remcos | 082a3c57ffec44191f71f8b170137a7d1c398b76fc93c5cdcb6714958d50f792

General

Target

e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Size

108KB
MD5

e624205c64a0d6780be9b6c2c0952499
SHA1

d68f80434f0425b67a6f4bb8663b215cad2ace40
SHA256

082a3c57ffec44191f71f8b170137a7d1c398b76fc93c5cdcb6714958d50f792
SHA512

3eaa85190f0d86dbc22595f1873763caf4f3b293356f2d0c3229534b91c27f9e7e21404109b5fd7dee9a4b4ab3d3a21759d9951e13a3e5f3c0746a77f9c49e33
SSDEEP

3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnr+vHI+zIcdBrx:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXq5

Score

10^/10

remcos host discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

Host

C2

agbero.duckdns.org:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
process.exe
copy_folder
Windows Explorer
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
process
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-6WHA5Q
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Process explorer
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Process explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	process.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Process explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	process.exe

Deletes itself 1 IoCs

pid	Process
2348	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
496	process.exe

Loads dropped DLL 2 IoCs

pid	Process
2548	cmd.exe
2548	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Process explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Process explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Process explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	process.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Process explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\process.exe\""	process.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	process.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	process.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
496	process.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2348	2092	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2348	2092	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2348	2092	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2348	2092	e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2548	2348	WScript.exe	31
PID 2348 wrote to memory of 2548	2348	WScript.exe	31
PID 2348 wrote to memory of 2548	2348	WScript.exe	31
PID 2348 wrote to memory of 2548	2348	WScript.exe	31
PID 2548 wrote to memory of 496	2548	cmd.exe	33
PID 2548 wrote to memory of 496	2548	cmd.exe	33
PID 2548 wrote to memory of 496	2548	cmd.exe	33
PID 2548 wrote to memory of 496	2548	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e624205c64a0d6780be9b6c2c0952499_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Windows Explorer\process.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Roaming\Windows Explorer\process.exe
      "C:\Users\Admin\AppData\Roaming\Windows Explorer\process.exe"
      4⤵
      Modifies WinLogon for persistence
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Modifies WinLogon
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
644B

MD5
65fba595a8695e6735510c07e56fe20b

SHA1
4c7e1992deef0bbc8b38ba553b2162368f21f970

SHA256
9307220350a92c86b20e0562193c554d57969a5bc33025382dfefcff29d5c6e3

SHA512
e42c1ba5ccfea1e0668bd303a89c2910d750ea163ab6dc3f16d09a0b6b7e12f7216ac8ded262f7b9503a727ea159e0f42759d3c5ddae30ec068a05d5df1b3628

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Explorer\process.exe

Filesize
108KB

MD5
e624205c64a0d6780be9b6c2c0952499

SHA1
d68f80434f0425b67a6f4bb8663b215cad2ace40

SHA256
082a3c57ffec44191f71f8b170137a7d1c398b76fc93c5cdcb6714958d50f792

SHA512
3eaa85190f0d86dbc22595f1873763caf4f3b293356f2d0c3229534b91c27f9e7e21404109b5fd7dee9a4b4ab3d3a21759d9951e13a3e5f3c0746a77f9c49e33

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads