remcos | 9842a24ddd591720659066c52c5ebd930179c95013f1697dc1013243983f2ea2

General

Target

Revised PO-2022092903_________________________.exe
Size

1.0MB
MD5

a41058fb1d301dcc5d91f9821fb320fa
SHA1

0133b20bef1df5c0dfbec2f2d688f61819e34072
SHA256

9842a24ddd591720659066c52c5ebd930179c95013f1697dc1013243983f2ea2
SHA512

ea29d3ea112c74a3370ca3f832d5cb55d896d894133f829119d2958bcca19f28b6eac58073ff380622e44bc33b0b93bdfe24625683c1c83d5b497774cd4f55c1
SSDEEP

24576:5n1b3CwVipVhCB1Z2+GP7mbQN96LrqyneUcNq0J:1B3CMivh40pPybDrqQeZfJ

Score

10^/10

remcos starmoneynew rat

Malware Config

Extracted

Family

remcos

Botnet

StarMoneyNew

C2

185.252.178.35:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6RGOTF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

Revised PO-2022092903_________________________.exe

description	pid	process	target process
PID 1492 set thread context of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1488 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Revised PO-2022092903_________________________.exepowershell.exe

pid process

1492 Revised PO-2022092903_________________________.exe
1492 Revised PO-2022092903_________________________.exe
672 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Revised PO-2022092903_________________________.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1492 Revised PO-2022092903_________________________.exe
Token: SeDebugPrivilege 672 powershell.exe

pid	process
1488	schtasks.exe

pid	process
1492	Revised PO-2022092903_________________________.exe
1492	Revised PO-2022092903_________________________.exe
672	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1492	Revised PO-2022092903_________________________.exe
Token: SeDebugPrivilege	672	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Revised PO-2022092903_________________________.exe

C:\Users\Admin\AppData\Local\Temp\Revised PO-2022092903_________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Revised PO-2022092903_________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LRYDcgZlIWOTzQ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LRYDcgZlIWOTzQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9DE.tmp"
2⤵
- Creates scheduled task(s)
PID:1488

C:\Users\Admin\AppData\Local\Temp\Revised PO-2022092903_________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Revised PO-2022092903_________________________.exe"
2⤵
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB9DE.tmp
Filesize
1KB

MD5
e50c97ec556546ae6e0b2b0630b1b86e

SHA1
d0aa611ddb2794e8f12be89be2060499135836bf

SHA256
2efd1c06dd938eb4032271b72bfa02f9f5f87bd7cca7ef5a45f5c955fd50a6cd

SHA512
d528ca40e92f135ec1a2a1ee66d8c7fcc44d092031e88da23529e1a72cad26ec721834d550e023338f5156ac531c0d4ec8269b78dfdb8baf3a250335b588f6e2

Download Submit
memory/560-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-66-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-81-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-78-0x00000000004327A4-mapping.dmp

Download
memory/560-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-85-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-83-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/560-71-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/672-60-0x0000000000000000-mapping.dmp

Download
memory/672-82-0x000000006ED50000-0x000000006F2FB000-memory.dmp

Filesize
5.7MB

Download
memory/672-84-0x000000006ED50000-0x000000006F2FB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-61-0x0000000000000000-mapping.dmp

Download
memory/1492-64-0x00000000084C0000-0x000000000853C000-memory.dmp

Filesize
496KB

Download
memory/1492-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000000590000-0x00000000005A4000-memory.dmp

Filesize
80KB

Download
memory/1492-54-0x0000000000D00000-0x0000000000E10000-memory.dmp

Filesize
1.1MB

Download
memory/1492-59-0x0000000005EB0000-0x0000000005F82000-memory.dmp

Filesize
840KB

Download
memory/1492-58-0x0000000000780000-0x000000000078C000-memory.dmp

Filesize
48KB

Download
memory/1492-57-0x00000000005D0000-0x00000000005E4000-memory.dmp

Filesize
80KB

Download

description	pid	process	target process
PID 1492 wrote to memory of 672	1492	Revised PO-2022092903_________________________.exe	powershell.exe
PID 1492 wrote to memory of 672	1492	Revised PO-2022092903_________________________.exe	powershell.exe
PID 1492 wrote to memory of 672	1492	Revised PO-2022092903_________________________.exe	powershell.exe
PID 1492 wrote to memory of 672	1492	Revised PO-2022092903_________________________.exe	powershell.exe
PID 1492 wrote to memory of 1488	1492	Revised PO-2022092903_________________________.exe	schtasks.exe
PID 1492 wrote to memory of 1488	1492	Revised PO-2022092903_________________________.exe	schtasks.exe
PID 1492 wrote to memory of 1488	1492	Revised PO-2022092903_________________________.exe	schtasks.exe
PID 1492 wrote to memory of 1488	1492	Revised PO-2022092903_________________________.exe	schtasks.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe
PID 1492 wrote to memory of 560	1492	Revised PO-2022092903_________________________.exe	Revised PO-2022092903_________________________.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads