remcos | c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467

General

Target

Image001.exe
Size

1.1MB
MD5

55fd1df4a7482ba442da4b93d4461c41
SHA1

042f6f01b517513d1bd3225385780ecc4d1cda9c
SHA256

c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467
SHA512

a87c3afdb43f1e2fa0e604579f2a81463d3a8dd3fa465a22592e19071879760b7ef0c54119eba195a023c032b483225cf415bad6d0c655292511b3c4d713c677
SSDEEP

12288:LFnv19b1u/+TTR1hxO66kHJhN+tB+HJuxMZcVnYvZR8/xOPKxtV7gqVkH:9f1a0a66kHzO8HJ9cVnE8/xOPitVcqV

Score

10^/10

remcos starmoneynew rat

Malware Config

Extracted

Family

remcos

Botnet

StarMoneyNew

C2

185.252.178.35:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6RGOTF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Image001.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Image001.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Image001.exe

description pid process target process

PID 964 set thread context of 100 964 Image001.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

456 schtasks.exe

description	pid	process	target process
PID 964 set thread context of 100	964	Image001.exe	vbc.exe

pid	process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Image001.exepowershell.exe

pid	process
964	Image001.exe
964	Image001.exe
964	Image001.exe
964	Image001.exe
964	Image001.exe
964	Image001.exe
964	Image001.exe
2020	powershell.exe
2020	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Image001.exepowershell.exe

description pid process

Token: SeDebugPrivilege 964 Image001.exe
Token: SeDebugPrivilege 2020 powershell.exe

description	pid	process
Token: SeDebugPrivilege	964	Image001.exe
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Image001.exe

description	pid	process	target process
PID 964 wrote to memory of 2020	964	Image001.exe	powershell.exe
PID 964 wrote to memory of 2020	964	Image001.exe	powershell.exe
PID 964 wrote to memory of 2020	964	Image001.exe	powershell.exe
PID 964 wrote to memory of 456	964	Image001.exe	schtasks.exe
PID 964 wrote to memory of 456	964	Image001.exe	schtasks.exe
PID 964 wrote to memory of 456	964	Image001.exe	schtasks.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe
PID 964 wrote to memory of 100	964	Image001.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Image001.exe
"C:\Users\Admin\AppData\Local\Temp\Image001.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IpdbFdcvK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IpdbFdcvK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6987.tmp"
2⤵
- Creates scheduled task(s)
PID:456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6987.tmp
Filesize
1KB

MD5
1c98ad95a74351f914d83457ce166f03

SHA1
2e85d9cc07ec4c20447479a1e80bfd02aa4694f6

SHA256
b0bfc75386761913e77e405cf09647ed3935e2412bd652624e41438af510e0ed

SHA512
1e665e02b82cc85567284806f1624224444eb22f83a916b3eb1d1ccb2e1c49602729e778b1af025839bf1cefc1f11c9a1f49df326c348a26da43e65be70017fa

Download Submit
memory/100-150-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/100-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/100-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/100-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/100-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/100-143-0x0000000000000000-mapping.dmp

Download
memory/456-139-0x0000000000000000-mapping.dmp

Download
memory/964-133-0x0000000005F20000-0x00000000064C4000-memory.dmp

Filesize
5.6MB

Download
memory/964-135-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/964-132-0x0000000000E30000-0x0000000000F52000-memory.dmp

Filesize
1.1MB

Download
memory/964-134-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/964-137-0x0000000009BF0000-0x0000000009C56000-memory.dmp

Filesize
408KB

Download
memory/964-136-0x00000000098E0000-0x000000000997C000-memory.dmp

Filesize
624KB

Download
memory/2020-142-0x00000000054D0000-0x0000000005AF8000-memory.dmp

Filesize
6.2MB

Download
memory/2020-153-0x00000000736F0000-0x000000007373C000-memory.dmp

Filesize
304KB

Download
memory/2020-152-0x0000000007270000-0x00000000072A2000-memory.dmp

Filesize
200KB

Download
memory/2020-138-0x0000000000000000-mapping.dmp

Download
memory/2020-161-0x0000000007900000-0x0000000007908000-memory.dmp

Filesize
32KB

Download
memory/2020-151-0x0000000004F90000-0x0000000004FAE000-memory.dmp

Filesize
120KB

Download
memory/2020-148-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Filesize
408KB

Download
memory/2020-147-0x0000000005310000-0x0000000005332000-memory.dmp

Filesize
136KB

Download
memory/2020-154-0x0000000007230000-0x000000000724E000-memory.dmp

Filesize
120KB

Download
memory/2020-155-0x0000000007C30000-0x00000000082AA000-memory.dmp

Filesize
6.5MB

Download
memory/2020-156-0x00000000075E0000-0x00000000075FA000-memory.dmp

Filesize
104KB

Download
memory/2020-157-0x0000000007650000-0x000000000765A000-memory.dmp

Filesize
40KB

Download
memory/2020-158-0x0000000007860000-0x00000000078F6000-memory.dmp

Filesize
600KB

Download
memory/2020-159-0x0000000007810000-0x000000000781E000-memory.dmp

Filesize
56KB

Download
memory/2020-160-0x0000000007920000-0x000000000793A000-memory.dmp

Filesize
104KB

Download
memory/2020-140-0x0000000004D20000-0x0000000004D56000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads