remcos | 8b4e75273b80e80c8da0b961babd27d1e357d7f3710330de71e0c846ed51dae7

General

Target

d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
Size

977KB
MD5

d358b84a8f0a32cf18b381e0c742d5ce
SHA1

4cd803db44f520fefaf126c0173da90b7b4917ce
SHA256

8b4e75273b80e80c8da0b961babd27d1e357d7f3710330de71e0c846ed51dae7
SHA512

227f13f1d57bbaa1f4d8b6f583d9c743c4aa2726aa24b88d20157bbf0c0f15a50f892f155dd943c383eac3f15d38702e15b00688f71f8326482ef37f0ef02a73
SSDEEP

24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaM5B3wl5:Vh+ZkldoPK8YaML3G

Score

10^/10

remcos 17042019 discovery rat upx

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

17042019

C2

jkamani.xyz:8246

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-56T1Q9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hvax64.url	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3068-1-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3068-7-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3068-8-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3068-9-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3068-12-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 3068	1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe	94

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3068	1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe	94
PID 1476 wrote to memory of 3068	1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe	94
PID 1476 wrote to memory of 3068	1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe	94
PID 1476 wrote to memory of 3068	1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe	94
PID 1476 wrote to memory of 3068	1476	d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d358b84a8f0a32cf18b381e0c742d5ce_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
79B

MD5
5e75ae8071fe932d4256c008cd052e94

SHA1
2f5839d99552f6c8bd95e2fbf7aad85c85b55737

SHA256
80ca03c25758d099b254e092df89b115d377816fdb28cd26ac2d985a6f0dd70f

SHA512
fadcbc825b372b50618d334af772768d4fe2f6487a350740d2a1ed41bb0c0e37736bd6c89de5b8265bf0d3ed2f6f2e2da26aaea220bdcda1e40143d297b8bd6e

Download Submit
memory/1476-0-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/3068-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3068-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3068-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3068-9-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3068-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing