Static task
static1
Behavioral task
behavioral1
Sample
RCO2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RCO2.exe
Resource
win10v2004-20230220-en
General
-
Target
RCO2.exe
-
Size
582KB
-
MD5
6b096fe4216a0e3852c5751e96c8b96b
-
SHA1
9a48a2ff8199b042131cf83f293d6753ba5c418d
-
SHA256
1ddee757e3211b9ebc55e0f58275a814522a0902821a3261b4010371e705f923
-
SHA512
fd6e4881940b70095860877de27c1d5f991338c06a3e32cc7fd1f9a7ef239d05c5b67d7b41fd7a2417f2c14812a46e0e5f1589feff7e1b1bbac3a82be6dc43e5
-
SSDEEP
6144:NIqogZ3gOkXiMj/p847cY7LlKG97yK5v+g3Z7hS2yHQRN5vXrTnJgL1S:NIq1Z3gOkXiMj/9HlHP5v1ZNcK/HR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RCO2.exe
Files
-
RCO2.exe.exe windows x86
caddb2d1d0d5be875a8fd485b8f8242f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACreateEvent
WSAEnumNetworkEvents
send
getsockopt
WSACloseEvent
WSAEventSelect
htonl
gethostname
ioctlsocket
getpeername
sendto
WSAResetEvent
recvfrom
WSAWaitForMultipleEvents
closesocket
getsockname
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
connect
WSACleanup
freeaddrinfo
getaddrinfo
recv
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
listen
wldap32
ord217
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord143
ord41
ord50
ord45
ord60
ord22
ord211
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
normaliz
IdnToAscii
kernel32
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetFileSizeEx
CreateFileA
VerSetConditionMask
SleepEx
GetCurrentProcessId
WaitForMultipleObjects
AreFileApisANSI
GetFileInformationByHandleEx
UnhandledExceptionFilter
GetFileAttributesExW
PeekNamedPipe
ReadFile
SetConsoleTextAttribute
GetStdHandle
CloseHandle
GetModuleHandleW
GetConsoleWindow
CreateProcessA
SetConsoleTitleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
VerifyVersionInfoW
user32
GetMessageW
DefWindowProcW
GetSystemMenu
LoadImageA
CreateWindowExW
GetWindowLongW
DispatchMessageW
RegisterClassW
TranslateMessage
SetWindowLongW
PostQuitMessage
EnableMenuItem
ShowWindow
advapi32
CryptHashData
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
shell32
Shell_NotifyIconW
msvcp140
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
bcrypt
BCryptGenRandom
vcruntime140
memcmp
__std_exception_copy
memset
strchr
memcpy
strrchr
memchr
memmove
strstr
_CxxThrowException
__current_exception
__current_exception_context
_except_handler4_common
__std_exception_destroy
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_initialize_onexit_table
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_initialize_narrow_environment
_crt_atexit
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
system
_beginthreadex
_controlfp_s
terminate
_errno
_invalid_parameter_noinfo_noreturn
exit
__p___argc
_register_onexit_function
_invalid_parameter_noinfo
__sys_nerr
__sys_errlist
_set_app_type
api-ms-win-crt-stdio-l1-1-0
fflush
setvbuf
fputc
feof
_close
_write
_read
ungetc
__p__commode
_set_fmode
fclose
fsetpos
_lseeki64
fgetc
fgets
_open
fopen
__stdio_common_vsprintf
__stdio_common_vsscanf
fread
ftell
_fseeki64
_get_stream_buffer_pointers
fwrite
fopen_s
fputs
__acrt_iob_func
fseek
fgetpos
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_set_new_mode
realloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlock_file
_access
_fstat64
remove
_lock_file
_unlink
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strpbrk
strspn
_strdup
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
strtoll
wcstombs
atoi
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
Sections
.text Size: 400KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ