姭Lh�� �,M1Y*�(�$�v��l��f�r�=|�K���=�@ԍ�x4���9!�#�_����s�Oƣ_+�"ލ���\M湸����Hn����~���D�v!���|!�<F�8E�tk8�E�0<m��"��8�VIJ����݇��Ǽ�ك�4����u�21#T����;�)�YMt�.i�A��뿤K�,R�!3����Ê/�=�1[އ��nLY�����L)�yZ���WA��� ���}/�<¹ܠ�]R���*���4���P6��N�*&�W!�#�9�=�b���Z�HL��ſQ�Ww�f��T�hV��qÕ�ݏ�������I� �3ΐ�W���Xf��(��ߙ����9$�J����+~ �Di��r+�l�G��7��QD{���D��bH>}������Eȼ����-�dZ �"Y}Ua����.�D_ƣ8���Ttq\��_�Q�َzs� ��1J�N���=Z��B7���I�dqy;P��L�i�& ���������$`G�V7wϭѫ} ��;C_�/�����7���otޝg5X`j�J��p���c��Mz��#���5�����Q�v�|���ǡ��#�b�5���f��M� ���1^fE�� Q"�����j���+�n5ڔ�s�n�r��[{�Q���yR��>�K�c��o<�C�h ���ڞJ�r��4=-���$J�/�qme<�)�Y���/�QCW���O�1{�_�������*V������wKT�у@F3�v���q�m\|� a*���B�#�:~�fcE<ʧ'��j��w0-�� ��1&Rt��y F��Ҏ��?��}'���2>?9�}���Oe�t2��M���(&���;��(9���Ć�ƪw^�g�����u1B�c}��N�;�_���m�FǑj�,ߤs>U��Y|փ�C���]���p�;u��YCR|��a0�&<B�� �3(��l�^�z ]h߽tR�.zE��c'����V�HDx�ônj����պv��Al�����:u �Hi�ѩ^���FuA�>S��)�?[�2b:����B�����n3���M-_y�����0 ��-XF �@᧔�j���J,���d-�=�b��1#�R�� Wۮ�L��fgő�:��2y ; �UG�p�}���|��-=D�t0Ȗ3���A=0m�IV����S���+�k(�����*�R!���c����{Va|��6l�&u˧�2m��a����Pѝ�z�/]{魻�����0����u"��C� �1�}����]f2��T��������vB������ ��.�d��3̦(-Q��O�oz&�+����iR7:��Cx�{���S(8�z4�7Nq+EW��j��lw31�ո�a!�8X�� ���S2�u���P 39�Q��`=Ј{�<��_��;Ob��:O��3D���y̼&��~�79�j�� �t기���l��j��b��.0(h�A�uc�'vgJ������^D���� �ƍ�� _��� �݅N��D�K�%2��*,mI^�=������S� 7v�ӹ��@Ի�+~�U��>"Ro�Q9�x�˃���q�#��({1�a� �s��NfP��V��?��$�4uE&�J 4�f����3����^~x��5]օU�"�m�v%O��wQK��mot#�+��%�$Vn�y�#B $L���z���8��I$�����Q�ȾXѬO|�!!|h?o�`y�&W�-8���>�+2�}����O�ȳY:�gm�"����>��Q�B7g��u:�����9�nF$�L��g�l͜�|i���S ��ן�UETy��*�ɗ��DR�Q��Q�t��P!qJ{�c���8Jhi�y�k�y|�5m$ՇF����B���<3������ '�&H˧8m\Q����#-Z�C��И��?W�T�<İgw�����akބ�q#�Μ� ��b��%<�H2_�e���Z%ʑ��.��k~Iaܯv�&��~x��1>�>�'@|��Ɗs�jbb���n�A�����Ѧ�@���Ԣ<~�X�Z,��L 6۱�4! ~%^�8����͆Gײ��L��" �Df�����$oƣ��?�f����P.�Š���BrW��Q��� $�<:��e�?�j�81�� 9Ԋ�K1��.)5,�4�\Ky�돆B�L�w�X @:ʵ)S�Ҟ�m�}�=A��{.?�(�yRR���>�|9��7��q���C�&�}pz�o��>k��H�e��%h���Y���W ں:ŋ-B��F0�D!�c28���������Ez.٦'(��3��#�f����P��k��0��.�x��/2�5���G˫�z������H�T#�� ֞܈,��5����e��dѢ Q��?�������<��X �j#� Z�LQ\�Iy���@Ď���V��C">2kd���Pb��^�� �CQz�����çAl�Q�j������{]�S��>���PJ?o�'q&��i���q b$#��tB��e�CMP>�,�B��&�e��~�vz�'��l{���D)���H8SJN�^���/0Y����i���Z�.�*'L�&�����3r�jM��ܗ�2����"�6�����9��������>b��TnɳZd���L�����Y�<��\�XG~�c$#�v%[5����l�6�c��L]%��I����'{�ʔ.Ȣ�{��4�J:,|%�hx�,�+���3!��m�bk��@EL��hyZ�@���B5"�� �s�Wjܺ�ݰe�_�`���(�_��TZ����`9g��������+뼧ؕ����7�:�o�]�=�r�v���VZ�X�Fwv(����+{���7s���V�V��D������W�����N�1���~��p�W��#n�U�dq#5�; ���e�����p����es�ŀ��0�DM���kL1g4�j��2�&���dl~Iq[���k��4֏�ܴ��Y��}��Ֆz��B(��uZ���˚��1�. n"���9��?)�D��M@�B�;l���>�Q�
Behavioral task
behavioral1
Sample
Remcos 1.7/REMCOSAuthHooks.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Remcos 1.7/REMCOSAuthHooks.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Remcos 1.7/Remcos Loader.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Remcos 1.7/Remcos Loader.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Remcos 1.7/remcos.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Remcos 1.7/remcos.exe
Resource
win10v2004-20220812-en
General
-
Target
185.238.3.205_-_Remcos_1.7.zip___f50526188fa4929800cf2a0209fd414f.dat
-
Size
12.1MB
-
MD5
f50526188fa4929800cf2a0209fd414f
-
SHA1
4d09dd7e1bacffb58e5f92532a199c2587693f04
-
SHA256
1774d51fd45ee43fbae963e8f9a6e0d85460d2359bc578004ba58375fe5343c1
-
SHA512
aeb7cf315ec7f2cad77c7812b5d23bd8bb1815214f7a0333997944a88f4aa09c93777c8d74eab6992fb47b73f93adf6bb57c31b8121d21555547ff5329307aaa
-
SSDEEP
393216:/0FBWcJvUtoiW01LxFHZxDq1a5JhQvtcd3P:/S2XLx3xDhhm6l
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Remcos 1.7/Remcos Loader.exe vmprotect
Files
-
185.238.3.205_-_Remcos_1.7.zip___f50526188fa4929800cf2a0209fd414f.dat.zip
-
Remcos 1.7/REMCOSAuthHooks.dll.dll windows x86
d452660aa6c160f2a66e1e195c1fec6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CreatePipe
FindClose
GetFileAttributesW
DuplicateHandle
MultiByteToWideChar
GetLastError
CloseHandle
GetLocalTime
SystemTimeToFileTime
CreateProcessW
WideCharToMultiByte
GetCurrentDirectoryA
lstrcatA
LoadLibraryW
CreateThread
GetProcAddress
GetModuleHandleW
GetTickCount
WriteProcessMemory
VirtualFree
GetStdHandle
WaitForSingleObject
GetVersionExW
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Process32NextW
LoadLibraryA
Process32FirstW
GetNativeSystemInfo
VirtualAllocEx
FreeLibrary
FlushInstructionCache
CreateRemoteThread
lstrcmpiW
DecodePointer
GetCurrentProcess
FindNextFileW
GetFullPathNameW
SetLastError
SetHandleInformation
FindFirstFileW
VirtualAlloc
ReadFile
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetStringTypeW
FlushFileBuffers
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
GetConsoleCP
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedExchange
HeapCreate
VirtualProtect
HeapFree
InterlockedCompareExchange
Thread32Next
Thread32First
SuspendThread
Sleep
HeapReAlloc
HeapAlloc
GetThreadContext
SetThreadContext
OpenThread
VirtualQuery
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetACP
GetCurrentDirectoryW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
RaiseException
user32
PostThreadMessageW
PeekMessageW
MessageBoxW
GetDesktopWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
ws2_32
ntohl
shutdown
listen
WSAStartup
getpeername
getsockname
send
socket
ntohs
select
inet_ntoa
recvfrom
recv
getsockopt
htonl
htons
sendto
ioctlsocket
setsockopt
WSAGetLastError
closesocket
bind
accept
__WSAFDIsSet
connect
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
shell32
SHGetFolderPathW
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 829KB - Virtual size: 832KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Remcos 1.7/Remcos Loader.exe.exe windows x86
28751844dec40b40bddaf2626843d3ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
GetMessageW
CharUpperBuffW
psapi
GetModuleFileNameExW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Remcos 1.7/remcos.exe.exe windows x86
e2c065b1c331512012c564526756d6f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo
advapi32
RegQueryValueExW
RegUnLoadKeyW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
user32
CharNextW
SetClassLongW
EnumDisplayMonitors
CharUpperBuffW
kernel32
GetVersion
GetProcAddress
GetVersionExW
GetVersion
Sleep
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
gdi32
UnrealizeObject
version
VerQueryValueW
netapi32
NetWkstaGetInfo
ole32
OleUninitialize
comctl32
InitializeFlatSB
msvcrt
memset
shell32
SHGetFileInfoA
wininet
InternetCheckConnectionA
comdlg32
GetSaveFileNameW
winspool.drv
OpenPrinterW
GetDefaultPrinterW
wsock32
WSACleanup
winmm
waveOutWrite
wtsapi32
WTSSendMessageW
Exports
Exports
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
��U�*r,���+�>b�A��烤6��j⺳���ئ�����d��0���X���Q ���ZJf��&8U^>�d�tG����;d@`�4� ^�N[]�p_�1�.�n�����k�÷�&pe?+^��S�#M�k�b� ���ϭ�Q���2��c7��.n�;��Y���%4�7G<\v�)��@:�tEH�&n��-^/ZR��/�� ��^�FZ��v�=����A�I��l~�X�K��E���� ��U?�T)�8�~Gy�s��k���}ڤ�����.���B �Y�v�X~�����!Q������(k�pD�ėݻek7�nʁ"�q�yp�j\:J�4:��7�t"�� �Ɏ�|Էu����*���Ɗ�T�M��H��}*���[�k nqG��p��5%ěлri����ZnY�F^�C��F���q/���DE��'fL/-�[�u�x�dM�K+��o�} ��9����=l��M�nI\����n�G�I*�cc��h�:I��BEqϽ��� t&�h�JDk�ͣ~��S� x�iF��j�<H���#]Z�Af&�Ϥ���e �N�@q�t#h��3_j�� ���RQ0W>���*����<\_�j���2�H�C�&��)�\�X��&�!4,��p $K������g���T�"�4��gtH:�@m����,���<z�|]����}]����E�"S���C�r����\�JIwD�*�r.X}{bWV�v�{�q;���W���DR�<��0 I��H��ͼ6�*���Q���r�&&ec��$��!d�kߒ����q1�(�IT� �}h(U{[u����wp�:Sv���/�Z���` p��HѠ��:�{[\PҨ�2jy��f�R�6�C�B�կ���$�h�Qw�צ�� ���`��l�XeQH�G��������4�m`��B������N�ɳ��(��*�h\��� �"��ms���<�, �����f��o��w�V�`��;����~pJ�ړ���}!��s=Ve�����#��6�B�k������ٸy���Ձ$��h�֜=�L���:-�کO|[�${z%F|թ��������t�a-B������\7])��5��H�B����Ր%��j�y�?���O0ORU�G�l:ԟϵY�Q?x�c?�|�����u[�b{$`0����� ��HM§w֭n1�����Ι�f� �!g�9����˴�=�5�U�eؔ��t�u{��7�f��]�!M�c�:���ÀvVmͣ��{��4�P@$dez�GO�O��oQoC�f=A� 1z9�c���ན�� OF�����>���:|�O��aF�K71ō�� J��&��K�����ŔY�h�Xx�۟�-����c�:�Vo������?O��R������ha�eQ�����2f�P3E4�T �`�+�@�nj�T�Υ�nq�\�I�6t������T5�9����RKg3�Tޞ���7t%�M�1�����u��gy��_v��C9K��+5Ѥx�òWp=ѥ�����e����.�w��:����I#����� �t�|M� �''$��$���.���X�n�x7@ �gI���c[:�����'�K��C�f�j���-7<�xD�?�9Z��:���0��!��V�y:�3���'Q�5iC�az�DMe�L3�{�vQ���m �PΝyK&u���dX���ɣ�L�7s���{���sٖ^��[���3�zo�>]�:vұ����1g�7��E�h����k�@�2�,H,��^���2I7-1r�� �p��h�H@#���9�ŭ�99����-� K��l��+�G�]<P�wz++�G�o��mY�C�"�s����~ۅ����Rv磏?'�BTg���}_t�Y1/�A��>��%n/ ��h +�q��k�q8� ��kJkSZf��$W=;L�y��������-l �5��r������.{!���,+�|Ⱥ��Hȡ�v��8d��J��oa�z��ݼl�//�+���bz��cJ5Qy@�s�<���b�{�9~ʾ�R,��(�����ʠ N�5����05����<����f�3��TyA�{�� ¬:��L���\�m{��YT���X�g�x��꺙�p �l7�����>L����� s�p�o���O �uq�R�ޢ�f��P�3/�����N���d�� /X�_v���݉�4Fk]�&sJݱ�}�ђ'�Vk��i�U��zE\���)���k����5�k�d��t���|b�H-�tJp�^˗�\� �R(/ ��@{+�!�&F���Q�g��"O����?$���]�HY�ОB:F�W��/���<*4��G�8?9��XԲ�M��2C ���=j�;ఠR����Lx�d�`"���i����9�� �6��N���VnS��j�#$�*r����J��(46��}���!�� u�^�EK H!ir�A�����7�Mx��D��,��GƎ�nA m�'�g������>� �6s�4�ⶥK%�AYS `�f��v:��ã�C¤,���@!����n�v8Dk�K�����j��6�wg�5����K{�c�H����w ߩ[�8;�A�vQF����?�|[O�ą'��� �65�/T�?❓PP4�Q6�$vi;L(����q>�����p�fRJ�2x{H~����}�I�Y�k��0���8>�p}z(->��? uR�{�y��ⲙ�`��H-�D!���w�>���b9���Z����������`~L͖���|D�� �\��]�ɓ�{�0/\lr���ENz�k;�$����U����� G�����!g��$a�W�1 ���q�Pp+�_����pV��?�̓ƫ�R��n_�5��E�-T�0���TH��� �!9���N���H��ϒ~}���>�������a��B4�|5���&.� F٩�gy�~� ��"ߐ�����������G���1r"��QN#���j�D�`z�.����a��>J`��'� ����̱����mV�σi�����Ŀ��A�jo8������@�o j� ��
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 104KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.viotto0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.viotto1 Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ