remcos | 94e964def734bac7e62fd8311cdea7568c2745aad40fd30de9e643240fbafaf2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 02:10

Target

4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe
Size

124KB
MD5

4ff2101e2f9d70643f8a2a33d74e0170
SHA1

ea237870949734caa0cdb2fb9c0c9c3de6dac5e4
SHA256

94e964def734bac7e62fd8311cdea7568c2745aad40fd30de9e643240fbafaf2
SHA512

95a879947ae38d3a0f9cb5d6e4554d53e285b2d41df5cb1ff64402d523fa8ccb08890e45f9e4c6dc768b2fb5732eabc2156022e2208131a43a6da970f8889e5f
SSDEEP

3072:4d8jGSsTMh7pqhCiE5xc4UbzdU4OzqhEhrc+5:kuGrQ7qE5xcPdOzqhEZ

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

352 2212 WerFault.exe 4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

pid process

2212 4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

pid	pid_target	process	target process
352	2212	WerFault.exe	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

pid	process
2212	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

description	pid	process	target process
PID 2212 wrote to memory of 352	2212	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe	WerFault.exe
PID 2212 wrote to memory of 352	2212	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe	WerFault.exe
PID 2212 wrote to memory of 352	2212	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe	WerFault.exe
PID 2212 wrote to memory of 352	2212	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 236
2⤵
- Program crash
PID:352