remcos | m[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
m.exe
Size 463KB
Sample220329-1lfvbafhaj
SHA256 2c8b78fc6c4fe463dac9d39fde2871f1bb2605453bc0f2d57c7549cf5d07aa86
MD5 b933b611ce9fad4e6ea2a50a45388039
SHA1 bbccc56fcb82968f5a0e3b037a2110701bb96747
SHA512 5a5fad65223a8f118fbf51169eb2d5f56c288f8cec3d4699536ceb0b70731a8b2a4921fcb1f04e7ef7982c5312ed8b5b269f162fb3613e4378eb514fa38d7dcf
MD5 SHA1 SHA512

Score

10^/10

test remcos

Malware Config

Extracted

Family

remcos

Botnet

test

harveyautos110.ddns.net:2404
harveyautos111.hopto.org:2404
harveyautos112.ddns.net:2404
harvey205.camdvr.org:2404
harvey206.casacam.net:2404
harvey207.accesscam.org:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
lluiiidddppydcadejeyrygoiytirolppkk-W6Q6HN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos family
remcos

File Explorer

m.exe

.exe 463KB

m.exe

IMPHASH 029a987f21e33b48f24d21b6f9ff1129
SHA256 2c8b78fc6c4fe463dac9d39fde2871f1bb2605453bc0f2d57c7549cf5d07aa86
MD5 b933b611ce9fad4e6ea2a50a45388039
SHA1 bbccc56fcb82968f5a0e3b037a2110701bb96747
SHA512 5a5fad65223a8f118fbf51169eb2d5f56c288f8cec3d4699536ceb0b70731a8b2a4921fcb1f04e7ef7982c5312ed8b5b269f162fb3613e4378eb514fa38d7dcf
MD5 SHA1 SHA512

windows x86

Minor OS version

Major OS version

Entry point

200558

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocaleInfoA CreateToolhelp32Snapshot OpenMutexA Process32NextW LoadLibraryA Process32FirstW GetProcAddress VirtualProtect SetLastError VirtualFree VirtualAlloc GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GetCurrentProcess GetSystemDirectoryA GlobalAlloc GlobalLock GetTickCount GlobalUnlock WriteProcessMemory ResumeThread GetThreadContext VirtualAllocEx ReadProcessMemory CreateProcessW SetThreadContext LocalAlloc GlobalFree MulDiv SizeofResource GetLongPathNameW SetFilePointer FindResourceA LockResource LoadResource LocalFree FormatMessageA GetModuleFileNameA lstrcpynA AllocConsole CreateMutexA QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapReAlloc GetACP GetStdHandle GetModuleHandleExW MoveFileExW RtlUnwind RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue CopyFileW DeleteFileA ExpandEnvironmentStringsA FindNextFileA FindFirstFileA GetFileSize TerminateThread CreateDirectoryW GetLastError SetFileAttributesW GetModuleHandleA RemoveDirectoryW MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW ExitProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep GetModuleFileNameW CloseHandle ExitThread CreateFileW WriteFile QueryPerformanceFrequency TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

SetForegroundWindow SetClipboardData EnumWindows ExitWindowsEx EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible TranslateMessage DispatchMessageA GetMessageA GetWindowTextW wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow GetWindowThreadProcessId GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CallNextHookEx CloseWindow SendInput mouse_event DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetCursorPos RegisterClassExA GetKeyboardLayoutNameA GetWindowTextLengthW GetKeyState ToUnicodeEx AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu CreatePopupMenu

gdi32

CreateCompatibleBitmap CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA SelectObject

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCreateKeyA RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegDeleteKeyA

shell32

ShellExecuteW ShellExecuteExA Shell_NotifyIconA ExtractIconA

shlwapi

PathFileExistsW PathFileExistsA StrToIntA

winmm

PlaySoundW mciSendStringA mciSendStringW waveInClose waveInAddBuffer waveInStart waveInOpen waveInUnprepareHeader waveInPrepareHeader waveInStop

ws2_32

send socket connect recv gethostbyname WSASetLastError inet_addr gethostbyaddr getservbyport ntohs getservbyname htonl htons inet_ntoa closesocket WSAGetLastError WSAStartup

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream

Name

.text

Size

331KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ