Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
-
submitted
01/07/2024, 18:22
General
-
Target
Remcos-RAT-3.8.0.exe
-
Size
7KB
-
MD5
6166f997b4bb3428ae0d9d4b4e1f0db2
-
SHA1
d18a89610c4ab5ff73532a608e3ba0038d6146e0
-
SHA256
3e3ef95e4d20e1cf759021d91f834b6f2c82a1a9dbab3cab1605a55bc85d5be5
-
SHA512
087be6857f602a648c612c9c849560c8c803182bf08bbdbc41f58eb17e28a1822ded1b1fb45c9a007722b6c6a19754671159a0a3510cc80188d3c145ab5a297c
-
SSDEEP
96:oz4/c4Kr6GgZ2+dzcMsio1ZafV/WyDhh1e35YZNW+hC/zNt:64KuG+2I5xfVWyDhh1eG10p
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos-RAT-3.8.0.exe"C:\Users\Admin\AppData\Local\Temp\Remcos-RAT-3.8.0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 17842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5104 -ip 51041⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB