remcos | 6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550 | Triage

Analysis

max time kernel
151s
max time network
154s
platform
windows10_x64
resource
win10-en-20211208
submitted
10-12-2021 08:36

Sharing

Report Analysis Logs

General

Target

tmp/6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550.exe
Size

463KB
MD5

63ead0514c5352dc4a7af34b8205366f
SHA1

b28b346574521b65b67b59838dfc22b70bfd533e
SHA256

6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550
SHA512

aa23453ea399961760f2469688da8be1f6525b7ef9f8f19b655e6f97925795ce103e307282e60a587eb8886c90fc9c9f303ce266b3313fc11497cbc92b2b7e62

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550.exe

pid process

3896 6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550.exe

C:\Users\Admin\AppData\Local\Temp\tmp\6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\6862cf51b5546665e90e27a0a188ea8c468097f86b8b5d68fa0521f4cd3a9550.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...