Remcos RAT PEB Masquerade as explorer.exe via iexplore/ieinstal/ielowutil
Detects Remcos RAT masquerading as explorer.exe by launching legitimate Internet Explorer browser components (iexplore.exe, ieinstal.exe, or ielowutil.exe) in a suspended state. This activity is indicative of process hollowing or PEB modification used by Remcos to inject malicious code into a seemingly legitimate process while evading detection.
YARA-L
