remcos | 3988-162-0x0000000010590000-0x0000000010613000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3988-162-0x0000000010590000-0x0000000010613000-memory.dmp
Size

524KB
MD5

4158fa317c306578b0306c33dd7a1cc0
SHA1

7a6623ce6a337c2d1ea06120e7e3a7414c0366b3
SHA256

926495bdc28dbaccb6087a5e7e50a288139daf6baf23d7694a40030d7efc8bf8
SHA512

4184db0fc5df6fab66baa2800991feb818c59edc539ec4aa8aca441064a8309cd573fd114363a5a4cdf65174011272be45d3435cfa1538e7843a05deb54107fa
SSDEEP

6144:1GqPd7rxgdfHD0Tnt5eh+4CwineHvWyBKxrw/5ttwAMS6NZ0sAOZZ7QX3cUFRq:1GAxQj0bTe04CLneHvW9rwbxs/Z7IRq

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Files

3988-162-0x0000000010590000-0x0000000010613000-memory.dmp
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 478KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE