remcos | 2d131382a95f99413d048cc55d9c053585001bc4e7813f88bed714fc3382cb0c

General

Target

ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
Size

1.1MB
MD5

ea7731870bb2af22b4a27e3c2a34b5ee
SHA1

838f2fcc622b22ab47097be9226c42efe1138d37
SHA256

2d131382a95f99413d048cc55d9c053585001bc4e7813f88bed714fc3382cb0c
SHA512

0b6d5dc13a58b5010fca93bb16f5c47aff80f65e9b23c75c0a152371b84e9e3ff795796dd709e5c6a7af50f083a6a6304478ef016c118c47524968362c47ca38
SSDEEP

24576:+4lavt0LkLL9IMixoEgealNOWU8wE9Eq9MmCS:pkwkn9IMHealNOWfr2aPCS

Score

10^/10

remcos bb discovery rat

Malware Config

Extracted

Family

remcos

Version

1.7.3 Pro

Botnet

BB

C2

SupportWin.dyndns.pro:10066

ServiceWin.Dynamic-DNS.net:10066

Qw3r.xxxy.info:10066

IM36.xxxy.info:10066

45df36.xxxy.info:10066

backend.system-ns.net:10066

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobe
keylog_path
%AppData%
mouse_option
false
mutex
A1s2d3f-A2BYVT
screenshot_crypt
true
screenshot_flag
false
screenshot_folder
Screen
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
true
take_screenshot_time
2
take_screenshot_title
credit;creditcard;kredit;kreditkarte;payment;bitcoin;paypal;bazahl;ausweis;giftcard;card;gutschein

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hcIt9Srplr.eu.url	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2764	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\G.gB

Filesize
112KB

MD5
36547b100f25addf3a8ba8eed6ed5d34

SHA1
e3b5a4d9588d1e6b010d9e091878cd45fd2155ed

SHA256
3f4649dda6a48819cf27304ff9140f87d51796b04773b345af32a21c96c7a359

SHA512
92ecd052105cbcd3cde806d7da8ed198f422fe0cc3347f7991872c8650259915e805bb06f2e71edcffb36bc35be5e086c6ca0eae4d139e65b60ea766534d3d38

Download Submit
memory/2640-9-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2764-20-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-26-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-24-0x00000000FFFDF000-0x00000000FFFE0000-memory.dmp

Filesize
4KB

Download
memory/2764-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-16-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-14-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-28-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-29-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-30-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-33-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-36-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-37-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-39-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-41-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-43-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-45-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-47-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-48-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-50-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing