remcos | c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895

Analysis

Target

Rbmmuoavjkz8.exe
Size

1.2MB
MD5

92a24000ceaaf6dfffe49237ce46c711
SHA1

8ddd627b8f77d01d3f20541e66c43f6196573e12
SHA256

c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895
SHA512

6ecb7e65b795f7bc4984d2b6b5a4b622d7d3979d24ce414e6373e58ad834b1161870489ab5efe5c8edfa7ce1b8ff31e06ee8e3ba067a24c7d68dd80cf8504128

Score

10^/10

remcos rat

Family

remcos

latua.nsupdate.info:7722

fanta.nsupdate.info:7722

coke.nsupdate.info:7722

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

Rbmmuoavjkz8.exe

description pid process target process

PID 1056 set thread context of 1628 1056 Rbmmuoavjkz8.exe Rbmmuoavjkz8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Rbmmuoavjkz8.exe

description pid process

Token: SeDebugPrivilege 1056 Rbmmuoavjkz8.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Rbmmuoavjkz8.exe

pid process

1628 Rbmmuoavjkz8.exe

description	pid	process	target process
PID 1056 set thread context of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe

description	pid	process
Token: SeDebugPrivilege	1056	Rbmmuoavjkz8.exe

pid	process
1628	Rbmmuoavjkz8.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Rbmmuoavjkz8.exe

description	pid	process	target process
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe
PID 1056 wrote to memory of 1628	1056	Rbmmuoavjkz8.exe	Rbmmuoavjkz8.exe

C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe
"C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe
  "C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1628

memory/1056-0-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1056-1-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/1056-3-0x0000000000600000-0x0000000000642000-memory.dmp

Filesize
264KB

Download
memory/1056-4-0x0000000000490000-0x00000000004A6000-memory.dmp

Filesize
88KB

Download
memory/1628-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1628-6-0x0000000000413FA4-mapping.dmp

Download
memory/1628-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download