remcos | 43cd9c2e9581da86628691ce210a40d64bb35ee6d7d33f0315d56c6208017781

Analysis

max time kernel
63s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 10:23

Target

itinerary.exe
Size

380.0MB
MD5

184ae205be9e6fb8e0f1983b60a380e9
SHA1

468f1122eb96501c0378ed8f68e640e292aa066b
SHA256

43cd9c2e9581da86628691ce210a40d64bb35ee6d7d33f0315d56c6208017781
SHA512

7069ed4602d2d5dec8defa91bd5682f33e26b39452641ec3b594a00039551cc5b4e3cdb16821faa9e42aacd9b7941a333af3e87b9c8e90d4f15a0bee936a52e1
SSDEEP

12288:e5UGXhYEdgwIRIxudakJOws9IxdDdaWzHRkmM4:/GxYEfIqMakIwsYhzHCmM4

Score

10^/10

remcos manup rat

Family

remcos

Botnet

manup

91.193.75.188:60005

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

itinerary.exe

description pid process target process

PID 2712 set thread context of 2508 2712 itinerary.exe itinerary.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3968 2508 WerFault.exe itinerary.exe

description	pid	process	target process
PID 2712 set thread context of 2508	2712	itinerary.exe	itinerary.exe

pid	pid_target	process	target process
3968	2508	WerFault.exe	itinerary.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

itinerary.exe

description	pid	process	target process
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe
PID 2712 wrote to memory of 2508	2712	itinerary.exe	itinerary.exe

C:\Users\Admin\AppData\Local\Temp\itinerary.exe
"C:\Users\Admin\AppData\Local\Temp\itinerary.exe"
2⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 500
3⤵
- Program crash
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2508 -ip 2508
1⤵
PID:4532

memory/2508-135-0x0000000000000000-mapping.dmp

Download
memory/2508-137-0x0000000000550000-0x00000000005CF000-memory.dmp

Filesize
508KB

Download
memory/2508-142-0x0000000000550000-0x00000000005CF000-memory.dmp

Filesize
508KB

Download
memory/2508-147-0x0000000000550000-0x00000000005CF000-memory.dmp

Filesize
508KB

Download
memory/2712-132-0x0000000000650000-0x00000000006EA000-memory.dmp

Filesize
616KB

Download
memory/2712-133-0x00000000055D0000-0x0000000005B74000-memory.dmp

Filesize
5.6MB

Download
memory/2712-134-0x0000000005090000-0x00000000050F6000-memory.dmp

Filesize
408KB

Download