remcos | 1668-89-0x0000000004FA0000-0x0000000004FE0000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.dmp
Size 256KB
Sample240302-j6versbg2t
SHA256 c695d187c552f8dcd820c4d6a419b0c050a664883fd4fcfbd5a5b4df914d61e0
MD5 49211559d690667fb9e84ac745dd606f
SHA1 7de58d8c1f22e56c9b973164f8b797384b763ba9
SHA512 58370cb2e003dffee26e514782a9e80825a4e1cd95c574adc42e7192005bb63bed50c8a4dc54167e5b180de00a17806aefb0b80cde2b30f3fed232bd3dd2868a
SSDEEP 6144:ehzOv2fM13jsIFShVrNT7P/PDIfDM13jsIFSHNT7P/PkNT7P/PGM13jsIFSaXhzD:e6sM9oIoH1QM9oIoH1M1uM9oIoaX6u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

happy new month remcos

Malware Config

Extracted

Family

remcos

Botnet

Happy New Month

arttronova124.duckdns.org:3030

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Windows Audio Service.exe
copy_folder
Microsoft Media Corp
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows Display
keylog_path
%WinDir%
mouse_option
false
mutex
Windows Audio
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Microsoft Sound EndPoints
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Username;password;proforma;invoice;notepad

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

File Explorer

1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

.exe 256KB

1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

IMPHASH d3a62971944197f0701c7049a9c739d1
SHA256 c695d187c552f8dcd820c4d6a419b0c050a664883fd4fcfbd5a5b4df914d61e0
MD5 49211559d690667fb9e84ac745dd606f
SHA1 7de58d8c1f22e56c9b973164f8b797384b763ba9
SHA512 58370cb2e003dffee26e514782a9e80825a4e1cd95c574adc42e7192005bb63bed50c8a4dc54167e5b180de00a17806aefb0b80cde2b30f3fed232bd3dd2868a
SSDEEP 6144:ehzOv2fM13jsIFShVrNT7P/PDIfDM13jsIFSHNT7P/PkNT7P/PGM13jsIFSaXhzD:e6sM9oIoH1QM9oIoH1M1uM9oIoaX6u
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetLongPathNameA CreateMutexA OpenMutexA Process32Next Process32First CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA Process32NextW Process32FirstW lstrlenA GetDriveTypeA CreateProcessA GetTickCount GlobalUnlock GlobalLock GlobalAlloc WinExec GetCurrentProcessId CreateDirectoryW CopyFileA GetFileAttributesW GetLogicalDriveStringsA GetCurrentProcess ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc GlobalFree LocalAlloc TerminateProcess ReadFile PeekNamedPipe GetStdHandle CreatePipe OpenProcess DuplicateHandle GetCurrentThread lstrcpynA ExitProcess AllocConsole GetStartupInfoA ExpandEnvironmentStringsA FindFirstFileA FindNextFileA GetLastError LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx DeleteFileA RemoveDirectoryA CloseHandle GetFileAttributesA SetFileAttributesA SetEvent TerminateThread FindFirstFileW FindNextFileW FindClose GetLocalTime CreateEventA WaitForSingleObject CreateDirectoryA ExitThread Sleep GetModuleHandleA DeleteFileW CreateThread

user32

GetWindowTextLengthA GetForegroundWindow UnhookWindowsHookEx CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard ExitWindowsEx MessageBoxA GetKeyboardLayoutNameA GetWindowThreadProcessId ShowWindow CloseWindow GetWindowTextA GetWindowTextW EnumWindows SendInput CreateWindowExA RegisterClassExA AppendMenuA CreatePopupMenu TrackPopupMenu SetForegroundWindow GetCursorPos DefWindowProcA GetKeyState CallNextHookEx SetWindowsHookExA GetMessageA TranslateMessage GetKeyboardLayout FindWindowA DispatchMessageA IsWindowVisible

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject StretchBlt GetObjectA GetDIBits DeleteObject DeleteDC

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA RegDeleteValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegDeleteKeyA RegCloseKey RegQueryValueExA GetUserNameW

shell32

ShellExecuteA ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcp60

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??Bios_base@std@@QBEPAXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

msvcrt

_wrename _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _iob freopen srand rand mbstowcs realloc _itoa sprintf getenv toupper tolower wcscmp printf strncmp malloc free _EH_prolog __CxxFrameHandler time localtime strftime puts atoi _ftol ??2@YAPAXI@Z _except_handler3 exit ??0exception@@QAE@ABV0@@Z _CxxThrowException

winmm

waveInOpen waveInStop waveInClose waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader waveInStart

shlwapi

PathFileExistsA

ws2_32

htons gethostbyname closesocket socket send WSAGetLastError connect recv WSAStartup

urlmon

URLDownloadToFileA

gdiplus

GdipLoadImageFromStreamICM GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdipLoadImageFromStream GdiplusStartup GdipGetImageEncoders GdipFree GdipGetImageEncodersSize

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile