姭Lh�� �,M1Y*�(�$�v��l��f�r�=|�K���=�@ԍ�x4���9!�#�_����s�Oƣ_+�"ލ���\M湸����Hn����~���D�v!���|!�<F�8E�tk8�E�0<m��"��8�VIJ����݇��Ǽ�ك�4����u�21#T����;�)�YMt�.i�A��뿤K�,R�!3����Ê/�=�1[އ��nLY�����L)�yZ���WA��� ���}/�<¹ܠ�]R���*���4���P6��N�*&�W!�#�9�=�b���Z�HL��ſQ�Ww�f��T�hV��qÕ�ݏ�������I� �3ΐ�W���Xf��(��ߙ����9$�J����+~ �Di��r+�l�G��7��QD{���D��bH>}������Eȼ����-�dZ �"Y}Ua����.�D_ƣ8���Ttq\��_�Q�َzs� ��1J�N���=Z��B7���I�dqy;P��L�i�& ���������$`G�V7wϭѫ} ��;C_�/�����7���otޝg5X`j�J��p���c��Mz��#���5�����Q�v�|���ǡ��#�b�5���f��M� ���1^fE�� Q"�����j���+�n5ڔ�s�n�r��[{�Q���yR��>�K�c��o<�C�h ���ڞJ�r��4=-���$J�/�qme<�)�Y���/�QCW���O�1{�_�������*V������wKT�у@F3�v���q�m\|� a*���B�#�:~�fcE<ʧ'��j��w0-�� ��1&Rt��y F��Ҏ��?��}'���2>?9�}���Oe�t2��M���(&���;��(9���Ć�ƪw^�g�����u1B�c}��N�;�_���m�FǑj�,ߤs>U��Y|փ�C���]���p�;u��YCR|��a0�&<B�� �3(��l�^�z ]h߽tR�.zE��c'����V�HDx�ônj����պv��Al�����:u �Hi�ѩ^���FuA�>S��)�?[�2b:����B�����n3���M-_y�����0 ��-XF �@᧔�j���J,���d-�=�b��1#�R�� Wۮ�L��fgő�:��2y ; �UG�p�}���|��-=D�t0Ȗ3���A=0m�IV����S���+�k(�����*�R!���c����{Va|��6l�&u˧�2m��a����Pѝ�z�/]{魻�����0����u"��C� �1�}����]f2��T��������vB������ ��.�d��3̦(-Q��O�oz&�+����iR7:��Cx�{���S(8�z4�7Nq+EW��j��lw31�ո�a!�8X�� ���S2�u���P 39�Q��`=Ј{�<��_��;Ob��:O��3D���y̼&��~�79�j�� �t기���l��j��b��.0(h�A�uc�'vgJ������^D���� �ƍ�� _��� �݅N��D�K�%2��*,mI^�=������S� 7v�ӹ��@Ի�+~�U��>"Ro�Q9�x�˃���q�#��({1�a� �s��NfP��V��?��$�4uE&�J 4�f����3����^~x��5]օU�"�m�v%O��wQK��mot#�+��%�$Vn�y�#B $L���z���8��I$�����Q�ȾXѬO|�!!|h?o�`y�&W�-8���>�+2�}����O�ȳY:�gm�"����>��Q�B7g��u:�����9�nF$�L��g�l͜�|i���S ��ן�UETy��*�ɗ��DR�Q��Q�t��P!qJ{�c���8Jhi�y�k�y|�5m$ՇF����B���<3������ '�&H˧8m\Q����#-Z�C��И��?W�T�<İgw�����akބ�q#�Μ� ��b��%<�H2_�e���Z%ʑ��.��k~Iaܯv�&��~x��1>�>�'@|��Ɗs�jbb���n�A�����Ѧ�@���Ԣ<~�X�Z,��L 6۱�4! ~%^�8����͆Gײ��L��" �Df�����$oƣ��?�f����P.�Š���BrW��Q��� $�<:��e�?�j�81�� 9Ԋ�K1��.)5,�4�\Ky�돆B�L�w�X @:ʵ)S�Ҟ�m�}�=A��{.?�(�yRR���>�|9��7��q���C�&�}pz�o��>k��H�e��%h���Y���W ں:ŋ-B��F0�D!�c28���������Ez.٦'(��3��#�f����P��k��0��.�x��/2�5���G˫�z������H�T#�� ֞܈,��5����e��dѢ Q��?�������<��X �j#� Z�LQ\�Iy���@Ď���V��C">2kd���Pb��^�� �CQz�����çAl�Q�j������{]�S��>���PJ?o�'q&��i���q b$#��tB��e�CMP>�,�B��&�e��~�vz�'��l{���D)���H8SJN�^���/0Y����i���Z�.�*'L�&�����3r�jM��ܗ�2����"�6�����9��������>b��TnɳZd���L�����Y�<��\�XG~�c$#�v%[5����l�6�c��L]%��I����'{�ʔ.Ȣ�{��4�J:,|%�hx�,�+���3!��m�bk��@EL��hyZ�@���B5"�� �s�Wjܺ�ݰe�_�`���(�_��TZ����`9g��������+뼧ؕ����7�:�o�]�=�r�v���VZ�X�Fwv(����+{���7s���V�V��D������W�����N�1���~��p�W��#n�U�dq#5�; ���e�����p����es�ŀ��0�DM���kL1g4�j��2�&���dl~Iq[���k��4֏�ܴ��Y��}��Ֆz��B(��uZ���˚��1�. n"���9��?)�D��M@�B�;l���>�Q�
Behavioral task
behavioral1
Sample
Remcos Loader.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
remcos.exe
Resource
win10v2004-20230220-en
General
-
Target
REMCOS v1.7 Professional By Viotto.rar
-
Size
12.0MB
-
MD5
f86ac0e2db32e57774d288fe2acbcfe7
-
SHA1
846644486c5bd4927d8185399bda79ee32b7bdb5
-
SHA256
fcf89228d1bf80eff09f0b7a3efffcd336af4d13a138d712408d8735aa523749
-
SHA512
9c31f554e7ce787f6f82f14625583219d9e01f50e043d2797f38adc94dc7c3c2b48526de11ff3b6400014bcb72273b187e58e3471b69a61c3939ba8856a44292
-
SSDEEP
196608:0HoSlu4Yz0zRdOC4DH6ErA+BXG8w5ulhPErGDXQjr6jediAkt0jvXecBh3wDUS46:RSLYz0ddvcH/L9Xmul0GXW6jlIbXeiGF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Remcos Loader.exe vmprotect
Files
-
REMCOS v1.7 Professional By Viotto.rar.rar
Password: infected
-
REMCOSAuthHooks.dll.dll windows x86
Password: infected
d452660aa6c160f2a66e1e195c1fec6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CreatePipe
FindClose
GetFileAttributesW
DuplicateHandle
MultiByteToWideChar
GetLastError
CloseHandle
GetLocalTime
SystemTimeToFileTime
CreateProcessW
WideCharToMultiByte
GetCurrentDirectoryA
lstrcatA
LoadLibraryW
CreateThread
GetProcAddress
GetModuleHandleW
GetTickCount
WriteProcessMemory
VirtualFree
GetStdHandle
WaitForSingleObject
GetVersionExW
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Process32NextW
LoadLibraryA
Process32FirstW
GetNativeSystemInfo
VirtualAllocEx
FreeLibrary
FlushInstructionCache
CreateRemoteThread
lstrcmpiW
DecodePointer
GetCurrentProcess
FindNextFileW
GetFullPathNameW
SetLastError
SetHandleInformation
FindFirstFileW
VirtualAlloc
ReadFile
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetStringTypeW
FlushFileBuffers
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
GetConsoleCP
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedExchange
HeapCreate
VirtualProtect
HeapFree
InterlockedCompareExchange
Thread32Next
Thread32First
SuspendThread
Sleep
HeapReAlloc
HeapAlloc
GetThreadContext
SetThreadContext
OpenThread
VirtualQuery
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetACP
GetCurrentDirectoryW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
RaiseException
user32
PostThreadMessageW
PeekMessageW
MessageBoxW
GetDesktopWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
ws2_32
ntohl
shutdown
listen
WSAStartup
getpeername
getsockname
send
socket
ntohs
select
inet_ntoa
recvfrom
recv
getsockopt
htonl
htons
sendto
ioctlsocket
setsockopt
WSAGetLastError
closesocket
bind
accept
__WSAFDIsSet
connect
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
shell32
SHGetFolderPathW
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 829KB - Virtual size: 832KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Remcos Loader.exe.exe windows x86
Password: infected
28751844dec40b40bddaf2626843d3ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
GetMessageW
CharUpperBuffW
psapi
GetModuleFileNameExW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
remcos.exe.exe windows x86
Password: infected
e2c065b1c331512012c564526756d6f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SafeArrayPtrOfIndex
GetErrorInfo
advapi32
RegQueryValueExW
RegUnLoadKeyW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
user32
CharNextW
SetClassLongW
EnumDisplayMonitors
CharUpperBuffW
kernel32
GetVersion
GetProcAddress
GetVersionExW
GetVersion
Sleep
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
gdi32
UnrealizeObject
version
VerQueryValueW
netapi32
NetWkstaGetInfo
ole32
OleUninitialize
comctl32
InitializeFlatSB
msvcrt
memset
shell32
SHGetFileInfoA
wininet
InternetCheckConnectionA
comdlg32
GetSaveFileNameW
winspool.drv
OpenPrinterW
GetDefaultPrinterW
wsock32
WSACleanup
winmm
waveOutWrite
wtsapi32
WTSSendMessageW
Exports
Exports
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
��U�*r,���+�>b�A��烤6��j⺳���ئ�����d��0���X���Q ���ZJf��&8U^>�d�tG����;d@`�4� ^�N[]�p_�1�.�n�����k�÷�&pe?+^��S�#M�k�b� ���ϭ�Q���2��c7��.n�;��Y���%4�7G<\v�)��@:�tEH�&n��-^/ZR��/�� ��^�FZ��v�=����A�I��l~�X�K��E���� ��U?�T)�8�~Gy�s��k���}ڤ�����.���B �Y�v�X~�����!Q������(k�pD�ėݻek7�nʁ"�q�yp�j\:J�4:��7�t"�� �Ɏ�|Էu����*���Ɗ�T�M��H��}*���[�k nqG��p��5%ěлri����ZnY�F^�C��F���q/���DE��'fL/-�[�u�x�dM�K+��o�} ��9����=l��M�nI\����n�G�I*�cc��h�:I��BEqϽ��� t&�h�JDk�ͣ~��S� x�iF��j�<H���#]Z�Af&�Ϥ���e �N�@q�t#h��3_j�� ���RQ0W>���*����<\_�j���2�H�C�&��)�\�X��&�!4,��p $K������g���T�"�4��gtH:�@m����,���<z�|]����}]����E�"S���C�r����\�JIwD�*�r.X}{bWV�v�{�q;���W���DR�<��0 I��H��ͼ6�*���Q���r�&&ec��$��!d�kߒ����q1�(�IT� �}h(U{[u����wp�:Sv���/�Z���` p��HѠ��:�{[\PҨ�2jy��f�R�6�C�B�կ���$�h�Qw�צ�� ���`��l�XeQH�G��������4�m`��B������N�ɳ��(��*�h\��� �"��ms���<�, �����f��o��w�V�`��;����~pJ�ړ���}!��s=Ve�����#��6�B�k������ٸy���Ձ$��h�֜=�L���:-�کO|[�${z%F|թ��������t�a-B������\7])��5��H�B����Ր%��j�y�?���O0ORU�G�l:ԟϵY�Q?x�c?�|�����u[�b{$`0����� ��HM§w֭n1�����Ι�f� �!g�9����˴�=�5�U�eؔ��t�u{��7�f��]�!M�c�:���ÀvVmͣ��{��4�P@$dez�GO�O��oQoC�f=A� 1z9�c���ན�� OF�����>���:|�O��aF�K71ō�� J��&��K�����ŔY�h�Xx�۟�-����c�:�Vo������?O��R������ha�eQ�����2f�P3E4�T �`�+�@�nj�T�Υ�nq�\�I�6t������T5�9����RKg3�Tޞ���7t%�M�1�����u��gy��_v��C9K��+5Ѥx�òWp=ѥ�����e����.�w��:����I#����� �t�|M� �''$��$���.���X�n�x7@ �gI���c[:�����'�K��C�f�j���-7<�xD�?�9Z��:���0��!��V�y:�3���'Q�5iC�az�DMe�L3�{�vQ���m �PΝyK&u���dX���ɣ�L�7s���{���sٖ^��[���3�zo�>]�:vұ����1g�7��E�h����k�@�2�,H,��^���2I7-1r�� �p��h�H@#���9�ŭ�99����-� K��l��+�G�]<P�wz++�G�o��mY�C�"�s����~ۅ����Rv磏?'�BTg���}_t�Y1/�A��>��%n/ ��h +�q��k�q8� ��kJkSZf��$W=;L�y��������-l �5��r������.{!���,+�|Ⱥ��Hȡ�v��8d��J��oa�z��ݼl�//�+���bz��cJ5Qy@�s�<���b�{�9~ʾ�R,��(�����ʠ N�5����05����<����f�3��TyA�{�� ¬:��L���\�m{��YT���X�g�x��꺙�p �l7�����>L����� s�p�o���O �uq�R�ޢ�f��P�3/�����N���d�� /X�_v���݉�4Fk]�&sJݱ�}�ђ'�Vk��i�U��zE\���)���k����5�k�d��t���|b�H-�tJp�^˗�\� �R(/ ��@{+�!�&F���Q�g��"O����?$���]�HY�ОB:F�W��/���<*4��G�8?9��XԲ�M��2C ���=j�;ఠR����Lx�d�`"���i����9�� �6��N���VnS��j�#$�*r����J��(46��}���!�� u�^�EK H!ir�A�����7�Mx��D��,��GƎ�nA m�'�g������>� �6s�4�ⶥK%�AYS `�f��v:��ã�C¤,���@!����n�v8Dk�K�����j��6�wg�5����K{�c�H����w ߩ[�8;�A�vQF����?�|[O�ą'��� �65�/T�?❓PP4�Q6�$vi;L(����q>�����p�fRJ�2x{H~����}�I�Y�k��0���8>�p}z(->��? uR�{�y��ⲙ�`��H-�D!���w�>���b9���Z����������`~L͖���|D�� �\��]�ɓ�{�0/\lr���ENz�k;�$����U����� G�����!g��$a�W�1 ���q�Pp+�_����pV��?�̓ƫ�R��n_�5��E�-T�0���TH��� �!9���N���H��ϒ~}���>�������a��B4�|5���&.� F٩�gy�~� ��"ߐ�����������G���1r"��QN#���j�D�`z�.����a��>J`��'� ����̱����mV�σi�����Ŀ��A�jo8������@�o j� ��
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 104KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 76B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.viotto0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.viotto1 Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ