Overview

overview

10

Static

static

10

4b7c123604...cs.exe

windows7-x64

10

4b7c123604...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 01:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe

  • Size

    124KB

  • MD5

    4b7c123604dbae97b89842cb7fa42d10

  • SHA1

    43973288e57a6b7f485916143c013584dc964091

  • SHA256

    4bbb98f3c0bc56b8968cc9c5bea46ba18bd7381eb8f6b39d7a04877b1edd393d

  • SHA512

    ab903b54a22890cf9f9e287d83c3aab37ec73ed8b2f9eccc91cce08a5712a44076651d57afa328acf2711e53555b7bdb07d0f9d5ab3ff341877b2b675afe829f

  • SSDEEP

    3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGDk4Ozqhcyrc+5:MGuVUD7/5yBP3s5p8m5IYNGDtOzqhcG

Score
10/10
remcosrat

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\remcos\logs.dat
    Filesize

    79B

    MD5

    011c88b4ef2dcbf43c4086312adfd19d

    SHA1

    59d5a90d738e0ca86a4f8f4f9801e46f8b17316e

    SHA256

    fd8f2446c07950bfa056c497643153b22d4edf7ebd3351b63c20851b773b40fd

    SHA512

    f2891af71eaf0ba77d14cf181a8afbd2569b15d74b3ea6b94156e583bea05ea5a77b79f81e06abaceb5cf7215d82f5663175ec7947b06abab76e8b420b888a6d

    Download Submit