remcos | c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467

General

Target

Image001.exe
Size

1.1MB
MD5

55fd1df4a7482ba442da4b93d4461c41
SHA1

042f6f01b517513d1bd3225385780ecc4d1cda9c
SHA256

c46b74e0a94456585415b10aa57fe25e85d8bf6405982873e4e58f01c8271467
SHA512

a87c3afdb43f1e2fa0e604579f2a81463d3a8dd3fa465a22592e19071879760b7ef0c54119eba195a023c032b483225cf415bad6d0c655292511b3c4d713c677
SSDEEP

12288:LFnv19b1u/+TTR1hxO66kHJhN+tB+HJuxMZcVnYvZR8/xOPKxtV7gqVkH:9f1a0a66kHzO8HJ9cVnE8/xOPitVcqV

Score

10^/10

remcos starmoneynew rat

Malware Config

Extracted

Family

remcos

Botnet

StarMoneyNew

C2

185.252.178.35:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6RGOTF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Image001.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Image001.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Image001.exe

description pid process target process

PID 5084 set thread context of 4436 5084 Image001.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3668 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Image001.exepowershell.exe

pid process

5084 Image001.exe
5084 Image001.exe
5084 Image001.exe
5084 Image001.exe
4092 powershell.exe
4092 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Image001.exepowershell.exe

description pid process

Token: SeDebugPrivilege 5084 Image001.exe
Token: SeDebugPrivilege 4092 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Image001.exe

description	pid	process	target process
PID 5084 set thread context of 4436	5084	Image001.exe	vbc.exe

pid	process
3668	schtasks.exe

pid	process
5084	Image001.exe
5084	Image001.exe
5084	Image001.exe
5084	Image001.exe
4092	powershell.exe
4092	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5084	Image001.exe
Token: SeDebugPrivilege	4092	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Image001.exe

description	pid	process	target process
PID 5084 wrote to memory of 4092	5084	Image001.exe	powershell.exe
PID 5084 wrote to memory of 4092	5084	Image001.exe	powershell.exe
PID 5084 wrote to memory of 4092	5084	Image001.exe	powershell.exe
PID 5084 wrote to memory of 3668	5084	Image001.exe	schtasks.exe
PID 5084 wrote to memory of 3668	5084	Image001.exe	schtasks.exe
PID 5084 wrote to memory of 3668	5084	Image001.exe	schtasks.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe
PID 5084 wrote to memory of 4436	5084	Image001.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Image001.exe
"C:\Users\Admin\AppData\Local\Temp\Image001.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IpdbFdcvK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IpdbFdcvK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E2F.tmp"
2⤵
- Creates scheduled task(s)
PID:3668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9E2F.tmp
Filesize
1KB

MD5
57e88638aae79c1ed5db87edc23b32fc

SHA1
672e27b7fa4d56fe1490b0dafdee49379a73ad30

SHA256
1f8c1b5238c5079e9c258ca7db65f633ae77d10688609248239732ffc71c7123

SHA512
66ee7fa0bf7f7b98465805847ab0e1934b791ac81025bda5bc3bcea9051e92a4fa694fd92af376e6315e85f6c31c87af702a18371dce649cbe9d75f762bc9249

Download Submit
memory/3668-139-0x0000000000000000-mapping.dmp

Download
memory/4092-153-0x0000000070820000-0x000000007086C000-memory.dmp

Filesize
304KB

Download
memory/4092-150-0x00000000068D0000-0x00000000068EE000-memory.dmp

Filesize
120KB

Download
memory/4092-155-0x0000000008300000-0x000000000897A000-memory.dmp

Filesize
6.5MB

Download
memory/4092-160-0x0000000007FB0000-0x0000000007FCA000-memory.dmp

Filesize
104KB

Download
memory/4092-138-0x0000000000000000-mapping.dmp

Download
memory/4092-154-0x0000000006CC0000-0x0000000006CDE000-memory.dmp

Filesize
120KB

Download
memory/4092-140-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

Filesize
216KB

Download
memory/4092-158-0x0000000007EE0000-0x0000000007F76000-memory.dmp

Filesize
600KB

Download
memory/4092-142-0x0000000005A60000-0x0000000006088000-memory.dmp

Filesize
6.2MB

Download
memory/4092-157-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Filesize
40KB

Download
memory/4092-148-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download
memory/4092-156-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Filesize
104KB

Download
memory/4092-161-0x0000000007F90000-0x0000000007F98000-memory.dmp

Filesize
32KB

Download
memory/4092-159-0x0000000007EA0000-0x0000000007EAE000-memory.dmp

Filesize
56KB

Download
memory/4092-152-0x0000000006F30000-0x0000000006F62000-memory.dmp

Filesize
200KB

Download
memory/4092-149-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/4436-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4436-151-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4436-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4436-143-0x0000000000000000-mapping.dmp

Download
memory/4436-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4436-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5084-133-0x0000000005B40000-0x00000000060E4000-memory.dmp

Filesize
5.6MB

Download
memory/5084-132-0x00000000009A0000-0x0000000000AC2000-memory.dmp

Filesize
1.1MB

Download
memory/5084-135-0x0000000005500000-0x000000000550A000-memory.dmp

Filesize
40KB

Download
memory/5084-134-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download
memory/5084-137-0x00000000095B0000-0x0000000009616000-memory.dmp

Filesize
408KB

Download
memory/5084-136-0x00000000092A0000-0x000000000933C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads