remcos | dcbd91d1d7361dc9b34c907f1d1d2677837ce29f6f3ab3f4994bb82ccce88dc5

General

Target

DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe
Size

378KB
MD5

291b17288e1b5919f9bf5173a3519cb3
SHA1

b88282c8e5a7546dd6363653bc68d1353163d3f6
SHA256

dcbd91d1d7361dc9b34c907f1d1d2677837ce29f6f3ab3f4994bb82ccce88dc5
SHA512

5fb634203786a7401ce15f55d433b19546a640747f9482f8a906464fca58b5e5d7696a618f721f32e0d73c02a256a74335803344b646891b0943303e122eba0a

Score

10^/10

remcos rat

Family

remcos

C2

jueces23.duckdns.org:1212

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe

description pid process target process

PID 1760 set thread context of 1344 1760 DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe

description pid process

Token: SeDebugPrivilege 1760 DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1344 RegSvcs.exe

description	pid	process	target process
PID 1760 set thread context of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe

pid	process
1344	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe

description	pid	process	target process
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe
PID 1760 wrote to memory of 1344	1760	DOCUMENTACIONJUXGADOPROCESAL68584983243128.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1344

memory/1344-8-0x0000000000413E54-mapping.dmp

Download
memory/1344-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1344-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1760-2-0x0000000074DD0000-0x00000000754BE000-memory.dmp

Filesize
6.9MB

Download
memory/1760-3-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x0000000000560000-0x0000000000564000-memory.dmp

Filesize
16KB

Download
memory/1760-6-0x0000000000FB0000-0x0000000001006000-memory.dmp

Filesize
344KB

Download