remcos | 8791b0b7f4a499d66dbbc5b41ea20cb13af614bdc62e62392bf041065e9ddb0f

Analysis

max time kernel
154s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2022 21:18

Target

inquiry data spec 20228494.PDF.exe
Size

815KB
MD5

1093418c094fb284481141f5c33895ac
SHA1

a76fd19c68c083f1a0a903699464ccfb2b04f757
SHA256

8791b0b7f4a499d66dbbc5b41ea20cb13af614bdc62e62392bf041065e9ddb0f
SHA512

b6ce87c109ee51b627d826e08a8b048bb504219a576e12a9a1e87babe9555af35195d6e27030d7392ca47986325d565572ceb06d88ff165990902ea276a9bb12
SSDEEP

12288:ah7n68TcSFhmPKndO4koBfDYBJfvKDUpnV19P7ba2hqee4BQ7cpdKOXQfZAEyL:J8ZhmUdO4pDYuDUpnLx7qekCdKhyEyL

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

inquiry data spec 20228494.PDF.exe

description pid process target process

PID 1528 set thread context of 4064 1528 inquiry data spec 20228494.PDF.exe inquiry data spec 20228494.PDF.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

inquiry data spec 20228494.PDF.exe

pid process

4064 inquiry data spec 20228494.PDF.exe

description	pid	process	target process
PID 1528 set thread context of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe

pid	process
4064	inquiry data spec 20228494.PDF.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

inquiry data spec 20228494.PDF.exe

description	pid	process	target process
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe
PID 1528 wrote to memory of 4064	1528	inquiry data spec 20228494.PDF.exe	inquiry data spec 20228494.PDF.exe

C:\Users\Admin\AppData\Local\Temp\inquiry data spec 20228494.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\inquiry data spec 20228494.PDF.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4064

memory/1528-132-0x0000000000600000-0x00000000006D2000-memory.dmp

Filesize
840KB

Download
memory/1528-133-0x0000000005720000-0x0000000005CC4000-memory.dmp

Filesize
5.6MB

Download
memory/1528-134-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/1528-135-0x0000000005DD0000-0x0000000005E6C000-memory.dmp

Filesize
624KB

Download
memory/4064-136-0x0000000000000000-mapping.dmp

Download
memory/4064-137-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4064-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4064-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4064-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4064-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download