remcos | 3664-302-0x0000000050590000-0x0000000050612000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3664-302-0x0000000050590000-0x0000000050612000-memory.dmp
Size

520KB
MD5

fcc088bcf06795ea394c0482f9ebe754
SHA1

9e9a141c303cb6996bca43150dc93d280b04fd5c
SHA256

147ca5fa7a76c35dd0c3725fb48799427081a29fa43619b6561cfb9ab00e702c
SHA512

7852c3f407110549e973ce86a9b6d2a919b441f21febf9ed9d39c1ad9f5d12758859a708e0af7db52c5641c218be0e5aad03ed6099bc64709663ad4d9ef4203b
SSDEEP

6144:pNzuFOjH9TX76ghtDNHffMq6+i1lSC6GocCh+41JnwNvtsAOZZYAXectorYN:pNzuFO7V6WBN/kq9KSC6kC044sfZYmN

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Files

3664-302-0x0000000050590000-0x0000000050612000-memory.dmp
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 468KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE