remcos | 3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3

General

Target

facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Size

548KB
MD5

facd0a31a1e02e682c1e833935125911
SHA1

fe9949b3a863e6cf002d0d19315a11d78f1afe7f
SHA256

3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3
SHA512

11260cd854fd2ae5dbcd54aa2ca465d9fe5f8b9e7be43297ff3b563e012b215684a1023d2699c2182cd318f9bc52f8eeda0e23d454c4bc36ea5c02ded9af8132
SSDEEP

6144:tcZ017BKfL6oVOiDB9I13IyGKU9nIy/n7+nLCU8+byE/I+SUQvRG:tcU7UL6mt9YE6Mn7+LCv+by+m9g

Score

10^/10

remcos discovery persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
2776	Remc.exe

Loads dropped DLL 2 IoCs

pid	Process
2560	cmd.exe
2560	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 2852	2776	Remc.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3012	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
2776	Remc.exe
2776	Remc.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3012	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
2776	Remc.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2168	3012	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2168	3012	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2168	3012	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2168	3012	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2560	2168	WScript.exe	31
PID 2168 wrote to memory of 2560	2168	WScript.exe	31
PID 2168 wrote to memory of 2560	2168	WScript.exe	31
PID 2168 wrote to memory of 2560	2168	WScript.exe	31
PID 2560 wrote to memory of 2776	2560	cmd.exe	33
PID 2560 wrote to memory of 2776	2560	cmd.exe	33
PID 2560 wrote to memory of 2776	2560	cmd.exe	33
PID 2560 wrote to memory of 2776	2560	cmd.exe	33
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34
PID 2776 wrote to memory of 2852	2776	Remc.exe	34

C:\Users\Admin\AppData\Local\Temp\facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
410B

MD5
837b54af2c8d285fb69d719cc9061206

SHA1
b31b75216a46b744eb0d89dd9885431a8ecde820

SHA256
353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46

SHA512
6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\logs.dat

Filesize
79B

MD5
3b856f099b0bce698887117649d83f97

SHA1
c553e1f2984761d1c369ae933398e7aa0bbfebcf

SHA256
d280ef41a84b123745c79226f2523c54c7fd5e9bddae96540fdae685a550c53d

SHA512
a77c9167d29defa1f10ebc8f2fa08ca250e6392a9eb7ceb1d38cd62c28faf937b409ef0ea0fad929b47700d5a806c9b91fbe2d4ee2364b4f3b6ce9ccc50ad7b5

Download Submit
\Users\Admin\AppData\Roaming\Remc\Remc.exe

Filesize
548KB

MD5
facd0a31a1e02e682c1e833935125911

SHA1
fe9949b3a863e6cf002d0d19315a11d78f1afe7f

SHA256
3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3

SHA512
11260cd854fd2ae5dbcd54aa2ca465d9fe5f8b9e7be43297ff3b563e012b215684a1023d2699c2182cd318f9bc52f8eeda0e23d454c4bc36ea5c02ded9af8132

Download Submit
memory/2776-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2776-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-34-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-26-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-24-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-37-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2852-32-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3012-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3012-2-0x00000000779F0000-0x0000000077AC6000-memory.dmp

Filesize
856KB

Download
memory/3012-11-0x0000000072940000-0x0000000072A60000-memory.dmp

Filesize
1.1MB

Download
memory/3012-7-0x0000000072940000-0x0000000072A60000-memory.dmp

Filesize
1.1MB

Download
memory/3012-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3012-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads