remcos | file[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 423KB
Sample221027-sagcpscefr
SHA256 b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66
MD5 2ac719907a9d3149559874a1ae0feb28
SHA1 fb6f18175a93062ae6411391ef6e6a7d93616ec6
SHA512 be2707cc0f5cf5fea7c0ed9b6f7c0c17190e4960ca06cbbd56b687dfe6f4a53f0fa3964b358c65dc07d10b1fa15a94d996b200576fd0fabf475331992f47e74f
SSDEEP 6144:YbfRYSwUv9gMP3+U+hyTqG8ntSxuH1ujujg9BD7a8rfdJ9AOq2CXr93cvNFS2U:YrRrwU2M3+xGCTQjujgj9U2292zU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remotehost remcos

Malware Config

Extracted

Family

remcos

Version

3.7.0 Light

Botnet

RemoteHost

127.0.0.1:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-94U7JZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos family
remcos

File Explorer

file.exe

.exe 423KB

file.exe

IMPHASH d5baaf7db716df76241a88766114f3b8
SHA256 b7149d17821e8a67af81dc5cc7d7d09def03d6347e178434ec8923a1fcb74e66
MD5 2ac719907a9d3149559874a1ae0feb28
SHA1 fb6f18175a93062ae6411391ef6e6a7d93616ec6
SHA512 be2707cc0f5cf5fea7c0ed9b6f7c0c17190e4960ca06cbbd56b687dfe6f4a53f0fa3964b358c65dc07d10b1fa15a94d996b200576fd0fabf475331992f47e74f
SSDEEP 6144:YbfRYSwUv9gMP3+U+hyTqG8ntSxuH1ujujg9BD7a8rfdJ9AOq2CXr93cvNFS2U:YrRrwU2M3+xGCTQjujgj9U2292zU
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

175989

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary IsBadReadPtr GetCurrentProcess GetSystemDirectoryA GlobalAlloc GlobalLock GetCurrentProcessId GetTickCount GlobalUnlock LocalAlloc GetModuleHandleA GlobalFree MulDiv SizeofResource RemoveDirectoryW FindResourceA OpenProcess LockResource LoadResource LocalFree GetFileSize FormatMessageA AllocConsole GetModuleFileNameA lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter SetLastError GetLastError InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType HeapReAlloc GetACP GetStdHandle GetModuleHandleExW MoveFileExW RtlUnwind VirtualProtect Process32FirstW Process32NextW CreateToolhelp32Snapshot GetLocaleInfoA CreateMutexA ExitProcess SetFileAttributesW GetModuleFileNameW EnterCriticalSection GetLongPathNameW ExpandEnvironmentStringsA FindNextFileA FindFirstFileA MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW WaitForSingleObject DeleteFileA GetFileAttributesW CreateFileW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW CreateDirectoryW CreateProcessA Sleep PeekNamedPipe CreatePipe TerminateProcess WriteFile ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread CloseHandle SetEvent CreateEventW LeaveCriticalSection RaiseException LoadLibraryExW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

GetClipboardData TranslateMessage DispatchMessageA GetMessageA GetWindowTextW SetForegroundWindow SetClipboardData MessageBoxW IsWindowVisible CloseWindow GetWindowThreadProcessId SendInput EnumDisplaySettingsW mouse_event DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetForegroundWindow GetCursorPos RegisterClassExA AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu CreatePopupMenu ShowWindow OpenClipboard CloseClipboard SetWindowTextW EnumWindows ExitWindowsEx EmptyClipboard

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA

advapi32

RegSetValueExA CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCreateKeyA RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegDeleteKeyA

shell32

ShellExecuteExA Shell_NotifyIconA ExtractIconA ShellExecuteW

shlwapi

StrToIntA PathFileExistsA PathFileExistsW

winmm

PlaySoundW mciSendStringA mciSendStringW

ws2_32

socket send WSAStartup closesocket connect htonl getservbyname inet_ntoa ntohs getservbyport gethostbyaddr inet_addr recv WSAGetLastError gethostbyname WSASetLastError htons

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

gdiplus

GdipDisposeImage GdipAlloc GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdiplusStartup GdipGetImageEncoders GdipCloneImage

wininet

InternetReadFile InternetOpenW InternetCloseHandle InternetOpenUrlW

Name

.text

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ