remcos | c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467

General

Target

Image001.exe
Size

1.1MB
MD5

55fd1df4a7482ba442da4b93d4461c41
SHA1

042f6f01b517513d1bd3225385780ecc4d1cda9c
SHA256

c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467
SHA512

a87c3afdb43f1e2fa0e604579f2a81463d3a8dd3fa465a22592e19071879760b7ef0c54119eba195a023c032b483225cf415bad6d0c655292511b3c4d713c677
SSDEEP

12288:LFnv19b1u/+TTR1hxO66kHJhN+tB+HJuxMZcVnYvZR8/xOPKxtV7gqVkH:9f1a0a66kHzO8HJ9cVnE8/xOPitVcqV

Score

10^/10

remcos starmoneynew rat

Malware Config

Extracted

Family

remcos

Botnet

StarMoneyNew

C2

185.252.178.35:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6RGOTF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Image001.exe

description pid process target process

PID 2020 set thread context of 560 2020 Image001.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1676 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Image001.exepowershell.exe

pid process

2020 Image001.exe
2020 Image001.exe
2020 Image001.exe
2020 Image001.exe
1772 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Image001.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2020 Image001.exe
Token: SeDebugPrivilege 1772 powershell.exe

description	pid	process	target process
PID 2020 set thread context of 560	2020	Image001.exe	vbc.exe

pid	process
1676	schtasks.exe

pid	process
2020	Image001.exe
2020	Image001.exe
2020	Image001.exe
2020	Image001.exe
1772	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2020	Image001.exe
Token: SeDebugPrivilege	1772	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Image001.exe

description	pid	process	target process
PID 2020 wrote to memory of 1772	2020	Image001.exe	powershell.exe
PID 2020 wrote to memory of 1772	2020	Image001.exe	powershell.exe
PID 2020 wrote to memory of 1772	2020	Image001.exe	powershell.exe
PID 2020 wrote to memory of 1772	2020	Image001.exe	powershell.exe
PID 2020 wrote to memory of 1676	2020	Image001.exe	schtasks.exe
PID 2020 wrote to memory of 1676	2020	Image001.exe	schtasks.exe
PID 2020 wrote to memory of 1676	2020	Image001.exe	schtasks.exe
PID 2020 wrote to memory of 1676	2020	Image001.exe	schtasks.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe
PID 2020 wrote to memory of 560	2020	Image001.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Image001.exe
"C:\Users\Admin\AppData\Local\Temp\Image001.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IpdbFdcvK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IpdbFdcvK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp"
2⤵
- Creates scheduled task(s)
PID:1676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp
Filesize
1KB

MD5
07297125c81b2bcb71546aea35108232

SHA1
6b4961716640458e9a4e2e26e32c0dffc0a1c99d

SHA256
aa7dddee851342da5b77af4cd8e5378ae68e5654083fd57c5f16dc382b13c5b4

SHA512
02f69e2ae4d02e869a328c0f2238aecc7a76d88e3fccd5e4bde548bec1bc1f1e66badee43918a7f2167beb223ed2abe144d710f8418c1b4a19dd44a30d8947c4

Download Submit
memory/560-77-0x00000000004327A4-mapping.dmp

Download
memory/560-80-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-69-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-83-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-71-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-81-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-64-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-76-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-61-0x0000000000000000-mapping.dmp

Download
memory/1772-84-0x000000006E5F0000-0x000000006EB9B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-82-0x000000006E5F0000-0x000000006EB9B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-59-0x0000000000000000-mapping.dmp

Download
memory/2020-56-0x00000000006B0000-0x00000000006C6000-memory.dmp

Filesize
88KB

Download
memory/2020-57-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/2020-54-0x0000000000D70000-0x0000000000E92000-memory.dmp

Filesize
1.1MB

Download
memory/2020-63-0x0000000005200000-0x000000000527C000-memory.dmp

Filesize
496KB

Download
memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-58-0x0000000008020000-0x00000000080F2000-memory.dmp

Filesize
840KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads