remcos | 6870257b5f12bce7d4256553ca5b350abb40016e196284a20662e09b4171bad2

Analysis

max time kernel
157s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 05:02

Target

FED Gov Approved Certificates.exe
Size

250.0MB
MD5

c50de3d7b0351f474c2901f2106f54da
SHA1

4a6e1118a0c0b702f2086a2721f389f89a50fd21
SHA256

6870257b5f12bce7d4256553ca5b350abb40016e196284a20662e09b4171bad2
SHA512

a0cab8850f84bfb6f54fda319b401b68740480555fd55266165b70d3ee114a1e740d5d8df52a1dfff10fddc7e00e489072d24aa08b357ac282532715ab600e69
SSDEEP

12288:2lWVinRO/caHHRuXVg6gP0za7PuxZVTTS/VWsLjDv6:6WV24HReVg6g2a6xZV6/djDv6

Score

10^/10

remcos manup rat

Family

remcos

Botnet

manup

91.193.75.188:60005

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

FED Gov Approved Certificates.exe

description pid process target process

PID 1352 set thread context of 1148 1352 FED Gov Approved Certificates.exe FED Gov Approved Certificates.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

FED Gov Approved Certificates.exe

pid process

1148 FED Gov Approved Certificates.exe

description	pid	process	target process
PID 1352 set thread context of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe

pid	process
1148	FED Gov Approved Certificates.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

FED Gov Approved Certificates.exe

description	pid	process	target process
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe
PID 1352 wrote to memory of 1148	1352	FED Gov Approved Certificates.exe	FED Gov Approved Certificates.exe

C:\Users\Admin\AppData\Local\Temp\FED Gov Approved Certificates.exe
"C:\Users\Admin\AppData\Local\Temp\FED Gov Approved Certificates.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1148

memory/1148-134-0x0000000000000000-mapping.dmp

Download
memory/1148-135-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1148-136-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1148-137-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1148-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1148-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1352-132-0x0000000000240000-0x00000000002D2000-memory.dmp

Filesize
584KB

Download
memory/1352-133-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download