remcos | 6b46090a5fbea2d1c5bddd027663f6874a934c3ad15545bd60379bd4b47860a1

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 03:20

Target
4880-99-0x0000000004860000-0x0000000005860000-memory.exe
Size 16.0MB
Sample240301-dv79labg79
SHA256 6b46090a5fbea2d1c5bddd027663f6874a934c3ad15545bd60379bd4b47860a1
MD5 2a8ba24711cfb0f919fb748c47f37ab5
SHA1 93a988cac5b865ef9c36537b5e343016a5010d24
SHA512 164cea3da020358966f7f8b0d42f2ae2476eb4a3a6cf4ffe2362f52ad356681c53bda35acd8c1da8d141b94b204dbd06160c83b59f1b0fc31d01b0e6cb809d52
SSDEEP 6144:l/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7A7ov:l/uPq3AfK496Gw0lwGXN3pvs/ZuN8v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

C:\Users\Admin\AppData\Local\Temp\4880-99-0x0000000004860000-0x0000000005860000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4880-99-0x0000000004860000-0x0000000005860000-memory.exe"
1⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2620

memory/2144-0-0x0000000000590000-0x0000000000615000-memory.dmp

Download