remcos | c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467

General

Target

Image001.exe
Size

1.1MB
MD5

55fd1df4a7482ba442da4b93d4461c41
SHA1

042f6f01b517513d1bd3225385780ecc4d1cda9c
SHA256

c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467
SHA512

a87c3afdb43f1e2fa0e604579f2a81463d3a8dd3fa465a22592e19071879760b7ef0c54119eba195a023c032b483225cf415bad6d0c655292511b3c4d713c677
SSDEEP

12288:LFnv19b1u/+TTR1hxO66kHJhN+tB+HJuxMZcVnYvZR8/xOPKxtV7gqVkH:9f1a0a66kHzO8HJ9cVnE8/xOPitVcqV

Score

10^/10

remcos starmoneynew rat

Malware Config

Extracted

Family

remcos

Botnet

StarMoneyNew

C2

185.252.178.35:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6RGOTF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Image001.exe

description pid process target process

PID 848 set thread context of 1784 848 Image001.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

560 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Image001.exepowershell.exe

pid process

848 Image001.exe
848 Image001.exe
1664 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Image001.exepowershell.exe

description pid process

Token: SeDebugPrivilege 848 Image001.exe
Token: SeDebugPrivilege 1664 powershell.exe

description	pid	process	target process
PID 848 set thread context of 1784	848	Image001.exe	vbc.exe

pid	process
560	schtasks.exe

pid	process
848	Image001.exe
848	Image001.exe
1664	powershell.exe

description	pid	process
Token: SeDebugPrivilege	848	Image001.exe
Token: SeDebugPrivilege	1664	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Image001.exe

description	pid	process	target process
PID 848 wrote to memory of 1664	848	Image001.exe	powershell.exe
PID 848 wrote to memory of 1664	848	Image001.exe	powershell.exe
PID 848 wrote to memory of 1664	848	Image001.exe	powershell.exe
PID 848 wrote to memory of 1664	848	Image001.exe	powershell.exe
PID 848 wrote to memory of 560	848	Image001.exe	schtasks.exe
PID 848 wrote to memory of 560	848	Image001.exe	schtasks.exe
PID 848 wrote to memory of 560	848	Image001.exe	schtasks.exe
PID 848 wrote to memory of 560	848	Image001.exe	schtasks.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe
PID 848 wrote to memory of 1784	848	Image001.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Image001.exe
"C:\Users\Admin\AppData\Local\Temp\Image001.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IpdbFdcvK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IpdbFdcvK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBBC2.tmp"
2⤵
- Creates scheduled task(s)
PID:560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBBC2.tmp
Filesize
1KB

MD5
8f12b7940dfe9b1f0c523fd9a4a38990

SHA1
70f1a99512cb8efff08ee80cdbe019c2e15a5a75

SHA256
24d1cf419a1e1ba5a86b4ed0c656f28a16c295a171323c0711f9499c0ddd1ce1

SHA512
dec1594f6b70d5cc3dfbc283a8e306e0e78ecab44a88a29747fa162a1a890b43f5eedadc85a05975f0efa5ca1f7961a6fb6e9355984453f826642640cd84d1e8

Download Submit
memory/560-60-0x0000000000000000-mapping.dmp

Download
memory/848-54-0x0000000001270000-0x0000000001392000-memory.dmp

Filesize
1.1MB

Download
memory/848-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/848-56-0x0000000000280000-0x0000000000296000-memory.dmp

Filesize
88KB

Download
memory/848-57-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/848-58-0x0000000008030000-0x0000000008102000-memory.dmp

Filesize
840KB

Download
memory/848-63-0x0000000008300000-0x000000000837C000-memory.dmp

Filesize
496KB

Download
memory/1664-59-0x0000000000000000-mapping.dmp

Download
memory/1664-83-0x000000006E680000-0x000000006EC2B000-memory.dmp

Filesize
5.7MB

Download
memory/1664-81-0x000000006E680000-0x000000006EC2B000-memory.dmp

Filesize
5.7MB

Download
memory/1784-69-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-71-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-77-0x00000000004327A4-mapping.dmp

Download
memory/1784-76-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-80-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-82-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-64-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1784-84-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads