remcos | 564d742044e5ac9f6279c01c5c29bb801606b63c6c2cbfc2af09d8f2a73b84a6

Analysis

max time kernel
178s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:54

Target

10012024_1753_gbrem.exe
Size

15.6MB
MD5

b6a22c3dfc954914f051aa33d2e2af1a
SHA1

18a53be63f02b68b9772a892816f83a6d97a1789
SHA256

564d742044e5ac9f6279c01c5c29bb801606b63c6c2cbfc2af09d8f2a73b84a6
SHA512

4dad54e04a99cdfbe473813647bb95e4410964b3fde126faca497f27ca8bcbcbd81f41129716af6a948a131282b6bde003b172b4cdcc33825d53c3144509a23f
SSDEEP

393216:XsMcUFlcXXZKTMlViqmu0k4nj8AcVwecyccnauSbb1LcVm:8pnZKTMlgfkMXcVMyouSbbK

Score

10^/10

remcos dvg rat

Family

remcos

Botnet

dvg

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 3692	3720	10012024_1753_gbrem.exe	105

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105
PID 3720 wrote to memory of 3692	3720	10012024_1753_gbrem.exe	105

C:\Users\Admin\AppData\Local\Temp\10012024_1753_gbrem.exe
"C:\Users\Admin\AppData\Local\Temp\10012024_1753_gbrem.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\10012024_1753_gbrem.exe
  "C:\Users\Admin\AppData\Local\Temp\10012024_1753_gbrem.exe"
  2⤵
  PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3692 -ip 3692
1⤵
PID:4040

memory/3692-6-0x0000000001600000-0x0000000001682000-memory.dmp

Filesize
520KB

Download
memory/3692-11-0x0000000001600000-0x0000000001682000-memory.dmp

Filesize
520KB

Download
memory/3692-18-0x0000000001600000-0x0000000001682000-memory.dmp

Filesize
520KB

Download
memory/3720-0-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/3720-1-0x00000000002A0000-0x000000000124C000-memory.dmp

Filesize
15.7MB

Download
memory/3720-2-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/3720-3-0x0000000006330000-0x00000000068D4000-memory.dmp

Filesize
5.6MB

Download
memory/3720-4-0x0000000005D70000-0x0000000005D80000-memory.dmp

Filesize
64KB

Download
memory/3720-5-0x0000000005D70000-0x0000000005D80000-memory.dmp

Filesize
64KB

Download
memory/3720-17-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download