remcos | 377992d8853161f9ea2d23e0bcebcc069e97ac9c0f498b8459a24ecc4c4c937f

Analysis

max time kernel
192s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:27

Target

574886754fee218e6e04abfd57608d45.exe
Size

970KB
MD5

574886754fee218e6e04abfd57608d45
SHA1

2fb47d1f6b0fd08745707e0bffef4132f7dbc0b8
SHA256

377992d8853161f9ea2d23e0bcebcc069e97ac9c0f498b8459a24ecc4c4c937f
SHA512

097e5775acff67f6b4f1a18bcb0fd44a3b1eb0a6c7821757649281af7e3f15411f2110ed72a78742b1ebfbd1456f52dd0fa81158722e5f89a2333984a544a8ce
SSDEEP

24576:UAgh/PJv46D6VAwhgPlSDOznsDF3brtY:Ujh/lD6AMgdymnKFXC

Score

10^/10

remcos baller rat

Family

remcos

Botnet

BALLER

91.192.100.48:1979

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

574886754fee218e6e04abfd57608d45.exe

description pid process target process

PID 1460 set thread context of 2952 1460 574886754fee218e6e04abfd57608d45.exe 574886754fee218e6e04abfd57608d45.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

574886754fee218e6e04abfd57608d45.exe

pid process

2952 574886754fee218e6e04abfd57608d45.exe

description	pid	process	target process
PID 1460 set thread context of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe

pid	process
2952	574886754fee218e6e04abfd57608d45.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

574886754fee218e6e04abfd57608d45.exe

description	pid	process	target process
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe
PID 1460 wrote to memory of 2952	1460	574886754fee218e6e04abfd57608d45.exe	574886754fee218e6e04abfd57608d45.exe

C:\Users\Admin\AppData\Local\Temp\574886754fee218e6e04abfd57608d45.exe
"C:\Users\Admin\AppData\Local\Temp\574886754fee218e6e04abfd57608d45.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2952

memory/1460-132-0x0000000000E70000-0x0000000000F68000-memory.dmp

Filesize
992KB

Download
memory/1460-133-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/1460-134-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/1460-135-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/1460-136-0x0000000008090000-0x000000000812C000-memory.dmp

Filesize
624KB

Download
memory/2952-137-0x0000000000000000-mapping.dmp

Download
memory/2952-138-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2952-139-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2952-140-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2952-141-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2952-142-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download