remcos | 90bd940eed30183ce45dcb4b50c1f521761e5229f8d6b315d2f18950b7b92d13

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
Size

1.4MB
MD5

bf69775900e6b43105c2491bfde96440
SHA1

e08c017f9194da43c2b377c5469cc07c35496fcc
SHA256

90bd940eed30183ce45dcb4b50c1f521761e5229f8d6b315d2f18950b7b92d13
SHA512

23085f44b303fe429767aafb60386b2f2f465f5f16842adbb041232798bdc7190067491d696a73d08e8e0b775089307f63219a1623246951266ed5b2f848cea7
SSDEEP

24576:3x1ZZfx3L4kwo2npC+/Pb0bEoqJpSjB3ZV8/F6XI0:h5fx3Lanbz0QoqJEBj

Score

10^/10

remcos host discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

office1.servemp3.com:2017

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
chrom.exe
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
remcos_zcfgsdehenjeyud
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
green
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	chrom.exe

Executes dropped EXE 2 IoCs

pid	Process
4668	chrom.exe
3016	chrom.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\green = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrom.exe\""	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\green = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrom.exe\""	chrom.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3216 set thread context of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 4668 set thread context of 3016	4668	chrom.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2264	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2264	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe
4476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4668	chrom.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
Token: SeDebugPrivilege	4668	chrom.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	chrom.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4864	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	97
PID 3216 wrote to memory of 4864	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	97
PID 3216 wrote to memory of 4864	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	97
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 3216 wrote to memory of 4676	3216	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	99
PID 4676 wrote to memory of 3108	4676	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	100
PID 4676 wrote to memory of 3108	4676	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	100
PID 4676 wrote to memory of 3108	4676	bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe	100
PID 3108 wrote to memory of 2264	3108	cmd.exe	102
PID 3108 wrote to memory of 2264	3108	cmd.exe	102
PID 3108 wrote to memory of 2264	3108	cmd.exe	102
PID 3108 wrote to memory of 4668	3108	cmd.exe	103
PID 3108 wrote to memory of 4668	3108	cmd.exe	103
PID 3108 wrote to memory of 4668	3108	cmd.exe	103
PID 4668 wrote to memory of 4476	4668	chrom.exe	107
PID 4668 wrote to memory of 4476	4668	chrom.exe	107
PID 4668 wrote to memory of 4476	4668	chrom.exe	107
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109
PID 4668 wrote to memory of 3016	4668	chrom.exe	109

C:\Users\Admin\AppData\Local\Temp\bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wLVduNdU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE589.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bf69775900e6b43105c2491bfde96440_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2264
  - - C:\Users\Admin\AppData\Roaming\chrom.exe
      "C:\Users\Admin\AppData\Roaming\chrom.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wLVduNdU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE35.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4476
    - - C:\Users\Admin\AppData\Roaming\chrom.exe
        
        "C:\Users\Admin\AppData\Roaming\chrom.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
91B

MD5
a39ae7cc6c427cc32cf9424241433a61

SHA1
dae03ad10ca1012fb1586ca112a466360fd97092

SHA256
c590eca67440b1e7a35726ea620d6787f82cc096a6b455b80aabb86cfd24d497

SHA512
5e15c6e01fb86f8f6733f4900ce17c5a3e9538823a67aa6ee81bb8180365f72123969a2ddf0f2dd4a238832af02df3987cd2b7bcb149938144cf06a123366f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE589.tmp

Filesize
1KB

MD5
5c64fcb673083b8c816fe3e9ab344e49

SHA1
7deda6c282199b36bfede1eaa03b21361fe1ffc0

SHA256
eb06e91a888c5797c66affc6b48ec9f359ddaac38e760eea8aa47671545ff803

SHA512
2bf40e99bd69867daacd2b9cebbb827a15c60fddb438df70f1fa107db3ea3c2650c2cdbd9f4b5626fa0c4794f41d1a2c4e21c5a1265bb511ff0d72c88f436003

Download Submit
C:\Users\Admin\AppData\Roaming\chrom.exe

Filesize
1.4MB

MD5
bf69775900e6b43105c2491bfde96440

SHA1
e08c017f9194da43c2b377c5469cc07c35496fcc

SHA256
90bd940eed30183ce45dcb4b50c1f521761e5229f8d6b315d2f18950b7b92d13

SHA512
23085f44b303fe429767aafb60386b2f2f465f5f16842adbb041232798bdc7190067491d696a73d08e8e0b775089307f63219a1623246951266ed5b2f848cea7

Download Submit
memory/3016-26-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3016-27-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3216-0-0x00007FF831DD0000-0x00007FF831FC5000-memory.dmp

Filesize
2.0MB

Download
memory/3216-10-0x00007FF831DD0000-0x00007FF831FC5000-memory.dmp

Filesize
2.0MB

Download
memory/4676-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4676-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4676-14-0x00007FF831DD0000-0x00007FF831FC5000-memory.dmp

Filesize
2.0MB

Download