General
-
Target
remcos_a.exe
-
Size
426KB
-
MD5
98646fcaf144afec283a2b786d40338d
-
SHA1
1309c2255f6eba1af368e39d6a7c490af4ba8e5a
-
SHA256
d365718bcfaf977bbccedd33103e2bccf641f7a8a001ae9bbff0a261827adc25
-
SHA512
d73901e8f65258ae3b39616be465985884427e1fd62db8c4c349c994f86040b95c396699afbe8ffb3df312b892df7f644ae3b994c1cbafe5027e9e59baa87879
-
SSDEEP
6144:oqYktk/thubEctguZK6iXoKLnk586i/f7rG9VLdAYNAO2nOX2Nd0cNEObaS:oqYktkO4cpK4KoK6i/f7rQdAn3NwOmS
Malware Config
Extracted
remcos
4.7.2 Light
RemoteHost
127.0.0.1:8888
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-5IVGHB
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource remcos_a.exe
Files
-
remcos_a.exe.exe windows x86
683440ffeaeaf7c50442463634e14c4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetCurrentProcess
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetCurrentProcessId
GetTickCount
GlobalUnlock
LocalAlloc
GetModuleHandleA
GlobalFree
MulDiv
SizeofResource
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
RemoveDirectoryW
FindResourceA
OpenProcess
LockResource
LoadResource
LocalFree
GetFileSize
SetConsoleOutputCP
FormatMessageA
AllocConsole
GetModuleFileNameA
lstrcpynA
SetLastError
ExpandEnvironmentStringsA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapReAlloc
GetACP
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
VirtualProtect
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetLocaleInfoA
ExitProcess
CreateMutexA
GetModuleFileNameW
GetLongPathNameW
QueryPerformanceFrequency
GetLastError
FindNextFileA
FindFirstFileA
MoveFileW
SetFilePointerEx
WaitForSingleObject
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
CreateFileW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
CreateDirectoryW
CreateProcessA
Sleep
PeekNamedPipe
CreatePipe
TerminateProcess
WriteFile
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
CloseHandle
SetEvent
CreateEventW
QueryPerformanceCounter
LoadLibraryExW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
user32
EnumWindows
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
SetForegroundWindow
SetClipboardData
GetClipboardData
MessageBoxW
IsWindowVisible
CloseWindow
GetWindowThreadProcessId
SendInput
EnumDisplaySettingsW
mouse_event
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetForegroundWindow
GetCursorPos
RegisterClassExA
AppendMenuA
CreateWindowExA
DefWindowProcA
TrackPopupMenu
CreatePopupMenu
ShowWindow
OpenClipboard
SetWindowTextW
ExitWindowsEx
EmptyClipboard
CloseClipboard
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
BitBlt
advapi32
RegCreateKeyW
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyA
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
shlwapi
StrToIntA
PathFileExistsA
PathFileExistsW
winmm
PlaySoundW
mciSendStringA
mciSendStringW
ws2_32
connect
socket
send
WSAStartup
recv
htons
htonl
getservbyname
inet_ntoa
ntohs
getservbyport
gethostbyaddr
WSAGetLastError
WSASetLastError
inet_addr
closesocket
gethostbyname
urlmon
URLOpenBlockingStreamW
URLDownloadToFileW
gdiplus
GdiplusStartup
GdipDisposeImage
GdipLoadImageFromStream
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipFree
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
wininet
InternetOpenW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
Sections
.text Size: 299KB - Virtual size: 298KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ