remcos | 3369eb912edf7df233e2a70803ef0cee6d914a6e40ac6da0e54e20c72c32f65f

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 01:18

Target

PRICE QUOTATION 20221213.exe
Size

1.4MB
MD5

bd7e3b9eaff60e5729b3744cf7216f5b
SHA1

21db492e46494e622b41f59949b5efc987bdf341
SHA256

3369eb912edf7df233e2a70803ef0cee6d914a6e40ac6da0e54e20c72c32f65f
SHA512

742d0d74f23d25c02f2ce4b6535aa770022d0f3a2744cddf86e55349e40faa5a19ea1c5cda29511448e9f131aea6e60222ddf7bed1e6c1983824869c2452a534
SSDEEP

6144:Rp45B+dKiTNSNvLmgquzl5+ElI1lF/0mDPQAcg2zVd/Pn5XxZLffm49GFbNWjob9:RuVDTpGDma

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

PRICE QUOTATION 20221213.exe

description pid process target process

PID 2020 created 1412 2020 PRICE QUOTATION 20221213.exe Explorer.EXE
Suspicious use of SetThreadContext 1 IoCs

Processes:

PRICE QUOTATION 20221213.exe

description pid process target process

PID 2020 set thread context of 1588 2020 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PRICE QUOTATION 20221213.exe

pid process

1588 PRICE QUOTATION 20221213.exe

description	pid	process	target process
PID 2020 created 1412	2020	PRICE QUOTATION 20221213.exe	Explorer.EXE

description	pid	process	target process
PID 2020 set thread context of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe

pid	process
1588	PRICE QUOTATION 20221213.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PRICE QUOTATION 20221213.exe

description	pid	process	target process
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe
PID 2020 wrote to memory of 1588	2020	PRICE QUOTATION 20221213.exe	PRICE QUOTATION 20221213.exe

C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe
"C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1588

memory/1588-56-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1588-57-0x00000000004327A4-mapping.dmp

Download
memory/1588-59-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1588-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1588-61-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1588-62-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2020-54-0x0000000000DA0000-0x0000000000F0A000-memory.dmp

Filesize
1.4MB

Download
memory/2020-55-0x0000000000460000-0x00000000004AE000-memory.dmp

Filesize
312KB

Download