remus_stealer | 6f237ca43382d389421a084b18e0e32b522d60a10727d4742c9822ad64c9d999

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 18:30

Target
file_a8b257b458693ac9.exe
Size 3.0MB
Sample260930-w5ts3aydpd
SHA256 6f237ca43382d389421a084b18e0e32b522d60a10727d4742c9822ad64c9d999
MD5 133517cc137dba1e885871e6d461717b
SHA1 05fe6a71add6db59c0457698f4bc7a56287ab43b
SHA512 4fa1e798ce6f7f4d8d811d3b27513c45957a19d40269b0518f8dccbc8eed64afd5e44fb8553e3b7e288ec53220b95b6e599f7d8969bc262534a6597495ebb0c4
SSDEEP 49152:h4z5mVByX+Xw+5e0rkCoaVwJdbTD3q+4Ofz:h4YQO80C/TbaOr
TLSH
T1C0E58D1BFC9518EAC0AA63328DB355923735BC452F3267CB2A9076B82FB36D05D79704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 5820	1324	file_a8b257b458693ac9.exe	90

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5820	1324	file_a8b257b458693ac9.exe	90
PID 1324 wrote to memory of 5820	1324	file_a8b257b458693ac9.exe	90
PID 1324 wrote to memory of 5820	1324	file_a8b257b458693ac9.exe	90
PID 1324 wrote to memory of 5820	1324	file_a8b257b458693ac9.exe	90
PID 1324 wrote to memory of 5820	1324	file_a8b257b458693ac9.exe	90
PID 1324 wrote to memory of 5820	1324	file_a8b257b458693ac9.exe	90

C:\Users\Admin\AppData\Local\Temp\file_a8b257b458693ac9.exe
"C:\Users\Admin\AppData\Local\Temp\file_a8b257b458693ac9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5820

memory/5820-0-0x00007FF6AB140000-0x00007FF6AB17A000-memory.dmp

Download

memory/5820-5-0x00007FF6AB140000-0x00007FF6AB17A000-memory.dmp

Download