remcos | 2d131382a95f99413d048cc55d9c053585001bc4e7813f88bed714fc3382cb0c

General

Target

ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
Size

1.1MB
MD5

ea7731870bb2af22b4a27e3c2a34b5ee
SHA1

838f2fcc622b22ab47097be9226c42efe1138d37
SHA256

2d131382a95f99413d048cc55d9c053585001bc4e7813f88bed714fc3382cb0c
SHA512

0b6d5dc13a58b5010fca93bb16f5c47aff80f65e9b23c75c0a152371b84e9e3ff795796dd709e5c6a7af50f083a6a6304478ef016c118c47524968362c47ca38
SSDEEP

24576:+4lavt0LkLL9IMixoEgealNOWU8wE9Eq9MmCS:pkwkn9IMHealNOWfr2aPCS

Score

10^/10

remcos bb discovery rat

Malware Config

Extracted

Family

remcos

Version

1.7.3 Pro

Botnet

BB

C2

SupportWin.dyndns.pro:10066

ServiceWin.Dynamic-DNS.net:10066

Qw3r.xxxy.info:10066

IM36.xxxy.info:10066

45df36.xxxy.info:10066

backend.system-ns.net:10066

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobe
keylog_path
%AppData%
mouse_option
false
mutex
A1s2d3f-A2BYVT
screenshot_crypt
true
screenshot_flag
false
screenshot_folder
Screen
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
true
take_screenshot_time
2
take_screenshot_title
credit;creditcard;kredit;kreditkarte;payment;bitcoin;paypal;bazahl;ausweis;giftcard;card;gutschein

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hcIt9Srplr.eu.url	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	1732	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85
PID 3384 wrote to memory of 1732	3384	ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ea7731870bb2af22b4a27e3c2a34b5ee_JaffaCakes118.exe"
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 12
    3⤵
    - Program crash
    PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1732 -ip 1732
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autCB20.tmp

Filesize
112KB

MD5
36547b100f25addf3a8ba8eed6ed5d34

SHA1
e3b5a4d9588d1e6b010d9e091878cd45fd2155ed

SHA256
3f4649dda6a48819cf27304ff9140f87d51796b04773b345af32a21c96c7a359

SHA512
92ecd052105cbcd3cde806d7da8ed198f422fe0cc3347f7991872c8650259915e805bb06f2e71edcffb36bc35be5e086c6ca0eae4d139e65b60ea766534d3d38

Download Submit
memory/1732-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3384-10-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing