remcos | 262f89154949a9f8d41b8fdb4de1013f897e60ab83225f8f35783bee6a1d6557

Analysis

max time kernel
183s
max time network
213s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:41

Target

travel itinerary.exe
Size

380.0MB
MD5

184ae205be9e6fb8e0f1983b60a380e9
SHA1

468f1122eb96501c0378ed8f68e640e292aa066b
SHA256

43cd9c2e9581da86628691ce210a40d64bb35ee6d7d33f0315d56c6208017781
SHA512

7069ed4602d2d5dec8defa91bd5682f33e26b39452641ec3b594a00039551cc5b4e3cdb16821faa9e42aacd9b7941a333af3e87b9c8e90d4f15a0bee936a52e1
SSDEEP

12288:e5UGXhYEdgwIRIxudakJOws9IxdDdaWzHRkmM4:/GxYEfIqMakIwsYhzHCmM4

Score

10^/10

remcos manup rat

Family

remcos

Botnet

manup

91.193.75.188:60005

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

travel itinerary.exe

description pid process target process

PID 1472 set thread context of 1744 1472 travel itinerary.exe travel itinerary.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

travel itinerary.exe

pid process

1744 travel itinerary.exe

description	pid	process	target process
PID 1472 set thread context of 1744	1472	travel itinerary.exe	travel itinerary.exe

pid	process
1744	travel itinerary.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

travel itinerary.exe

description	pid	process	target process
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe
PID 1472 wrote to memory of 1744	1472	travel itinerary.exe	travel itinerary.exe

C:\Users\Admin\AppData\Local\Temp\travel itinerary.exe
"C:\Users\Admin\AppData\Local\Temp\travel itinerary.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1744

memory/1472-54-0x0000000000280000-0x000000000031A000-memory.dmp

Filesize
616KB

Download
memory/1472-55-0x00000000020F0000-0x000000000216A000-memory.dmp

Filesize
488KB

Download
memory/1472-56-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1744-57-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-58-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-60-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-62-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-63-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-64-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-65-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-67-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-70-0x00000000004327A4-mapping.dmp

Download
memory/1744-71-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-76-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/1744-82-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download