remcos | 282760aaaa1b23718548e3a4bac27b594de3c83f3db15a453cf3d123a8bfc7e9 | Triage

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-05-2022 13:23

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

464KB
MD5

ebf5113c6c5ae6b441dd21df3f87a396
SHA1

30c6a54d6f58b5d1ce4cfcb6f7d820e2f909e10c
SHA256

282760aaaa1b23718548e3a4bac27b594de3c83f3db15a453cf3d123a8bfc7e9
SHA512

0f5cfccd6a5a7eaa49aad91d8ab8eca8eb8f2b88d7f42e60b8fedeb110d832c4e0a610a93b3c0d710e2e72930408135862bd97669876b0713066c223e3f3bcbf

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tmp.exe

pid process

3536 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...