remcos | xziwUIFDcuFe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
xziwUIFDcuFe.exe
Size 462KB
Sample220810-yldnvaeccq
SHA256 49efb022a06b4f063912eb2d6c3a95ddfef97b2b843ccdf369aa990191588189
MD5 43a2e23673b003ce068060b73d54c08d
SHA1 5356907bf5b4d504599c82b61682bcb45afda198
SHA512 522831d5ce320abc1aad87448e6cb847dd3edaacad7c0d2ddbb43756609fdca76d72590896bce60bd8d65aaf888740dffc0191b931f79121b4ff0042c0070e95
SSDEEP 12288:8oCqKde3G314caiojGRoaOd+2sfZsSVg:JAdIG314cFo4Od+NZjS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lola1 remcos

Malware Config

Extracted

Family

remcos

Botnet

lola1

avastupdate.con-ip.com:2100

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logosdat.dat
keylog_flag
false
keylog_folder
logosdat
keylog_path
ApplicationPath
mouse_option
false
mutex
privates1-59RKNX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos family
remcos

File Explorer

xziwUIFDcuFe.exe

.exe 462KB

xziwUIFDcuFe.exe

IMPHASH 029a987f21e33b48f24d21b6f9ff1129
SHA256 49efb022a06b4f063912eb2d6c3a95ddfef97b2b843ccdf369aa990191588189
MD5 43a2e23673b003ce068060b73d54c08d
SHA1 5356907bf5b4d504599c82b61682bcb45afda198
SHA512 522831d5ce320abc1aad87448e6cb847dd3edaacad7c0d2ddbb43756609fdca76d72590896bce60bd8d65aaf888740dffc0191b931f79121b4ff0042c0070e95
SSDEEP 12288:8oCqKde3G314caiojGRoaOd+2sfZsSVg:JAdIG314cFo4Od+NZjS
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

200533

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocaleInfoA CreateToolhelp32Snapshot OpenMutexA Process32NextW LoadLibraryA Process32FirstW GetProcAddress VirtualProtect SetLastError VirtualFree VirtualAlloc GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GetCurrentProcess GetSystemDirectoryA GlobalAlloc GlobalLock GetTickCount GlobalUnlock WriteProcessMemory ResumeThread GetThreadContext VirtualAllocEx ReadProcessMemory CreateProcessW SetThreadContext LocalAlloc GlobalFree MulDiv SizeofResource GetLongPathNameW SetFilePointer FindResourceA LockResource LoadResource LocalFree FormatMessageA GetModuleFileNameA lstrcpynA AllocConsole CreateMutexA QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapReAlloc GetACP GetStdHandle GetModuleHandleExW MoveFileExW RtlUnwind RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue CopyFileW DeleteFileA ExpandEnvironmentStringsA FindNextFileA FindFirstFileA GetFileSize TerminateThread CreateDirectoryW GetLastError SetFileAttributesW GetModuleHandleA RemoveDirectoryW MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW ExitProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep GetModuleFileNameW CloseHandle ExitThread CreateFileW WriteFile QueryPerformanceFrequency TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

SetForegroundWindow SetClipboardData EnumWindows ExitWindowsEx EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible TranslateMessage DispatchMessageA GetMessageA GetWindowTextW wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow GetWindowThreadProcessId GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CallNextHookEx CloseWindow SendInput mouse_event DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetCursorPos RegisterClassExA GetKeyboardLayoutNameA GetWindowTextLengthW GetKeyState ToUnicodeEx AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu CreatePopupMenu

gdi32

CreateCompatibleBitmap CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA SelectObject

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCreateKeyA RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegDeleteKeyA

shell32

ShellExecuteW ShellExecuteExA Shell_NotifyIconA ExtractIconA

shlwapi

PathFileExistsW PathFileExistsA StrToIntA

winmm

PlaySoundW mciSendStringA mciSendStringW waveInClose waveInAddBuffer waveInStart waveInOpen waveInUnprepareHeader waveInPrepareHeader waveInStop

ws2_32

send socket connect recv gethostbyname WSASetLastError inet_addr gethostbyaddr getservbyport ntohs getservbyname htonl htons inet_ntoa closesocket WSAGetLastError WSAStartup

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream

Name

.text

Size

331KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ