Overview

overview

10

Static

static

10

2680-80-0x...ry.exe

windows7-x64

10

2680-80-0x...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    203s
  • max time network
    222s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 10:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2680-80-0x0000000003400000-0x0000000004400000-memory.exe

  • Size

    16.0MB

  • MD5

    12c161188f2444ec79e64e14a0b2a87c

  • SHA1

    cf8baf01528feff44e038e3ed6d8c51d05360422

  • SHA256

    15edd6a40d636d26c70cd211de71098e0dcb06b1bf68763371f5760410d0f6bc

  • SHA512

    f43301ae28a96fe354f1e16e9f77a1c9ef60d00de25c3c9594c66ebac2046c88d515f898c824ca7fbb3bad0f24728269d1b44365c8251bf02329f3cefcb0ca96

  • SSDEEP

    6144:h/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7q7ov:h/uPq3AfK496Gw0lwGXN3pvs/Zub8v

Score
10/10
remcosrat

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

Processes

  • C:\Users\Admin\AppData\Local\Temp\2680-80-0x0000000003400000-0x0000000004400000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2680-80-0x0000000003400000-0x0000000004400000-memory.exe"
    1⤵
      PID:1876

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1876-0-0x0000000000590000-0x0000000000615000-memory.dmp

            Filesize

            532KB

            Download