remcos | 71f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527

Analysis

max time kernel
130s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:16

Target
07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe
Size 108KB
Sample240429-rlb2pace98
SHA256 71f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527
MD5 07dafacf45c8e2fe217985a20c1ee89d
SHA1 f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c
SHA512 08c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074
SSDEEP 3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnr+vHI+zIcdhrp5:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXqL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Botnet

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4108 set thread context of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82
PID 4108 wrote to memory of 3884	4108	07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07dafacf45c8e2fe217985a20c1ee89d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:3884

memory/3884-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download