Remcos RAT Process Hollowing into Default Browser via Remcos_Mutex_Inj

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects Remcos RAT attempting process hollowing into common web browser executables. This rule identifies several indicators: creation of the 'Remcos_Mutex_Inj' mutex, a sequence of API calls (VirtualAllocEx, WriteProcessMemory, NtUnmapViewOfSection) targeting browser processes from a non-browser process, and the presence of a known Remcos payload MD5 hash (4924369C0BDAF73B21EB992EB9DB4DEA).