remcos | 259fc30a379693fe2f11d132ac39141a108098bd96649f6979fdfd0e83b22aae

Analysis

max time kernel
3s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe
Size

3.3MB
MD5

fc06fb4a9fb3000799f1a3fd358042be
SHA1

859969ff010454e561d27ec5a4e22e0a3130312d
SHA256

259fc30a379693fe2f11d132ac39141a108098bd96649f6979fdfd0e83b22aae
SHA512

c60abd23990f70a7082cc54ad1750d599ee073956130806bf2b1f9e0defe14896b325a536e96ef8131101cd55ec28c0a6171ab3d1bce05fe6080e0ae9cc2991c
SSDEEP

49152:0Cb8SdqSI9A9VgegW2iC5SUeTI+lp6Qo:0negBH5SU4No

Score

10^/10

remcos tuyrgfdyyt65r85 discovery rat

Malware Config

Extracted

Family

remcos

Version

2.5.1 Pro

Botnet

tuyrgfdyyt65r85

5.252.194.41:5850

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
data.bin
keylog_flag
false
keylog_folder
radio
keylog_path
%Temp%
mouse_option
false
mutex
Remcos-6BMR5A
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2656	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2656
- C:\Windows\SysWOW64\extrac32.exe
  "C:\Windows\system32\extrac32.exe"
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\radio\data.bin

Filesize
74B

MD5
64e89b704eeaac013fa4f57cb635807d

SHA1
249423d7f1cba275fd2a38de883706e3549fd40a

SHA256
c083d0bc5cdc6e5254260d8ef1c5dea2c292e48d00674ea2f4c6ec52ce0ca01e

SHA512
997e6ef3b5a109f5b91c774802c956f31c2bd78814458b6c804a68a1257dee477e6f8d94933f1681e4d87ef9c5a36ece93d881841564d5147125bd321ec4c688

Download Submit
memory/1832-25-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1832-2-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download
memory/1832-36-0x0000000004520000-0x0000000004555000-memory.dmp

Filesize
212KB

Download
memory/1832-27-0x0000000077C70000-0x0000000077E19000-memory.dmp

Filesize
1.7MB

Download
memory/1832-26-0x0000000004520000-0x0000000004555000-memory.dmp

Filesize
212KB

Download
memory/2656-4-0x0000000000400000-0x0000000000773000-memory.dmp

Filesize
3.4MB

Download
memory/2656-5-0x00000000002C0000-0x00000000002C9000-memory.dmp

Filesize
36KB

Download
memory/2656-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2656-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2656-1-0x00000000002C0000-0x00000000002C9000-memory.dmp

Filesize
36KB

Download
memory/3004-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-30-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download
memory/3004-31-0x0000000077C70000-0x0000000077E19000-memory.dmp

Filesize
1.7MB

Download
memory/3004-39-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-43-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-45-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download