remcos | 2932-204-0x0000000010590000-0x0000000010613000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2932-204-0x0000000010590000-0x0000000010613000-memory.dmp
Size

524KB
MD5

f8c347c454ca624617ffb842fcf4b112
SHA1

4e26c73fa20b9f6bccdfc96f91aaa36b7323c853
SHA256

542bdf8dcd0fb9cf72a0fbd1bcafce3701ccf67d188e3feb824e64361a59079d
SHA512

f0820696a908716d5b205dd1def206099e2493472b5dee528794166cba75fa5b86408f7e8b84f2a8b587a396dc02310c7bd5fed1f8b8dd6473c66007bbd64ab0
SSDEEP

6144:zuXSTGAOFCBf7tcJLsfuRpAKSC2eKCmB/tvPNT/kC+xiGsAOZZ0QXLcAXRq:6XnQpc9IuLAKN2eKCStvVgs/Z0GRq

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Files

2932-204-0x0000000010590000-0x0000000010613000-memory.dmp
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 479KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE