95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf | Triage

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 23:55

Sharing

Report Analysis Logs

General

Target

Remcos Professional.exe
Size

6.5MB
MD5

1ecae7b88236fff686604c40f2ec8ef0
SHA1

5338d387c764b7da0a097e4dd38c17c603e62b08
SHA256

95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf
SHA512

6a396bf98181250a2a386c2ee4dbcd8a4be6e23de029d614296e6f33a66b6f6049b487ef07d70936812c31f6cce7bb1b709361b749e0b1ad3507382b26c00a5c
SSDEEP

196608:CyDxS34Qskc93Uuze5VbN0Wp4ctz7Z9aVi:txb1kcWuzku84cNd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2008-0-0x000000013F310000-0x0000000140C54000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

C:\Users\Admin\AppData\Local\Temp\Remcos Professional.exe
"C:\Users\Admin\AppData\Local\Temp\Remcos Professional.exe"
1⤵
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x000000013F310000-0x0000000140C54000-memory.dmp

Filesize
25.3MB

Download