remcos | 3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3

General

Target

facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Size

548KB
MD5

facd0a31a1e02e682c1e833935125911
SHA1

fe9949b3a863e6cf002d0d19315a11d78f1afe7f
SHA256

3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3
SHA512

11260cd854fd2ae5dbcd54aa2ca465d9fe5f8b9e7be43297ff3b563e012b215684a1023d2699c2182cd318f9bc52f8eeda0e23d454c4bc36ea5c02ded9af8132
SSDEEP

6144:tcZ017BKfL6oVOiDB9I13IyGKU9nIy/n7+nLCU8+byE/I+SUQvRG:tcU7UL6mt9YE6Mn7+LCv+by+m9g

Score

10^/10

remcos discovery persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	Remc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erwfguyhjnxcj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remc\\Remc.exe\""	Remc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3616	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
3964	Remc.exe
3964	Remc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2212	3616	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	82
PID 3616 wrote to memory of 2212	3616	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	82
PID 3616 wrote to memory of 2212	3616	facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe	82
PID 2212 wrote to memory of 852	2212	WScript.exe	83
PID 2212 wrote to memory of 852	2212	WScript.exe	83
PID 2212 wrote to memory of 852	2212	WScript.exe	83
PID 852 wrote to memory of 3964	852	cmd.exe	85
PID 852 wrote to memory of 3964	852	cmd.exe	85
PID 852 wrote to memory of 3964	852	cmd.exe	85
PID 3964 wrote to memory of 3900	3964	Remc.exe	93
PID 3964 wrote to memory of 3900	3964	Remc.exe	93
PID 3964 wrote to memory of 3900	3964	Remc.exe	93

C:\Users\Admin\AppData\Local\Temp\facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\facd0a31a1e02e682c1e833935125911_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remc\Remc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      C:\Users\Admin\AppData\Roaming\Remc\Remc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
410B

MD5
837b54af2c8d285fb69d719cc9061206

SHA1
b31b75216a46b744eb0d89dd9885431a8ecde820

SHA256
353bf067c7071e2b6904205a0f6755433a8711a4b2a9b48ac32ff538463f0e46

SHA512
6cc4e846538cf16de26004343a157a565fe9730ad5c253e3fb6c64098405849e732bd2216fbdecd52cc3cbcb84e24e4dca23b5fd4f68bcdc0e73d485479e2311

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\Remc.exe

Filesize
548KB

MD5
facd0a31a1e02e682c1e833935125911

SHA1
fe9949b3a863e6cf002d0d19315a11d78f1afe7f

SHA256
3e2adc2b31db675bde5c51b93457cde98aa5df481dea548c3ea7b2eece2927c3

SHA512
11260cd854fd2ae5dbcd54aa2ca465d9fe5f8b9e7be43297ff3b563e012b215684a1023d2699c2182cd318f9bc52f8eeda0e23d454c4bc36ea5c02ded9af8132

Download Submit
C:\Users\Admin\AppData\Roaming\Remc\logs.dat

Filesize
79B

MD5
fdc618692ed8b17f0b49903e1aa1c28d

SHA1
26e99f8e3c305ea6be771c7715df845cebc28d02

SHA256
3ddffd40a420ae92c663f78de0683c3dbecb94d6cfb7ca613fa5f410f1cf7559

SHA512
e7f3f07cdc98facfeef66c0593a2eb2de196bd67e972f2858458178294c16aee6a8be3e27510a15a79c4043b21eee1625674290c63c6775284fbcf10da12d239

Download Submit
memory/3616-2-0x0000000077D31000-0x0000000077E51000-memory.dmp

Filesize
1.1MB

Download
memory/3616-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3616-7-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3616-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3616-12-0x0000000077D31000-0x0000000077E51000-memory.dmp

Filesize
1.1MB

Download
memory/3964-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3964-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3964-24-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads