remcos | 0ac5715dbbb22286a1cc79fe33377cd2dcb71ac6ad5d876da8e938684e7d7cf8

Analysis

max time kernel
151s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 08:07

Target

RFQ 20227364547.PDF.exe
Size

1.2MB
MD5

9b6a8293c59a24d58516ac07a824242a
SHA1

e9dff04c869390ae1395577fcbd06a9cbd1277ba
SHA256

0ac5715dbbb22286a1cc79fe33377cd2dcb71ac6ad5d876da8e938684e7d7cf8
SHA512

3593ed30f2e05fc4ed5c821abd837c56093319b28e60bc4fb6dc1a949476af9207aae23b808f44b642f1f34652863c45462e92df649da2228c6c76e292606232
SSDEEP

24576:zIvydnI6HUUOEg85L5eA9Atd9J5YhHV4/oUSTx7e:zrdI60UVg85L5Ctd9J5yHV4cTk

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ 20227364547.PDF.exe

description pid process target process

PID 3916 set thread context of 1956 3916 RFQ 20227364547.PDF.exe RFQ 20227364547.PDF.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RFQ 20227364547.PDF.exe

pid process

1956 RFQ 20227364547.PDF.exe

description	pid	process	target process
PID 3916 set thread context of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe

pid	process
1956	RFQ 20227364547.PDF.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RFQ 20227364547.PDF.exe

description	pid	process	target process
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe
PID 3916 wrote to memory of 1956	3916	RFQ 20227364547.PDF.exe	RFQ 20227364547.PDF.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 20227364547.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 20227364547.PDF.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1956

memory/1956-138-0x0000000000000000-mapping.dmp

Download
memory/1956-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1956-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1956-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1956-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1956-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3916-132-0x0000000000CC0000-0x0000000000DF8000-memory.dmp

Filesize
1.2MB

Download
memory/3916-133-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/3916-134-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/3916-135-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/3916-136-0x000000000C0D0000-0x000000000C16C000-memory.dmp

Filesize
624KB

Download
memory/3916-137-0x000000000C170000-0x000000000C1D6000-memory.dmp

Filesize
408KB

Download