92a8a3e3a82b382c4ce2bfda2e5ee34bfa380f2078efca3f97eda6cfb29cc0f3c5934e2033b6
MD5 SHA1 SHA512

Submit Download

memory/3612-31-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3612-33-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3612-36-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3612-38-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3612-41-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3612-43-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5024-19-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5024-26-0x0000000000400000-0x0000000000419000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads