remcos | c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895

Analysis

Target

Rbmmuoavjkz8.exe
Size

1.2MB
MD5

92a24000ceaaf6dfffe49237ce46c711
SHA1

8ddd627b8f77d01d3f20541e66c43f6196573e12
SHA256

c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895
SHA512

6ecb7e65b795f7bc4984d2b6b5a4b622d7d3979d24ce414e6373e58ad834b1161870489ab5efe5c8edfa7ce1b8ff31e06ee8e3ba067a24c7d68dd80cf8504128

Score

10^/10

remcos rat

Family

remcos

latua.nsupdate.info:7722

fanta.nsupdate.info:7722

coke.nsupdate.info:7722

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 4060	2268	Rbmmuoavjkz8.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	Rbmmuoavjkz8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4060	Rbmmuoavjkz8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78

C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe
"C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe
  "C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4060

memory/2268-0-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-1-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2268-3-0x0000000005440000-0x0000000005482000-memory.dmp

Filesize
264KB

Download
memory/2268-4-0x0000000005590000-0x00000000055A6000-memory.dmp

Filesize
88KB

Download
memory/4060-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4060-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download