Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-07-2024 04:41

General

  • Target

    662d5ab8f03c44205c00e9f12e99105a_JaffaCakes118.exe

  • Size

    983KB

  • MD5

    662d5ab8f03c44205c00e9f12e99105a

  • SHA1

    df86b024cd1d3135a0056c32c5e682420b4301ad

  • SHA256

    c684c19f26ab739c326667fc6c0ad1d6288846b22da744940e7865bbde25dd00

  • SHA512

    abcec11083f1895767d4a880cef5c03be189f29246062eb45c54bb020e7d51cda84c192bfb285f3e751a2249e731d087eec29cf7db8acf1a485ade93fc040a9f

  • SSDEEP

    24576:Emy2FtwvxuN4HtOOpmF4zH5YOMGk6pbKneG9tK:TXFQINIOOpJzH515gQ

Malware Config

Extracted

Family

remcos

Version

3.0.2 Pro

Botnet

FEB

C2

194.5.98.202:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-8W5M5B

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\662d5ab8f03c44205c00e9f12e99105a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\662d5ab8f03c44205c00e9f12e99105a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\662d5ab8f03c44205c00e9f12e99105a_JaffaCakes118.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3788
            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
              "{path}"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4268
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\SysWOW64\svchost.exe
                7⤵
                  PID:3604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\install.vbs

      Filesize

      418B

      MD5

      ff449f6f7bc5e2d800eb30e2d2c56611

      SHA1

      93419ea805b9ce35a766e5c56db50d54c2d3f94b

      SHA256

      655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416

      SHA512

      02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6

    • C:\Users\Admin\AppData\Roaming\remcos\logs.dat

      Filesize

      74B

      MD5

      e17c3d0d2a74f37e7059fe9ec92828eb

      SHA1

      117755fe80bdd12a1b30404cabd9d2a53697fa65

      SHA256

      ca6b7f1592aa05fd670629f4e18c0cdb7cc3e09f06b4abef918f917e3267928a

      SHA512

      2c9fc2b51f425bf58862a2be389b999992c2f7f3e3c9740d3adf0f74f199af27d0f22d297eed6e70b7b9694e6b883d615ff781ccd82a2421cbe20b0f8c0fe0dc

    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe

      Filesize

      983KB

      MD5

      662d5ab8f03c44205c00e9f12e99105a

      SHA1

      df86b024cd1d3135a0056c32c5e682420b4301ad

      SHA256

      c684c19f26ab739c326667fc6c0ad1d6288846b22da744940e7865bbde25dd00

      SHA512

      abcec11083f1895767d4a880cef5c03be189f29246062eb45c54bb020e7d51cda84c192bfb285f3e751a2249e731d087eec29cf7db8acf1a485ade93fc040a9f

    • memory/2752-6-0x0000000007750000-0x00000000077EC000-memory.dmp

      Filesize

      624KB

    • memory/2752-18-0x0000000074D30000-0x00000000754E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2752-4-0x0000000074D30000-0x00000000754E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2752-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

      Filesize

      4KB

    • memory/2752-7-0x0000000005410000-0x0000000005418000-memory.dmp

      Filesize

      32KB

    • memory/2752-8-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

      Filesize

      4KB

    • memory/2752-9-0x0000000074D30000-0x00000000754E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2752-10-0x00000000078F0000-0x00000000079BC000-memory.dmp

      Filesize

      816KB

    • memory/2752-1-0x0000000000320000-0x000000000041C000-memory.dmp

      Filesize

      1008KB

    • memory/2752-2-0x0000000005430000-0x00000000059D4000-memory.dmp

      Filesize

      5.6MB

    • memory/2752-3-0x0000000004DD0000-0x0000000004E62000-memory.dmp

      Filesize

      584KB

    • memory/2752-5-0x0000000004F80000-0x0000000004F8A000-memory.dmp

      Filesize

      40KB

    • memory/3384-17-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/3384-21-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/3384-14-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/3384-11-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/3384-12-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4268-30-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4268-29-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4268-33-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/4268-36-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB