remcos | 236493354378eefc6203b957baa7df24b566d8e5b0f04523bbb060999cc8a227

Analysis

max time kernel
159s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 08:04

Target

NEW ERUO ORDER.SCR.exe
Size

1016KB
MD5

87d248727141ea8053b5ded89750962b
SHA1

654c2110cbe433f8697a2347e590d63a563c1f8b
SHA256

236493354378eefc6203b957baa7df24b566d8e5b0f04523bbb060999cc8a227
SHA512

aaee93e32842ae750414358b1b727764c968b8a8e3a8c0771b286df6e01b709583abd497d48189b047471271ea89f0517cb134022446ff93e184eda5a9f0cd61
SSDEEP

12288:4ptk1UbDD5du/VAAiSdjXU4UZFGcVDmWsQaUUk3p82drYGBahHgGCUcZVpsNL:Mx5dAWCw4oIrrsp8WrYGFGCLbq

Score

10^/10

Family

remcos

Botnet

IP-REMCOS

91.192.100.12:2404

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

NEW ERUO ORDER.SCR.exe

description pid process target process

PID 5088 set thread context of 240 5088 NEW ERUO ORDER.SCR.exe NEW ERUO ORDER.SCR.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

NEW ERUO ORDER.SCR.exe

pid process

240 NEW ERUO ORDER.SCR.exe

description	pid	process	target process
PID 5088 set thread context of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe

pid	process
240	NEW ERUO ORDER.SCR.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

NEW ERUO ORDER.SCR.exe

description	pid	process	target process
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe
PID 5088 wrote to memory of 240	5088	NEW ERUO ORDER.SCR.exe	NEW ERUO ORDER.SCR.exe

C:\Users\Admin\AppData\Local\Temp\NEW ERUO ORDER.SCR.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ERUO ORDER.SCR.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:240

memory/240-138-0x0000000000000000-mapping.dmp

Download
memory/240-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/240-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/240-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/240-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/240-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5088-132-0x00000000005D0000-0x00000000006D4000-memory.dmp

Filesize
1.0MB

Download
memory/5088-133-0x0000000005560000-0x0000000005B04000-memory.dmp

Filesize
5.6MB

Download
memory/5088-134-0x0000000005060000-0x00000000050F2000-memory.dmp

Filesize
584KB

Download
memory/5088-135-0x0000000005100000-0x000000000510A000-memory.dmp

Filesize
40KB

Download
memory/5088-136-0x0000000007890000-0x000000000792C000-memory.dmp

Filesize
624KB

Download
memory/5088-137-0x0000000007930000-0x0000000007996000-memory.dmp

Filesize
408KB

Download