remcos | 0bec16111e2199d4f62882cd59c2e3868b5c7539e64f5f3fb16dde94e2b4292e

General

Target

cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe
Size

556KB
MD5

cbd453d3cca0a21f19e5d2f1b2f2cdd5
SHA1

b5b2d7139500f1a45c9e85e7a278d59ab0e6dac4
SHA256

0bec16111e2199d4f62882cd59c2e3868b5c7539e64f5f3fb16dde94e2b4292e
SHA512

7ede9637c2fdb3640bdd2fb7bc81e7ba96b85dd6154ba68e4ff45469d9597bcca9ff76765ef16f28782d5ee50168a9323082a3d05b5fcb1ece4fe21e4f0eb66e
SSDEEP

6144:D3zSXlx+8X8zqLoDpNAZF6HdygYEuH0u4N51cz/XtD/yld9K753:jWXTZsuMDpKT68gYEuUp50try1K7F

Score

10^/10

remcos discovery persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	Remc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 3864	1160	Remc.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5004	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe
1160	Remc.exe
1160	Remc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4420	5004	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe	88
PID 5004 wrote to memory of 4420	5004	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe	88
PID 5004 wrote to memory of 4420	5004	cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe	88
PID 4420 wrote to memory of 1504	4420	WScript.exe	89
PID 4420 wrote to memory of 1504	4420	WScript.exe	89
PID 4420 wrote to memory of 1504	4420	WScript.exe	89
PID 1504 wrote to memory of 1160	1504	cmd.exe	91
PID 1504 wrote to memory of 1160	1504	cmd.exe	91
PID 1504 wrote to memory of 1160	1504	cmd.exe	91
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97
PID 1160 wrote to memory of 3864	1160	Remc.exe	97

C:\Users\Admin\AppData\Local\Temp\cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cbd453d3cca0a21f19e5d2f1b2f2cdd5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
410B

MD5
837b54af2c8d285fb69d719cc9061206

SHA1
b31b75216a46b744eb0d89dd9885431a8ecde820

SHA256
353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46

SHA512
6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

Filesize
556KB

MD5
cbd453d3cca0a21f19e5d2f1b2f2cdd5

SHA1
b5b2d7139500f1a45c9e85e7a278d59ab0e6dac4

SHA256
0bec16111e2199d4f62882cd59c2e3868b5c7539e64f5f3fb16dde94e2b4292e

SHA512
7ede9637c2fdb3640bdd2fb7bc81e7ba96b85dd6154ba68e4ff45469d9597bcca9ff76765ef16f28782d5ee50168a9323082a3d05b5fcb1ece4fe21e4f0eb66e

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\logs.dat

Filesize
79B

MD5
5005b2aba1a0df9358d70d026f32ca42

SHA1
f74b78293675428b355b9f0544fb15f50cb58215

SHA256
1a55ee89ed8fd17bceacd09fd699e1b049250df1269f2337eab999f639e7b30a

SHA512
f9f1a1e6cd568741f22ac3d0f1a8212d3f13ad07b6e7af7ed35fb7d14cd99482f239797294bb2ff114ab63b433d3c6df147cba2fa899cd1f2c1499a014b7098a

Download Submit
memory/1160-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1160-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3864-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5004-2-0x00000000776F1000-0x0000000077811000-memory.dmp

Filesize
1.1MB

Download
memory/5004-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5004-7-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5004-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads