remcos | 4ee463200a2e23f5f8cd27820da94a17de71dfbcdd4793524262d6ab2099b44c

General

Target

d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
Size

233KB
MD5

d4ac7bbda85aebcfdceb1989f81ac1c9
SHA1

58104a1c576cd4bc6f3218589c6d8d927a852068
SHA256

4ee463200a2e23f5f8cd27820da94a17de71dfbcdd4793524262d6ab2099b44c
SHA512

39fa6e5ccab2521876d3ee55ebafdeefb79293223f194b401cb004a11fc9507a6772b4d6219149c172c2832f322c56cf2d8d80353386d95d2565f08de5017565
SSDEEP

3072:yBkfJpRXATwMdFCcM6HbgkHL7CgLuGkH7zX+dFReLF/Bbnz+eE+2ErDBjCoit:yqjIGezCgLuGy+TkB/9z+Wj4t

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

103.89.88.238:4299

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
excel.exe
copy_folder
excel
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
excel
keylog_path
%AppData%
mouse_option
false
mutex
excel-8OHAVR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
excel
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 2 IoCs

pid	Process
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\name = "C:\\Users\\Admin\\AppData\\Roaming\\folder\\file.exe"	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2980 set thread context of 2520	2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2520	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2520	2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2520	2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2520	2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2520	2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2520	2980	d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d4ac7bbda85aebcfdceb1989f81ac1c9_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\excel\logs.dat

Filesize
74B

MD5
7799be99414923ff2276ed43a3d51980

SHA1
494962a85ed312601b3c5079473e1eb8083a6ea8

SHA256
914d7ba742aed92529a1833266b89094ce616bcd28569da1850e96b79e86a22f

SHA512
7b730062d742dd8cb0a9be201c4a8ad6866eb5de13482affc376564635df2f47a0a50bb07b62e1a752600de42708c4670f9a6c37009d5d40b6fe5c3ec36b7442

Download Submit
\Users\Admin\AppData\Local\Temp\k84i936.dll

Filesize
13KB

MD5
7c0a51de29d404c903e2768e6d083ba6

SHA1
af1177ab91ca26ca84c096df4dc1f36363f21520

SHA256
f6c7ccbb1f2c879b7788e284301360e65d983ee000b1d69efbc9cdb60820b734

SHA512
3091c385603723769adb29f484548b8c7da3610bb588fc37359043c897fc9d1e69740a117b4be6f0c95e278c2b72ade6efc81e86523f33e82d297ceb7d1c08a9

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB175.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/2520-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-49-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-31-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-45-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-33-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-35-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-36-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2520-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2980-11-0x0000000074E70000-0x0000000074E78000-memory.dmp

Filesize
32KB

Download
memory/2980-16-0x0000000074E70000-0x0000000074E78000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads