2026-09-28_0e134e53aac5a46af8d7a50b945fd0e5_elex_parallax_remcos_remocs_wannacry
Remcos RAT with keylogger
Imports unmap, write, and thread contextUnmap-based RunPE process hollowing
SHA-25628d840216fd88f2c15e69e3281f1c02a84ef9a1905bbe6e9ad9fabdf8302755d
Evidence
⋯7 more rows
0x98e4abababab8d45f0508d45ac5033c05050.....E.P.E.P3.PP
0x98f468000000085050506858584100683c58h....PPPhXXA.h<X
0x99044100ff159c414100ff75f08b35d44141A....AA..u..5.AA
⋯15 more rows
⋯7 more rows
0x132b0000000005b4461746153746172745d00....[DataStart].
0x132c0253032693a253032693a253032693a25%02i:%02i:%02i:%
0x132d0303369205b494e464f5d20004b65657003i [INFO] .Keep
0x132e0416c69766520456e61626c6564212054Alive Enabled! T
⋯12 more rows
0x133b067650000010000000a0000005c000000ge..........\...
0x133c053797374656d447269766500636d642eSystemDrive.cmd.
0x133d0657865006f00700065006e0000000000exe.o.p.e.n.....
0x133e06576656e747677722e65786500000000eventvwr.exe....
0x133f053006f00660074007700610072006500S.o.f.t.w.a.r.e.
0x134005c0043006c0061007300730065007300\.C.l.a.s.s.e.s.
0x134105c006d0073006300660069006c006500\.m.s.c.f.i.l.e.
0x134205c007300680065006c006c005c006f00\.s.h.e.l.l.\.o.
⋯5 more rows
0x1348056657273696f6e4e756d626572730000VersionNumbers..
0x13490536f6674776172655c436c6173736573Software\Classes
0x134a05c6d736366696c655c7368656c6c5c6f\mscfile\shell\o
0x134b070656e5c636f6d6d616e64002e000000pen\command.....
0x134c055706c6f6164696e672066696c652074Uploading file t
⋯7 more rows
⋯6 more rows
0x138595b4573635d2000205b50616755705d20[Esc] . [PagUp]
0x13869000000205b4374726c202b20565d0d0a... [Ctrl + V]..
0x138795b466f6c6c6f77696e67207465787420[Following text
0x13889686173206265656e2070617374656420has been pasted
0x1389966726f6d20636c6970626f6172643a5dfrom clipboard:]
0x138a90d0a000d0a5b456e64206f6620636c69.....[End of cli
0x138b970626f61726420746578745d0d0a0d0apboard text]....
0x138c9000000205b4374726c202b2000000080... [Ctrl + ....
0x138d9000000205b4c4374726c5d2000000020... [LCtrl] ...
0x138e95b524374726c5d200000000d0a5b466f[RCtrl] .....[Fo
0x138f96c6c6f77696e67207465787420686173llowing text has
0x13909206265656e20636f7069656420746f20 been copied to
0x13919636c6970626f6172643a5d0d0a00000dclipboard:].....
0x139290a5b456e64206f6620636c6970626f61.[End of clipboa
0x13939726420746578745d0d0a000a5b436872rd text]....[Chr
0x139496f6d652053746f7265644c6f67696e73ome StoredLogins
0x1395920666f756e642c20636c656172656421 found, cleared!
0x139695d00000a5b4368726f6d652053746f72]...[Chrome Stor
0x1397965644c6f67696e73206e6f7420666f75edLogins not fou
0x139896e645d000000005573657250726f6669nd]....UserProfi
0x139996c65005c417070446174615c4c6f6361le.\AppData\Loca
0x139a96c5c476f6f676c655c4368726f6d655cl\Google\Chrome\
0x139b95573657220446174615c44656661756cUser Data\Defaul
0x139c9745c4c6f67696e20446174610000000at\Login Data....
0x139d95b4368726f6d6520436f6f6b69657320[Chrome Cookies
0x139e9666f756e642c20636c6561726564215dfound, cleared!]
0x139f90000000a5b4368726f6d6520436f6f6b....[Chrome Cook
0x13a09696573206e6f7420666f756e645d005cies not found].\
0x13a19417070446174615c4c6f63616c5c476fAppData\Local\Go
0x13a296f676c655c4368726f6d655c55736572ogle\Chrome\User
0x13a3920446174615c44656661756c745c436f Data\Default\Co
0x13a496f6b69657300000a5b46697265666f78okies...[Firefox
0x13a592053746f7265644c6f67696e7320636c StoredLogins cl
0x13a696561726564215d000000005c6b657933eared!]....\key3
0x13a792e6462000000005c6c6f67696e732e6a.db....\logins.j
0x13a89736f6e000000002e2e00000a5b466972son.........[Fir
0x13a9965666f782053746f7265644c6f67696eefox StoredLogin
0x13aa973206e6f7420666f756e645d0000005cs not found]...\
0x13ab9417070446174615c526f616d696e675cAppData\Roaming\
0x13ac94d6f7a696c6c615c46697265666f785cMozilla\Firefox\
0x13ad950726f66696c65735c00000a5b466972Profiles\...[Fir
0x13ae965666f7820636f6f6b69657320666f75efox cookies fou
⋯3 more rows
0x13ff074007300280022000000000022002900t.s.(.".....".).
0x140000a0000004f006e002000450072007200....O.n. .E.r.r.
0x140106f007200200052006500730075006d00o.r. .R.e.s.u.m.
0x14020650020004e006500780074000a000000e. .N.e.x.t.....
0x140305c0075006e0069006e00730074006100\.u.n.i.n.s.t.a.
0x140406c006c002e0076006200730000000000l.l...v.b.s.....
0x14050657865706174680055736572696e6974exepath.Userinit
0x1406000000000433a5c57494e444f57535c73....C:\WINDOWS\s
0x14070797374656d33325c75736572696e6974ystem32\userinit
0x140802e657865000000005368656c6c000000.exe....Shell...
0x140906578706c6f7265722e65786500000000explorer.exe....
0x140a0536f6674776172655c4d6963726f736fSoftware\Microso
0x140b066745c57696e646f7773204e545c4375ft\Windows NT\Cu
0x140c07272656e7456657273696f6e5c57696errentVersion\Win
0x140d06c6f676f6e5c00005c00750070006400logon\..\.u.p.d.
0x140e06100740065002e007600620073000000a.t.e...v.b.s...
0x140f04300720065006100740065004f006200C.r.e.a.t.e.O.b.
0x141006a006500630074002800220053006300j.e.c.t.(.".S.c.
0x14110720069007000740069006e0067002e00r.i.p.t.i.n.g...
0x14120460069006c0065005300790073007400F.i.l.e.S.y.s.t.
0x1413065006d004f0062006a00650063007400e.m.O.b.j.e.c.t.
0x14140220029002e00440065006c0065007400".)...D.e.l.e.t.
0x141506500460069006c006500280057007300e.F.i.l.e.(.W.s.
0x14160630072006900700074002e0053006300c.r.i.p.t...S.c.
0x141707200690070007400460075006c006c00r.i.p.t.F.u.l.l.
0x141804e0061006d006500290000005c007200N.a.m.e.)...\.r.
0x141906500730074006100720074002e007600e.s.t.a.r.t...v.
0x141a062007300000000005500730065007200b.s.....U.s.e.r.
0x141b0500072006f00660069006c0065000000P.r.o.f.i.l.e...
0x141c041007000700044006100740061000000A.p.p.D.a.t.a...
0x141d0500072006f006700720061006d004600P.r.o.g.r.a.m.F.
0x141e069006c0065007300000000005c005300i.l.e.s.....\.S.
0x141f07900730057004f005700360034000000y.s.W.O.W.6.4...
0x142005c00730079007300740065006d003300\.s.y.s.t.e.m.3.
0x1421032000000570069006e004400690072002...W.i.n.D.i.r.
0x1422000000000530079007300740065006d00....S.y.s.t.e.m.
0x142304400720069007600650000001e000000D.r.i.v.e.......
0x142406c6963656e6365002028333220626974licence. (32 bit
0x1425029000000202836342062697429000000)... (64 bit)...
0x14260534f4654574152455c4d6963726f736fSOFTWARE\Microso
0x1427066745c57696e646f7773204e545c4375ft\Windows NT\Cu
0x142807272656e7456657273696f6e00000000rrentVersion....
0x1429050726f647563744e616d6500496e6a00ProductName.Inj.
0x142a052656d636f735f4d757465785f496e6aRemcos_Mutex_Inj
0x142b00000000057440000536f667477617265....WD..Software
⋯3 more rows
0x17cf6a80077617665496e537461727400a500..waveInStart...
0x17d0677617665496e4f70656e00009b007761waveInOpen....wa
0x17d167665496e41646442756666657200a600veInAddBuffer...
⋯4 more rows
0x17d66496e53746f70000057494e4d4d2e646cInStop..WINMM.dl
0x17d766c005753325f33322e646c6c00003f00l.WS2_32.dll..?.
0x17d8655524c446f776e6c6f6164546f46696cURLDownloadToFil
0x17d9665570000420055524c4f70656e426c6feW..B.URLOpenBlo
0x17da6636b696e6753747265616d5700007572ckingStreamW..ur
0x17db66c6d6f6e2e646c6c0000120147646970lmon.dll....Gdip
0x17dc6476574496d616765456e636f64657273GetImageEncoders
⋯13 more rows
0x17ea6696c6500676469706c75732e646c6c00ile.gdiplus.dll.
0x17eb65600496e7465726e6574436c6f736548V.InternetCloseH
0x17ec6616e646c65007700496e7465726e6574andle.w.Internet
0x17ed65265616446696c6500007100496e7465ReadFile..q.Inte
0x17ee6726e65744f70656e55726c4100006f00rnetOpenUrlA..o.
0x17ef6496e7465726e65744f70656e41005749InternetOpenA.WI
0x17f064e494e45542e646c6c00500147657453NINET.dll.P.GetS
0x17f16746172747570496e666f410034015f69tartupInfoA.4._i
⋯10 more rows