remcos | 94e964def734bac7e62fd8311cdea7568c2745aad40fd30de9e643240fbafaf2

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:10

Target

4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe
Size

124KB
MD5

4ff2101e2f9d70643f8a2a33d74e0170
SHA1

ea237870949734caa0cdb2fb9c0c9c3de6dac5e4
SHA256

94e964def734bac7e62fd8311cdea7568c2745aad40fd30de9e643240fbafaf2
SHA512

95a879947ae38d3a0f9cb5d6e4554d53e285b2d41df5cb1ff64402d523fa8ccb08890e45f9e4c6dc768b2fb5732eabc2156022e2208131a43a6da970f8889e5f
SSDEEP

3072:4d8jGSsTMh7pqhCiE5xc4UbzdU4OzqhEhrc+5:kuGrQ7qE5xcPdOzqhEZ

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4732 4044 WerFault.exe 4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

pid process

4044 4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

pid	pid_target	process	target process
4732	4044	WerFault.exe	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

pid	process
4044	4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ff2101e2f9d70643f8a2a33d74e0170_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 612
2⤵
- Program crash
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4044 -ip 4044
1⤵
PID:4400