Overview

overview

10

Static

static

10

e5d56a9880...bf.exe

windows7-x64

10

e5d56a9880...bf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 19:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe

  • Size

    124KB

  • MD5

    836f20f29fe33a7f80578d36dd3429c6

  • SHA1

    edbea84969b18b9e241a3bc7fe4b61dd302f58a9

  • SHA256

    e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf

  • SHA512

    abeecfd989d81b50ef8a50f2ccf51c26c29245c02e081d93beca68d5f2b1865e974213a3140e1a599764a60b462d73789d6c483b555d17e975d8e18fc88cb0f2

  • SSDEEP

    3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNG2k4OzqhaIrc+5:MGuVUD7/5yBP3s5p8m5IYNG2tOzqhaU

Score
10/10
remcosrat

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe
    "C:\Users\Admin\AppData\Local\Temp\e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\remcos\logs.dat
    Filesize

    79B

    MD5

    ab5661f3ac088336f7461adde33461d8

    SHA1

    0d19694c55dd0a83a5215fb07c2a9a65259dad60

    SHA256

    65c50428f5156b365ab4b8b5a0709f216616dba2b57b2975988e8a3a27780dbc

    SHA512

    0d46adfce8f7b522100a200f0610345fc3f1fa040beb8114215e39c229ad5a8f6973fdcdf35bfc6b717a1ba07cd969f8d101bd8fcbbfdb366d574d733038b234

    Download Submit