Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 09:04
Static task
static1
Behavioral task
behavioral1
Sample
MT NEW STAR V2231.PDF.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
MT NEW STAR V2231.PDF.js
Resource
win10v2004-20220901-en
General
-
Target
MT NEW STAR V2231.PDF.js
-
Size
856KB
-
MD5
b57f46aae59e5b141af36a0e5598cb7b
-
SHA1
d7c37a169fd2399d44b6330d8c459f5edd0151dd
-
SHA256
15c52aa78fef0b66472f35c92e2778fcc726762e4f648ea8b027074f4d13fe46
-
SHA512
040321fa3f3db208587af428bcc2643e36b941eaaea788c86c1e380168b35790c735cc09bbe29305feb1612bd9673e239007a728a7aa388427a7fa34235eb6f1
-
SSDEEP
12288:5F+J0rvOJnnLrRoIalxPZu2o0iZTbSX7/QCFxweyve:+JGrhu5qVGve
Malware Config
Extracted
remcos
RemoteHost
84.21.172.33:5763
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
uac.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-AG7QM3
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1152-92-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1152-96-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1196-93-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/1196-94-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 5 IoCs
Processes:
resource yara_rule behavioral1/memory/740-91-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1152-92-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1196-93-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1196-94-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1152-96-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Blocklisted process makes network request 4 IoCs
Processes:
wscript.exeflow pid process 6 1496 wscript.exe 11 1496 wscript.exe 12 1496 wscript.exe 15 1496 wscript.exe -
Executes dropped EXE 5 IoCs
Processes:
remcos_a.exeuac.exeuac.exeuac.exeuac.exepid process 1468 remcos_a.exe 2036 uac.exe 1196 uac.exe 1152 uac.exe 740 uac.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DkBSYEKIrV.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DkBSYEKIrV.js wscript.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1672 cmd.exe 1672 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
uac.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts uac.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
remcos_a.exeuac.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\uac.exe\"" remcos_a.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ uac.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\uac.exe\"" uac.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ uac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\uac.exe\"" uac.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos_a.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\uac.exe\"" remcos_a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos_a.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
uac.exedescription pid process target process PID 2036 set thread context of 1968 2036 uac.exe svchost.exe PID 2036 set thread context of 1196 2036 uac.exe uac.exe PID 2036 set thread context of 1152 2036 uac.exe uac.exe PID 2036 set thread context of 740 2036 uac.exe uac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
uac.exepid process 1196 uac.exe 1196 uac.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
uac.exepid process 2036 uac.exe 2036 uac.exe 2036 uac.exe 2036 uac.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
uac.exedescription pid process Token: SeDebugPrivilege 740 uac.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
wscript.exeremcos_a.execmd.exeWScript.execmd.exeuac.execmd.exedescription pid process target process PID 784 wrote to memory of 1496 784 wscript.exe wscript.exe PID 784 wrote to memory of 1496 784 wscript.exe wscript.exe PID 784 wrote to memory of 1496 784 wscript.exe wscript.exe PID 784 wrote to memory of 1468 784 wscript.exe remcos_a.exe PID 784 wrote to memory of 1468 784 wscript.exe remcos_a.exe PID 784 wrote to memory of 1468 784 wscript.exe remcos_a.exe PID 784 wrote to memory of 1468 784 wscript.exe remcos_a.exe PID 1468 wrote to memory of 1700 1468 remcos_a.exe cmd.exe PID 1468 wrote to memory of 1700 1468 remcos_a.exe cmd.exe PID 1468 wrote to memory of 1700 1468 remcos_a.exe cmd.exe PID 1468 wrote to memory of 1700 1468 remcos_a.exe cmd.exe PID 1700 wrote to memory of 1876 1700 cmd.exe reg.exe PID 1700 wrote to memory of 1876 1700 cmd.exe reg.exe PID 1700 wrote to memory of 1876 1700 cmd.exe reg.exe PID 1700 wrote to memory of 1876 1700 cmd.exe reg.exe PID 1468 wrote to memory of 948 1468 remcos_a.exe WScript.exe PID 1468 wrote to memory of 948 1468 remcos_a.exe WScript.exe PID 1468 wrote to memory of 948 1468 remcos_a.exe WScript.exe PID 1468 wrote to memory of 948 1468 remcos_a.exe WScript.exe PID 948 wrote to memory of 1672 948 WScript.exe cmd.exe PID 948 wrote to memory of 1672 948 WScript.exe cmd.exe PID 948 wrote to memory of 1672 948 WScript.exe cmd.exe PID 948 wrote to memory of 1672 948 WScript.exe cmd.exe PID 1672 wrote to memory of 2036 1672 cmd.exe uac.exe PID 1672 wrote to memory of 2036 1672 cmd.exe uac.exe PID 1672 wrote to memory of 2036 1672 cmd.exe uac.exe PID 1672 wrote to memory of 2036 1672 cmd.exe uac.exe PID 2036 wrote to memory of 1960 2036 uac.exe cmd.exe PID 2036 wrote to memory of 1960 2036 uac.exe cmd.exe PID 2036 wrote to memory of 1960 2036 uac.exe cmd.exe PID 2036 wrote to memory of 1960 2036 uac.exe cmd.exe PID 1960 wrote to memory of 1784 1960 cmd.exe reg.exe PID 1960 wrote to memory of 1784 1960 cmd.exe reg.exe PID 1960 wrote to memory of 1784 1960 cmd.exe reg.exe PID 1960 wrote to memory of 1784 1960 cmd.exe reg.exe PID 2036 wrote to memory of 1968 2036 uac.exe svchost.exe PID 2036 wrote to memory of 1968 2036 uac.exe svchost.exe PID 2036 wrote to memory of 1968 2036 uac.exe svchost.exe PID 2036 wrote to memory of 1968 2036 uac.exe svchost.exe PID 2036 wrote to memory of 1968 2036 uac.exe svchost.exe PID 2036 wrote to memory of 1196 2036 uac.exe uac.exe PID 2036 wrote to memory of 1196 2036 uac.exe uac.exe PID 2036 wrote to memory of 1196 2036 uac.exe uac.exe PID 2036 wrote to memory of 1196 2036 uac.exe uac.exe PID 2036 wrote to memory of 1152 2036 uac.exe uac.exe PID 2036 wrote to memory of 1152 2036 uac.exe uac.exe PID 2036 wrote to memory of 1152 2036 uac.exe uac.exe PID 2036 wrote to memory of 1152 2036 uac.exe uac.exe PID 2036 wrote to memory of 740 2036 uac.exe uac.exe PID 2036 wrote to memory of 740 2036 uac.exe uac.exe PID 2036 wrote to memory of 740 2036 uac.exe uac.exe PID 2036 wrote to memory of 740 2036 uac.exe uac.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\MT NEW STAR V2231.PDF.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\DkBSYEKIrV.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
C:\Users\Admin\AppData\Roaming\remcos_a.exe"C:\Users\Admin\AppData\Roaming\remcos_a.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\nvvhjpgwxbpvomybagmysjt.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\uac.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\uac.exeC:\ProgramData\Remcos\uac.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵
-
C:\ProgramData\Remcos\uac.exeC:\ProgramData\Remcos\uac.exe /stext "C:\Users\Admin\AppData\Local\Temp\jjuszyjsittjqtzvic"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Remcos\uac.exeC:\ProgramData\Remcos\uac.exe /stext "C:\Users\Admin\AppData\Local\Temp\meacaquteblwsznhrncxn"6⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
-
C:\ProgramData\Remcos\uac.exeC:\ProgramData\Remcos\uac.exe /stext "C:\Users\Admin\AppData\Local\Temp\wgfvbifnsjdbcnjliypyqwpnd"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
C:\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
C:\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
C:\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
C:\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
C:\Users\Admin\AppData\Local\Temp\jjuszyjsittjqtzvicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\nvvhjpgwxbpvomybagmysjt.vbsFilesize
380B
MD57b8772bb10bd0b5381f26c961f6d2768
SHA1ad8bdcb8251394e87f5599abdb0bc2334f65eb12
SHA2560bb9b2e1d903edf86f15874531f3ceea186e953ab8f8489ecd601fd7eac5b457
SHA512bff73e04eb175c741a733c48a3bb38821d26d470e9b25ee0c18b1b7d0ccf850d57a9cee94843016c78e17f6859ca86dd6b4ea59296ed7b0022d7cf915a743a75
-
C:\Users\Admin\AppData\Roaming\DkBSYEKIrV.jsFilesize
7KB
MD5de6279ecda86cb1c9dea290f11778fed
SHA1510eeb73129bf63873ed19fd07955e2e8cb3e83d
SHA256a99dbe1f52517b26087512d54d1f849c0216f14ab9f3c618c437546118dd1373
SHA512f3434f9b38f0d2b9a52aa160698aec75d03f3bd92263a06636098561e0b5f310191bca760338a0640a280893488f781cb2df80f52b9a6f3a631dd2c4fcecff73
-
C:\Users\Admin\AppData\Roaming\remcos_a.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
C:\Users\Admin\AppData\Roaming\remcos_a.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
\ProgramData\Remcos\uac.exeFilesize
470KB
MD5d7eda792cc905481af5f73aa23dcfbcb
SHA124bacf412ca6befbaf27703019ab3aafa0e52596
SHA256da59632417e4b72af2be17400c9f5cbbc8207542de1781ab5f69657d2c85f108
SHA5120891b69a550e5a8daf48be8c2eb2e47eac092e564d696d8fb83103ee2c4efa358c9069ac22635d971f4e23fa3f3dab33ff261fd14bfe9ed9ad83f4c2588f56da
-
memory/740-91-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/740-83-0x0000000000422206-mapping.dmp
-
memory/740-90-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/784-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmpFilesize
8KB
-
memory/948-64-0x0000000000000000-mapping.dmp
-
memory/1152-92-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1152-89-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1152-96-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1152-81-0x0000000000455238-mapping.dmp
-
memory/1196-85-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1196-79-0x0000000000476274-mapping.dmp
-
memory/1196-94-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1196-93-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1468-57-0x0000000000000000-mapping.dmp
-
memory/1468-59-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/1496-55-0x0000000000000000-mapping.dmp
-
memory/1672-67-0x0000000000000000-mapping.dmp
-
memory/1700-61-0x0000000000000000-mapping.dmp
-
memory/1784-75-0x0000000000000000-mapping.dmp
-
memory/1876-63-0x0000000000000000-mapping.dmp
-
memory/1960-74-0x0000000000000000-mapping.dmp
-
memory/1968-76-0x00000000000B292E-mapping.dmp
-
memory/1968-78-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/2036-71-0x0000000000000000-mapping.dmp