Analysis
-
max time kernel
93s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2024 00:04
Behavioral task
behavioral1
Sample
remcos_a.exe
Resource
win10-20240404-en
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
remcos_a.exe
Resource
win10v2004-20240709-en
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
remcos_a.exe
Resource
win11-20240709-en
1 signatures
300 seconds
General
-
Target
remcos_a.exe
-
Size
428KB
-
MD5
cc69cac4b290ffe3a48eb97a84161c3c
-
SHA1
e45d5038e8768728383268d8b446221a258ea5cf
-
SHA256
8dbaaf8394250340e282a70a69dad00c21424e68d56cfc46816c1d0c2a2a0bd6
-
SHA512
d0fc16e29cbd878313b64aba9c9215d2122813cdd2f3f29356e77941e3104b3851aa9fdbd18700d4a08bb32a5e0c10ccf2a989c71cb9f15289c9d4f38b30a06c
-
SSDEEP
6144:uCJBSkHyP4DivRrO+d3cyU6320ho4nbJAj0N91EU7ZUFbz68AO2wjXH7ecrX6B3:uCJB/RuFhU6ho0ej0N91HFAAw778B3
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4344 2700 WerFault.exe remcos_a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"1⤵PID:2700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 6002⤵
- Program crash
PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2700 -ip 27001⤵PID:5064