remcos | 1720-62-0x0000000000400000-0x0000000000480000-memory[.]dmp

General

Target
1720-62-0x0000000000400000-0x0000000000480000-memory.dmp
Size 512KB
Sample240302-nkejmsda78
SHA256 14a2bcd53daea56316ccc68059bad77c88b47039a561fe2e0f727433582ef50e
MD5 cc33c1bdfcbb534a3fdca2368ec0997c
SHA1 a7566721d7dff60a38dd3b5770b1e1300716db47
SHA512 d09b064852fec45a0f4a3de122b7bccbc2e59a136b0d3eb14fc5ca05fb0edea1a82f40fae180b8b976e6290f9e42a35abfa1aa7d06fb6d74f2d554a2acf285cd
SSDEEP 6144:rjH9dY1fKmXbwxqbQWmudPOqwiXO3X2yjKCrp/5ttAAMS6NYUsAOZZgQXTc9:rjdAK8wxqkXuxOqLXO3X2orpbKs/Zg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1720-62-0x0000000000400000-0x0000000000480000-memory.dmp

File Explorer

1720-62-0x0000000000400000-0x0000000000480000-memory.dmp

.exe 512KB

1720-62-0x0000000000400000-0x0000000000480000-memory.dmp

SHA256 14a2bcd53daea56316ccc68059bad77c88b47039a561fe2e0f727433582ef50e
MD5 cc33c1bdfcbb534a3fdca2368ec0997c
SHA1 a7566721d7dff60a38dd3b5770b1e1300716db47
SHA512 d09b064852fec45a0f4a3de122b7bccbc2e59a136b0d3eb14fc5ca05fb0edea1a82f40fae180b8b976e6290f9e42a35abfa1aa7d06fb6d74f2d554a2acf285cd
SSDEEP 6144:rjH9dY1fKmXbwxqbQWmudPOqwiXO3X2yjKCrp/5ttAAMS6NYUsAOZZgQXTc9:rjdAK8wxqkXuxOqLXO3X2orpbKs/Zg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

208467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

341KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1720-62-0x0000000000400000-0x0000000000480000-memory.dmp

generic