remcos | 2c620195dddbd080bff652a08fe7287023cb27ffe8418a2bbc478dad376b63b8

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 00:26

Target

6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe
Size

108KB
MD5

6172d523e7d0677101201d4532cf0098
SHA1

b3077ec85cbb03f0548379745d30c535b8ae72a6
SHA256

2c620195dddbd080bff652a08fe7287023cb27ffe8418a2bbc478dad376b63b8
SHA512

67cbc7af916a4c4f4c10591f54cd37613ebecba9afb94795c2608a62e0e5cc626273ad13ecb14a6265b9940bf5973ef8bf88d52be6ea4187f97ea9281feb5e5e
SSDEEP

3072:eFNUcekHxRkuHxSWMDUajQJf/p/itxBCBpEzImXnZvHI+zIcEUrp5:eHUcLxRkuRSWMDUaGf/p/sxWpEzImXZn

Score

10^/10

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

79.172.242.28:2404

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe

description pid process target process

PID 2892 set thread context of 2192 2892 6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe iexplore.exe

description	pid	process	target process
PID 2892 set thread context of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe

description	pid	process	target process
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe
PID 2892 wrote to memory of 2192	2892	6172d523e7d0677101201d4532cf0098_JaffaCakes118.exe	iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:2192

memory/2192-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download