remcos | 8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af

Analysis

Target
ORDERS.exe
Size 253KB
Sample200715-eanwwys256
SHA256 8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af
MD5 5057d94ffda400296dd29e5b0d89b5b5
SHA1 7cdeca35860f00b86682fa5f3ce069161e751e4f
SHA512 0fe572ac8c17d6be705f4390d618f26ba8b4d861e4b5fbe27729a9a97814a7ba37bb82afeeb8261f55ef9c9b66563b26e35b7380c15233e0e1ddd14f1bb0b26f
MD5 SHA1 SHA512

Score

10^/10

rat remcos

Family

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24
PID 1492 wrote to memory of 1600	1492	ORDERS.exe	24

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1600	1492	ORDERS.exe	24

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	ORDERS.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

C:\Users\Admin\AppData\Local\Temp\ORDERS.exe
"C:\Users\Admin\AppData\Local\Temp\ORDERS.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1492
- C:\Users\Admin\AppData\Local\Temp\ORDERS.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDERS.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1600

memory/1600-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1600-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download