Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2024 02:13

General

  • Target

    91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe

  • Size

    249KB

  • MD5

    91389828fe5ae5e5a96983826c0eb0d0

  • SHA1

    cd21df962aada5660de39ea828fba2d9b1651041

  • SHA256

    5e0414eddc6f66f187a13acfc42cd37568af9f904823e0bceebc5c7f451ea80a

  • SHA512

    5c141d6764a853ab4236951ec5875425f8d2c052fb4d26841176d29762d7fcebb5ad914ab2ec317100c3a2c4f9be1d5434f6601125f992cc977f39f5faad4aa5

  • SSDEEP

    6144:TqjI4LurUOZx18y+LFy5h7ZMhF7g3sj8+ccXt:O/LurdZx18ye0OG3k8Nc9

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

103.89.88.238:4299

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    excel.exe

  • copy_folder

    excel

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    excel

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    excel-8OHAVR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    excel

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\odoomv.dll

    Filesize

    23KB

    MD5

    791b5b4e9636444923a03112bcd4de23

    SHA1

    a99a6985a2cfa4ff2e9171cb330748da5054381d

    SHA256

    d98f8a6e2fb2e874c80f8a974ff777d07d2bee075c8893e1e707b625fb6ec834

    SHA512

    cc64c5a07f8b87718f5e86efa3261af9ee1bca74efab8c42ad13c07a2569b1b8e9402e47d0094bd62f9d16ab740733a833d96369d073c123d5386b7b148ff6a7

  • C:\Users\Admin\AppData\Roaming\excel\logs.dat

    Filesize

    74B

    MD5

    a0af023454bf43e4752ec97a5c6d7aef

    SHA1

    efea56807e51247d8821450948cbea8cde6de0ef

    SHA256

    c449c4d7348dff2bd02694ffe525433229e30499e915a1bc1d9a43ffae335ba0

    SHA512

    6e013dace7ac4fbc522be2afe4db0cc772c4c8df15ef82001feeaad3fbeb2ef937f08d7c4575e642f55c3a6f4e003e69e43e33415eebb0a925fb162a1a0bdd3d

  • \Users\Admin\AppData\Local\Temp\nso582F.tmp\System.dll

    Filesize

    11KB

    MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

    SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

  • memory/2712-12-0x00000000744D0000-0x00000000744DA000-memory.dmp

    Filesize

    40KB

  • memory/2712-15-0x00000000744D0000-0x00000000744DA000-memory.dmp

    Filesize

    40KB

  • memory/2780-25-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-31-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-18-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-21-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-23-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-16-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-27-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-29-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-13-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-17-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-35-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-37-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-39-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-41-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-42-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-45-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2780-49-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB