remcos | 7571ebe6ed5e4da21e0317e7236afcb5635f0437cd020b1668f7049b2555993c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
Size 408KB
Sample240724-cf36nasarq
SHA256 7571ebe6ed5e4da21e0317e7236afcb5635f0437cd020b1668f7049b2555993c
MD5 69d87778f9e68baeaf138671c04770d5
SHA1 c1da975b4740c8426e2a4f87423b669f16b709ac
SHA512 9d63943ed76f983359ef192c3fad88c23f85c120d59bac708d526397a1b2f5031d06293ef2ebc1b5e08ec72b247d78d6965c269c389d4f2999c319efcfc2e2c0
SSDEEP 6144:Ef/9jiDZ+a+fl/0nZNpejVDzaLP31uz3okHvV8QRy4BrMn/tCTMBr7iC4/R6HMzj:Cxih+J0nZ/QVv6Y+sBInCwlrH0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

3.0.1 Pro

Botnet

RemoteHost

capriteam.ddns.net:1010

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-VHHYND
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
2500	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
4028	remcos.exe
2860	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3824 set thread context of 404	3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	92
PID 4028 set thread context of 2860	4028	remcos.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
4028	remcos.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
4028	remcos.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 404	3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	92
PID 3824 wrote to memory of 404	3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	92
PID 3824 wrote to memory of 404	3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	92
PID 3824 wrote to memory of 404	3824	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	92
PID 404 wrote to memory of 2500	404	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	93
PID 404 wrote to memory of 2500	404	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	93
PID 404 wrote to memory of 2500	404	69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe	93
PID 2500 wrote to memory of 1572	2500	WScript.exe	94
PID 2500 wrote to memory of 1572	2500	WScript.exe	94
PID 2500 wrote to memory of 1572	2500	WScript.exe	94
PID 1572 wrote to memory of 4028	1572	cmd.exe	96
PID 1572 wrote to memory of 4028	1572	cmd.exe	96
PID 1572 wrote to memory of 4028	1572	cmd.exe	96
PID 4028 wrote to memory of 2860	4028	remcos.exe	99
PID 4028 wrote to memory of 2860	4028	remcos.exe	99
PID 4028 wrote to memory of 2860	4028	remcos.exe	99
PID 4028 wrote to memory of 2860	4028	remcos.exe	99

C:\Users\Admin\AppData\Local\Temp\69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\69d87778f9e68baeaf138671c04770d5_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 622B
SHA256 ed2cb41d92ee78274d3b6d402a773bb966f0085b1ad3253f082449a199491fc2
MD5 68bb08003b54b152263ad62df78d1511
SHA1 b236d8a9c590f1caf67956cff2d01aa533223900
SHA512 a54d017aace7ed3cd69846d41978b260a63b668b35483f7ce97a969a5bcb64ad5ec417215dae40370c5d2107045b0b9bf15145c001b1023e312cbef2ebc54491
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 408KB
SHA256 7571ebe6ed5e4da21e0317e7236afcb5635f0437cd020b1668f7049b2555993c
MD5 69d87778f9e68baeaf138671c04770d5
SHA1 c1da975b4740c8426e2a4f87423b669f16b709ac
SHA512 9d63943ed76f983359ef192c3fad88c23f85c120d59bac708d526397a1b2f5031d06293ef2ebc1b5e08ec72b247d78d6965c269c389d4f2999c319efcfc2e2c0
SSDEEP 6144:Ef/9jiDZ+a+fl/0nZNpejVDzaLP31uz3okHvV8QRy4BrMn/tCTMBr7iC4/R6HMzj:Cxih+J0nZ/QVv6Y+sBInCwlrH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-18-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/404-5-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/404-6-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/404-7-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/404-13-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/404-12-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/404-20-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-31-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/2860-39-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-44-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-43-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-29-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/2860-42-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-32-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-33-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-34-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-35-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-36-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-37-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-38-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-41-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2860-40-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3824-14-0x0000000000AC0000-0x0000000000AC5000-memory.dmp

Download

memory/3824-2-0x0000000077232000-0x0000000077233000-memory.dmp

Download

memory/3824-3-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/3824-4-0x0000000000AC0000-0x0000000000AC5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads