remcos | 0979159201a936120d137b6a1669c1bf9913483e8b261b8b40f6d150908b7ddf

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 02:49

Target

9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
Size

124KB
MD5

9745158a44764f2c56f32f93658380e0
SHA1

f2f84ac2e32fd8bbe804cc172ae0579274622a87
SHA256

0979159201a936120d137b6a1669c1bf9913483e8b261b8b40f6d150908b7ddf
SHA512

2b82c809e03de8023929e936cf093e3a64c0c663170a9827ac350492b4d980b5084b5c03356e2e898bef0bcf49008c5d957aa06d7bd3299814d67702fa34dce2
SSDEEP

3072:4d8jGSsTMh7pqhCiE5xc4UbzyU4OzqhEWrc+5:kuGrQ7qE5xcsdOzqhEi

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2072 1932 WerFault.exe 9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

pid process

1932 9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

pid	pid_target	process	target process
2072	1932	WerFault.exe	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

pid	process
1932	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

description	pid	process	target process
PID 1932 wrote to memory of 2072	1932	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe	WerFault.exe
PID 1932 wrote to memory of 2072	1932	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe	WerFault.exe
PID 1932 wrote to memory of 2072	1932	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe	WerFault.exe
PID 1932 wrote to memory of 2072	1932	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 236
2⤵
- Program crash
PID:2072