remcos | 4a3ee480e184ee589aae2817674cf6ecdf9ed829db8388d7e85bc8a95bc69bd2

General

Target

Shipping_Document.exe
Size

736KB
MD5

8809c7cab903669b1da338f39327a7c3
SHA1

7b19e931f2ab478e1189431a216f1cc2c9b43d8d
SHA256

86fffe8373d8bbcc79e4105465a3775bb9a2b4d35fb47961ab6173558bfeda14
SHA512

33bfbfd4729fb6ed94e27f323c668c92e7c1394e4628e236e16fff0bee0df0644ca29e666679e7a8b92cf077267aeff43bbf5c35e57d68ee80d11956cb246cac

Score

10^/10

remcos young rat

Family

remcos

Botnet

Young

C2

june248.ddns.net:3759

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Shipping_Document.exe

description	pid	process	target process
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe
PID 2004 wrote to memory of 572	2004	Shipping_Document.exe	mobsync.exe

C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

memory/572-61-0x0000000000000000-mapping.dmp

Download
memory/572-63-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/572-65-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/572-64-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/572-66-0x0000000010590000-0x000000001060D000-memory.dmp

Filesize
500KB

Download
memory/572-67-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2004-59-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/2004-60-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download