remcos | 49042e86af4503a917b8408c4faab2759688065a429015a2c90430fa7371291f

Analysis

max time kernel
299s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2024, 23:01

Target

Dropped Malware/BNP DOC 12578945329763-7633562829.exe
Size

2.1MB
MD5

864ec5148797f4e02d42e1bccd9a6fe7
SHA1

bc0a0146ef1d4fbab0b1a75c82cc45bbd94b4f2f
SHA256

0ec61eda09a5b90027808d2295a193eb7a8e81d440e5460d00a69328c2f9ee81
SHA512

13e2bc609ac3fe021b39ffb783d7dda07eb5028752cc22c4adf0363b23624c92618b83b913e95bbc8c854341eb2fc8be5bf6903699031623a8a50b167b593f49
SSDEEP

49152:nOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZNIrRo2ht1W1cvkN8TCiJ5QtbF:Gv85wDJ5QtB

Score

10^/10

Family

remcos

Botnet

1218202300

softwareupdatexkwre.duckdns.org:45682

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79
PID 2492 wrote to memory of 3660	2492	BNP DOC 12578945329763-7633562829.exe	79

C:\Users\Admin\AppData\Local\Temp\Dropped Malware\BNP DOC 12578945329763-7633562829.exe
"C:\Users\Admin\AppData\Local\Temp\Dropped Malware\BNP DOC 12578945329763-7633562829.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:3660

memory/3660-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3660-1-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3660-2-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3660-3-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3660-4-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3660-5-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download