remcos | 0979159201a936120d137b6a1669c1bf9913483e8b261b8b40f6d150908b7ddf

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 02:49

Target

9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
Size

124KB
MD5

9745158a44764f2c56f32f93658380e0
SHA1

f2f84ac2e32fd8bbe804cc172ae0579274622a87
SHA256

0979159201a936120d137b6a1669c1bf9913483e8b261b8b40f6d150908b7ddf
SHA512

2b82c809e03de8023929e936cf093e3a64c0c663170a9827ac350492b4d980b5084b5c03356e2e898bef0bcf49008c5d957aa06d7bd3299814d67702fa34dce2
SSDEEP

3072:4d8jGSsTMh7pqhCiE5xc4UbzyU4OzqhEWrc+5:kuGrQ7qE5xcsdOzqhEi

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3760 3608 WerFault.exe 9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

pid process

3608 9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

pid	pid_target	process	target process
3760	3608	WerFault.exe	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

pid	process
3608	9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9745158a44764f2c56f32f93658380e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 612
2⤵
- Program crash
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3608 -ip 3608
1⤵
PID:3488