remcos | 259fc30a379693fe2f11d132ac39141a108098bd96649f6979fdfd0e83b22aae

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe
Size

3.3MB
MD5

fc06fb4a9fb3000799f1a3fd358042be
SHA1

859969ff010454e561d27ec5a4e22e0a3130312d
SHA256

259fc30a379693fe2f11d132ac39141a108098bd96649f6979fdfd0e83b22aae
SHA512

c60abd23990f70a7082cc54ad1750d599ee073956130806bf2b1f9e0defe14896b325a536e96ef8131101cd55ec28c0a6171ab3d1bce05fe6080e0ae9cc2991c
SSDEEP

49152:0Cb8SdqSI9A9VgegW2iC5SUeTI+lp6Qo:0negBH5SU4No

Score

10^/10

remcos tuyrgfdyyt65r85 discovery rat

Malware Config

Extracted

Family

remcos

Version

2.5.1 Pro

Botnet

tuyrgfdyyt65r85

5.252.194.41:5850

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
data.bin
keylog_flag
false
keylog_folder
radio
keylog_path
%Temp%
mouse_option
false
mutex
Remcos-6BMR5A
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 5 IoCs

flow	pid	Process
49	4312	cmd.exe
54	4312	cmd.exe
58	4312	cmd.exe
62	4312	cmd.exe
63	4312	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rel.job	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe
3948	extrac32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3948	extrac32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe
4312	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82
PID 4552 wrote to memory of 3948	4552	fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc06fb4a9fb3000799f1a3fd358042be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\extrac32.exe
  "C:\Windows\system32\extrac32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\radio\data.bin

Filesize
74B

MD5
dd1d14a112383f6c222820dc4b2304c7

SHA1
3ea1cb7296b965c04f6a5c6b0aab05da40fd869e

SHA256
4a1419ac3cbde43b813dd2d867da973564cbb6a3b3590ef6bd23ebf3010719a7

SHA512
e676dc82d836f57b30094b9316ac37dac763ea2f9383cbd6ea6fe2fa55276defeceee9403fe427c12110a9afb1ae440637d6aa96003585696468408d3e08f583

Download Submit
memory/3948-2-0x0000000000D40000-0x0000000000D42000-memory.dmp

Filesize
8KB

Download
memory/3948-16-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/4312-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4312-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4312-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4552-0-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/4552-1-0x00000000027A0000-0x00000000027A9000-memory.dmp

Filesize
36KB

Download
memory/4552-3-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/4552-4-0x0000000000400000-0x0000000000773000-memory.dmp

Filesize
3.4MB

Download
memory/4552-5-0x00000000027A0000-0x00000000027A9000-memory.dmp

Filesize
36KB

Download