remcos | 8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af

Analysis

Target
ORDERS.exe
Size 253KB
Sample200715-eanwwys256
SHA256 8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af
MD5 5057d94ffda400296dd29e5b0d89b5b5
SHA1 7cdeca35860f00b86682fa5f3ce069161e751e4f
SHA512 0fe572ac8c17d6be705f4390d618f26ba8b4d861e4b5fbe27729a9a97814a7ba37bb82afeeb8261f55ef9c9b66563b26e35b7380c15233e0e1ddd14f1bb0b26f
MD5 SHA1 SHA512

Score

10^/10

rat remcos

Family

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67
PID 2460 wrote to memory of 3300	2460	ORDERS.exe	67

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 3300	2460	ORDERS.exe	67

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	ORDERS.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

C:\Users\Admin\AppData\Local\Temp\ORDERS.exe
"C:\Users\Admin\AppData\Local\Temp\ORDERS.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2460
- C:\Users\Admin\AppData\Local\Temp\ORDERS.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDERS.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3300

memory/3300-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3300-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download