Static task
static1
Behavioral task
behavioral1
Sample
RemCom.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
RemCom.exe
Resource
win10v2004-20230915-en
General
-
Target
RemCom.exe
-
Size
302KB
-
MD5
269a2981ea44a33c3870440629917e3c
-
SHA1
e8141f765cf51ca474f1808854447c6fc30c8214
-
SHA256
483db9d4c21f1be98395530c58c97fc9990541c01241ad683ba713da6993c89f
-
SHA512
54c1ef865d626b681373b3f2f721023954d60eddc045bbc2d3f2f3f398fdd749f8b9ef48e59fe557b2b974f8edc42c4e8014355b9ec637d1f9f890564bf64c92
-
SSDEEP
6144:d6dM1VQuNauWUa0r0Qka65vJEew41wK8a:d6q1VQuNFa0r0Q36AJ41w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RemCom.exe
Files
-
RemCom.exe.exe windows:5 windows x86
9220c7e5978a3cce0449c19f6e4633a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetCancelConnection2A
WNetAddConnection2A
kernel32
WaitForSingleObject
CreateProcessA
GetFileSize
GetTickCount
DeleteFileA
SetLastError
CopyFileA
GetComputerNameA
SetConsoleCtrlHandler
ReadFile
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
HeapReAlloc
SetStdHandle
SetFilePointer
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
SetConsoleCursorPosition
ExitThread
GetCurrentProcessId
SetConsoleTitleA
WaitNamedPipeA
Sleep
GetModuleHandleA
FindResourceA
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
CreateFileA
WriteFile
GetStdHandle
ReadConsoleA
GetConsoleMode
SetConsoleMode
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
SetEnvironmentVariableA
CloseHandle
GetLastError
FormatMessageA
LocalFree
SetEndOfFile
CompareStringW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
ResumeThread
CreateThread
MoveFileA
RtlUnwind
GetCommandLineA
HeapSetInformation
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetTimeZoneInformation
HeapCreate
HeapDestroy
GetConsoleCP
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameW
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
IsProcessorFeaturePresent
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
WriteConsoleW
user32
OpenDesktopA
OpenWindowStationA
CloseDesktop
GetUserObjectSecurity
SetUserObjectSecurity
GetProcessWindowStation
CloseWindowStation
SetProcessWindowStation
advapi32
AddAccessAllowedAce
RevertToSelf
EnumDependentServicesA
ControlService
QueryServiceStatusEx
ImpersonateLoggedOnUser
CreateProcessAsUserA
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
AddAce
LogonUserA
CreateProcessWithLogonW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
StartServiceA
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ