remcos | a91f677d3f99a4b0142d526bb62139b076e66d8e1ad1ffd805df21bd9bbfe36e | Triage

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
06-08-2022 07:40

Sharing

Report Analysis Logs

General

Target

1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe
Size

156KB
MD5

0b4aa9ee84acbe36df0dfcc0c061898e
SHA1

38ed57362c4f3479a70b45221f5ef3393a112938
SHA256

a91f677d3f99a4b0142d526bb62139b076e66d8e1ad1ffd805df21bd9bbfe36e
SHA512

37464d729afcc68c6112fdffe6a99d9eede376b636f9fbb549e452cdcf7715135ad2477ea2847e7b43605151349439c03ab8648ba363066ab8facbc782ab4ea7

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 1704 WerFault.exe 1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe

description	pid	process	target process
PID 1704 wrote to memory of 1896	1704	1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe	WerFault.exe
PID 1704 wrote to memory of 1896	1704	1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe	WerFault.exe
PID 1704 wrote to memory of 1896	1704	1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe	WerFault.exe
PID 1704 wrote to memory of 1896	1704	1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1940-231-0x00000000505A0000-0x00000000505C7000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 36
  2⤵
  - Program crash
  PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x0000000000520000-0x0000000000547000-memory.dmp

Filesize
156KB

Download
memory/1896-55-0x0000000000000000-mapping.dmp

Download