Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
7ff84f66ea15dd8fb9631a630c581531dabf361cc6a8a2ede6d78056d9ca5c78.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7ff84f66ea15dd8fb9631a630c581531dabf361cc6a8a2ede6d78056d9ca5c78.exe
Resource
win10v2004-20230915-en
Target
7ff84f66ea15dd8fb9631a630c581531dabf361cc6a8a2ede6d78056d9ca5c78
Size
492KB
MD5
d83933084952ca7ce07956c773a87076
SHA1
0cfec5e433ae06e2a28128869415d5b51defec46
SHA256
7ff84f66ea15dd8fb9631a630c581531dabf361cc6a8a2ede6d78056d9ca5c78
SHA512
a9d88ffbfe3f3140e3d594ba90c4f2f52894080b8906f7572425761509c941dc015a66055da9200dc499c4be759ad767e91a1a04d44446c1c46d6cd22fef4287
SSDEEP
6144:N/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7Qo7ovTdq:N/uPq3AfK496Gw0lwGXN3pvs/ZuG8vQ
remcos
Crypted
MicRecords
5
0
1
remcos.exe
Remcos
false
false
true
false
false
esotss.dat
false
%AppData%
false
wsaortist-MIF9KD
false
false
Screenshots
%AppData%
10
false
5
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
FindNextFileA
ExpandEnvironmentStringsA
GetLongPathNameW
CopyFileW
GetLocaleInfoA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
OpenProcess
OpenMutexA
lstrcatW
GetCurrentProcessId
GetTempFileNameW
UnmapViewOfFile
DuplicateHandle
CreateFileMappingW
MapViewOfFile
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
QueryDosDeviceW
FindFirstVolumeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
lstrlenW
GetStdHandle
SetFilePointer
FindResourceA
LockResource
LoadResource
LocalFree
FindVolumeClose
GetVolumePathNamesForVolumeNameW
lstrcpyW
FindFirstFileA
FormatMessageA
FindNextVolumeW
AllocConsole
lstrcmpW
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetACP
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
LoadLibraryExW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
GetFileSize
TerminateThread
GetLastError
CreateDirectoryW
GetModuleHandleA
RemoveDirectoryW
MoveFileW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetModuleHandleW
ExitProcess
CreateMutexA
GetCurrentProcess
GetProcAddress
LoadLibraryA
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
GetModuleFileNameW
CloseHandle
ExitThread
CreateFileW
WriteFile
SetConsoleOutputCP
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
CallNextHookEx
GetKeyboardLayoutNameA
GetKeyState
GetWindowTextLengthW
GetWindowThreadProcessId
GetMessageA
SetClipboardData
EnumWindows
ExitWindowsEx
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
CloseWindow
SendInput
EnumDisplaySettingsW
mouse_event
CreatePopupMenu
DispatchMessageA
TranslateMessage
TrackPopupMenu
DefWindowProcA
CreateWindowExA
GetIconInfo
GetSystemMetrics
AppendMenuA
RegisterClassExA
GetCursorPos
SetForegroundWindow
DrawIcon
SystemParametersInfoW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteObject
CreateDCA
GetObjectA
DeleteDC
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyA
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
CoInitializeEx
CoUninitialize
CoGetObject
PathFileExistsW
PathFileExistsA
StrToIntA
waveInUnprepareHeader
waveInOpen
waveInStart
waveInAddBuffer
PlaySoundW
mciSendStringA
mciSendStringW
waveInClose
waveInStop
waveInPrepareHeader
gethostbyname
send
WSAStartup
closesocket
inet_ntoa
htons
htonl
getservbyname
ntohs
getservbyport
gethostbyaddr
inet_addr
WSASetLastError
WSAGetLastError
recv
connect
socket
URLOpenBlockingStreamW
URLDownloadToFileW
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusStartup
GdipLoadImageFromStream
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ