remcos | 1180-76-0x0000000000400000-0x000000000047F000-memory[.]dmp

General

Target
1180-76-0x0000000000400000-0x000000000047F000-memory.dmp
Size 508KB
Sample240302-md3gfscg27
SHA256 7d24f4a185376131ea931a6e7d1abba6a0149e73b2f913ce044900a65d452eb5
MD5 ad32ec82c4a63f223f81504010732e06
SHA1 02b85cba3c128822e3ec9af4a36d3ee5a90c0499
SHA512 b8f58667d910064891994713d2e9b422f71bdbc77d2adfae2b247a79cedcbf8695b9958c8121e6b10591b7eb02b04078a21811a14f4a70e4143f0c07b1b6287f
SSDEEP 6144:QbdjQFiTrgVohW1ydxCrLkE7ZFCSq1zeH4L5WIMOHsAOZZL1XBcY:QbdUYCohW1kMfkEbCSqxeYdsfZL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1180-76-0x0000000000400000-0x000000000047F000-memory.dmp

File Explorer

1180-76-0x0000000000400000-0x000000000047F000-memory.dmp

.exe 508KB

1180-76-0x0000000000400000-0x000000000047F000-memory.dmp

SHA256 7d24f4a185376131ea931a6e7d1abba6a0149e73b2f913ce044900a65d452eb5
MD5 ad32ec82c4a63f223f81504010732e06
SHA1 02b85cba3c128822e3ec9af4a36d3ee5a90c0499
SHA512 b8f58667d910064891994713d2e9b422f71bdbc77d2adfae2b247a79cedcbf8695b9958c8121e6b10591b7eb02b04078a21811a14f4a70e4143f0c07b1b6287f
SSDEEP 6144:QbdjQFiTrgVohW1ydxCrLkE7ZFCSq1zeH4L5WIMOHsAOZZL1XBcY:QbdUYCohW1kMfkEbCSqxeYdsfZL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

207910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

338KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1180-76-0x0000000000400000-0x000000000047F000-memory.dmp

generic