remcos | 3242e8b156688b8925a6aa109a87844a9879d35425c0197128212ab6324d90ae

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
Size

612KB
MD5

49b3efccb302b34666813c88d9d95dae
SHA1

0fd6a780221ef0f620468e512d3beee841f8429e
SHA256

3242e8b156688b8925a6aa109a87844a9879d35425c0197128212ab6324d90ae
SHA512

4b9c692cc40686ca0b224fae128cfba22895bc4f010fbfd40f6dabed7ed0164135141514f5214fe30a48d203ddbdf1cc83ad8ad6dd244ddd14c2a3f0ee5d157f
SSDEEP

12288:XwN8XUsW8uCJjuCn6iQUB8CHPku8TvKNK6KSKF2C1vXRyk5x5PYSvBSc/amlC38e:XdW2spxF91vXRyoIKCUmnYyZ

Score

10^/10

remcos ach discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

ACH

freightmgmt.duckdns.org:691

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-2PRHXT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\notapad = "\"C:\\Users\\Admin\\AppData\\Roaming\\notapad.exe\""	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
9100	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
9100	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
Token: SeDebugPrivilege	9100	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8988	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 8956	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	31
PID 1052 wrote to memory of 8956	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	31
PID 1052 wrote to memory of 8956	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	31
PID 1052 wrote to memory of 8956	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	31
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 1052 wrote to memory of 8988	1052	JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe	32
PID 8956 wrote to memory of 9100	8956	WScript.exe	33
PID 8956 wrote to memory of 9100	8956	WScript.exe	33
PID 8956 wrote to memory of 9100	8956	WScript.exe	33
PID 8956 wrote to memory of 9100	8956	WScript.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Ooasmryksvcoijutafmuelw.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\notapad.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:9100
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49b3efccb302b34666813c88d9d95dae.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:8988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Ooasmryksvcoijutafmuelw.vbs

Filesize
137B

MD5
ab51ffae3c1beb809f59646481b495fc

SHA1
b6e9d6ef0c4265b77442b3cab8e0fc7c95714df1

SHA256
afed9764da68b96f87efc1e26726033d19eb8b83eb9eaf288295fb19e7cb4237

SHA512
086acbefa580ad7c058aa1da05549d49eb1d58cfd5c4020d092550ca52f1a374ab4342a397b8a998fb4708621da344f204c505661dacf0edf37b224c8809dabf

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
148B

MD5
825780ea7109e6f28062d5034c9c82d7

SHA1
352dbe854cce1a24dcd37817a58338922b7c36f2

SHA256
f801391322b4c1c3d2e44ae71d12b9ee5ab9f9323831beb8102daff585e633c6

SHA512
5799456f23b4a7f820a7ded027d30ee5ba085a99c64cdfa7612d90d654ce5bf888fb8be928100e30b3cfc0d8602d94f85783e02c5711f6518f890c7c19fa7a96

Download Submit
memory/1052-64-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-5-0x0000000002220000-0x00000000022A0000-memory.dmp

Filesize
512KB

Download
memory/1052-4-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/1052-62-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-6-0x00000000047C0000-0x0000000004830000-memory.dmp

Filesize
448KB

Download
memory/1052-20-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-26-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-36-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-7-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-52-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-8-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-70-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-10-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-12-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-14-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-60-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-18-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-24-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-68-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-66-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-1-0x00000000002D0000-0x0000000000370000-memory.dmp

Filesize
640KB

Download
memory/1052-3-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/1052-16-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-58-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-56-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-54-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-50-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-48-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-46-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-44-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-42-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-40-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-38-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-34-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-32-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-30-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-28-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-22-0x00000000047C0000-0x0000000004829000-memory.dmp

Filesize
420KB

Download
memory/1052-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/1052-0-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/1052-2046-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/8988-2042-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/8988-2051-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download