remcos | 7666415f1d2f03e6a14e4f058b012ec6ed4a77cd3ecd1398817b2ac97b25cbc5

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 06:43

Target

ORDER ENQUIRY 22.11.21.exe
Size

965KB
MD5

0f30923fef1943c6444512e4da3987d4
SHA1

b1cfa49c4ac292f26cd04c1442eb2d7bcffc3e0a
SHA256

7666415f1d2f03e6a14e4f058b012ec6ed4a77cd3ecd1398817b2ac97b25cbc5
SHA512

ced07b8a11bdc5ebbe1396262efc937946f150c9cbfa2e5d812012cdc9e974f501a70b687f4b0debef0ca9da00d72748f217693cf02da0c4c7ab4518f584407e
SSDEEP

24576:0pn3wdfEYxdAXYVWYc0Lsz33ygpjbh4+L74mBfNUstzo:yn2fbdAXY8Y9L43yg

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER ENQUIRY 22.11.21.exe

description pid process target process

PID 4456 set thread context of 4396 4456 ORDER ENQUIRY 22.11.21.exe ORDER ENQUIRY 22.11.21.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ORDER ENQUIRY 22.11.21.exe

pid process

4396 ORDER ENQUIRY 22.11.21.exe

description	pid	process	target process
PID 4456 set thread context of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe

pid	process
4396	ORDER ENQUIRY 22.11.21.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ORDER ENQUIRY 22.11.21.exe

description	pid	process	target process
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe
PID 4456 wrote to memory of 4396	4456	ORDER ENQUIRY 22.11.21.exe	ORDER ENQUIRY 22.11.21.exe

C:\Users\Admin\AppData\Local\Temp\ORDER ENQUIRY 22.11.21.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER ENQUIRY 22.11.21.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\ORDER ENQUIRY 22.11.21.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER ENQUIRY 22.11.21.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4396

memory/4396-137-0x0000000000000000-mapping.dmp

Download
memory/4396-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4396-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4396-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4396-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4396-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4456-132-0x0000000000F60000-0x0000000001058000-memory.dmp

Filesize
992KB

Download
memory/4456-133-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/4456-134-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/4456-135-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/4456-136-0x0000000009420000-0x00000000094BC000-memory.dmp

Filesize
624KB

Download