remcos | 1796-91-0x0000000010590000-0x0000000010612000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1796-91-0x0000000010590000-0x0000000010612000-memory.dmp
Size

520KB
MD5

191efa0d201ede8edd4600a13e9e6658
SHA1

c91ddce8901faed29e18ad35e0e42f0818ae7841
SHA256

525579294e826a4e1d900595d46f376600af4628a5bb2d28cc5f21f90aa02b56
SHA512

9d5ada15d98961d2a459f4c4e228f020b19010fae86768e966cb373df869bc1e76661c9b7d240bb09e4e849751fd2d9986016708f096dd32d52056085676470d
SSDEEP

12288:wUmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSFn9:wMiLJbpI7I2WhQqZ7F9

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Files

1796-91-0x0000000010590000-0x0000000010612000-memory.dmp
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 471KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE