remus_stealer | 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c

Analysis

max time kernel
298s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 00:19

Target
FLTLIB.dll
Size 33.3MB
Sample260819-al8bfstdlb
SHA256 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c
MD5 987ea6e787945b049b32c1bdb31b54aa
SHA1 da97a8cfeeecbc1af4d034bb877f9558840a4fe3
SHA512 dde8c30a6f8c925142afae743ba10cb8e2639a46f405919565f0a8f30e1270d8e16f342f587301783b6b75fc0a04cf8dd17546b7ffbaa9682e47c3b7aa6d3bf7
SSDEEP 196608:gBw90Fzm+TtnKz7Puu0cRzOeYT9UMeN/I5usq:gBw90FvTiT0S6eYTOMepxl
TLSH
T1D5778C05A39705ABD436DAF8CA3492F2F2B37D524636814B0959F63F1F73A504B3BA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4204 set thread context of 3088	4204	rundll32.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3088	4204	rundll32.exe	89
PID 4204 wrote to memory of 3088	4204	rundll32.exe	89
PID 4204 wrote to memory of 3088	4204	rundll32.exe	89
PID 4204 wrote to memory of 3088	4204	rundll32.exe	89
PID 4204 wrote to memory of 3088	4204	rundll32.exe	89
PID 4204 wrote to memory of 3088	4204	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLTLIB.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:3088

memory/3088-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download