Overview

overview

10

Static

static

09000900000000000.exe

windows7_x64

10

09000900000000000.exe

windows10_x64

10

Analysis

  • max time kernel
    53s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 18:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    09000900000000000.exe

  • Size

    1.3MB

  • MD5

    10f306cb61e4f2894b60220ce173ef99

  • SHA1

    79ca974cf5435d64c33cd92a85af5cc7627e569d

  • SHA256

    89da7208176dbbd63ca89225c0defa5c3c12fb4e067d3b4630eac41c5e621017

  • SHA512

    d34c65adc85db0863b11813aba60a3e510be599a56b700dfb4245cfa55b9ecf2af403918d8494b2d3cc13925f7a63cc693f3b274bb9f4495a8d91462cd72cffb

Score
10/10
remcosrat

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09000900000000000.exe
    "C:\Users\Admin\AppData\Local\Temp\09000900000000000.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\09000900000000000.exe
      "C:\Users\Admin\AppData\Local\Temp\09000900000000000.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1036-3-0x00000000008C0000-0x00000000008CA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1036-4-0x00000000008D0000-0x00000000008D3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1504-2-0x00000000004172EC-mapping.dmp
    Download
  • memory/1504-5-0x0000000000400000-0x0000000000419000-memory.dmp
    Filesize

    100KB

    Download