remcos | 2d3b381fbf74084bf2183a3528d80750_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2d3b381fbf74084bf2183a3528d80750_NeikiAnalytics.exe
Size 124KB
Sample240528-cmr2zacb52
SHA256 291ee191047a5039399d50a349c0babaa936ac95235395c896d3e73579c2287d
MD5 2d3b381fbf74084bf2183a3528d80750
SHA1 6cd1a236b01e71941996bd0228c417ccecaacfcc
SHA512 6ad7f72cf628d5bade4d557a6105be0c96fe7306c7776a6d31e41bcf715ec19de33ebb7b0f82be52bf87715f60fdb05a0fa7b03e9b2e1767a45b6b55a4bb7e35
SSDEEP 3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGak4Ozqhc/rc+5:MGuVUD7/5yBP3s5p8m5IYNGatOzqhcv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remote%host remcos

Malware Config

Extracted

Family

remcos

Version

2.4.5 Pro

Botnet

Remote%Host

www.rmagent.biz:7181

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
vbs.server.exe
copy_folder
vbs.server
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-00GA1C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
vbs.server
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d3b381fbf74084bf2183a3528d80750_NeikiAnalytics.exe

File Explorer

2d3b381fbf74084bf2183a3528d80750_NeikiAnalytics.exe

.exe 124KB

2d3b381fbf74084bf2183a3528d80750_NeikiAnalytics.exe

IMPHASH e614da0834fa05db0c29913dd3f46013
SHA256 291ee191047a5039399d50a349c0babaa936ac95235395c896d3e73579c2287d
MD5 2d3b381fbf74084bf2183a3528d80750
SHA1 6cd1a236b01e71941996bd0228c417ccecaacfcc
SHA512 6ad7f72cf628d5bade4d557a6105be0c96fe7306c7776a6d31e41bcf715ec19de33ebb7b0f82be52bf87715f60fdb05a0fa7b03e9b2e1767a45b6b55a4bb7e35
SSDEEP 3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGak4Ozqhc/rc+5:MGuVUD7/5yBP3s5p8m5IYNGatOzqhcv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexA OpenMutexA GetModuleHandleA Process32NextW Process32FirstW CreateToolhelp32Snapshot SizeofResource LockResource LoadResource FindResourceA GetLocaleInfoA OpenProcess GetCurrentProcessId lstrcatW GetTempFileNameW GetTempPathW GetTickCount GlobalUnlock GlobalLock GlobalAlloc CopyFileW ResumeThread SetThreadContext WriteProcessMemory VirtualAllocEx ReadProcessMemory GetThreadContext VirtualAlloc CreateProcessW GlobalFree LocalAlloc DuplicateHandle GetCurrentThread GetLongPathNameW lstrcpynA GetModuleFileNameA ExitProcess AllocConsole GetStartupInfoA ExpandEnvironmentStringsA FindFirstFileA FindNextFileA DeleteFileA GetLastError LoadLibraryA GetProcAddress CreateFileMappingA MapViewOfFileEx RemoveDirectoryW SetFileAttributesW TerminateThread FindClose GetLogicalDriveStringsA GetFileAttributesW DeleteFileW GetFileSize SetFilePointer GetDriveTypeA lstrlenA FindFirstFileW FindNextFileW CreatePipe CreateProcessA PeekNamedPipe ReadFile TerminateProcess SetEvent HeapCreate ExitThread HeapFree GetLocalTime CreateEventA WaitForSingleObject CreateThread GetModuleFileNameW Sleep CreateDirectoryW CreateFileW WriteFile CloseHandle GetCurrentProcess

user32

AppendMenuA RegisterClassExA CreateWindowExA SystemParametersInfoW SendInput GetIconInfo DrawIcon EnumWindows GetWindowTextW IsWindowVisible CloseWindow GetWindowThreadProcessId GetKeyboardLayoutNameA MessageBoxW ExitWindowsEx EmptyClipboard CreatePopupMenu ShowWindow SetWindowTextW SetForegroundWindow OpenClipboard GetClipboardData CloseClipboard UnhookWindowsHookEx GetForegroundWindow GetWindowTextLengthA GetWindowTextA GetKeyState CallNextHookEx SetWindowsHookExA GetKeyboardLayout GetMessageA TranslateMessage TrackPopupMenu GetCursorPos SetClipboardData DispatchMessageA DefWindowProcA

gdi32

CreateDCA CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap DeleteDC DeleteObject GetDIBits GetObjectA StretchBlt SelectObject

advapi32

RegOpenKeyExA RegEnumKeyExA GetUserNameW ChangeServiceConfigW QueryServiceStatus ControlService OpenSCManagerW StartServiceW OpenSCManagerA EnumServicesStatusW OpenServiceW RegDeleteKeyA RegCloseKey RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegSetValueExA RegCreateKeyA RegSetValueExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CloseServiceHandle QueryServiceConfigW

shell32

ExtractIconA Shell_NotifyIconA ShellExecuteExA ShellExecuteW

msvcrt

_controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _iob freopen wcscat _itow srand swprintf _wsystem wcscpy wcslen _wgetenv toupper sprintf tolower wcscmp _wrename exit getenv printf strncmp malloc free _EH_prolog __CxxFrameHandler ??3@YAXPAX@Z _CxxThrowException ??0exception@@QAE@ABV0@@Z time localtime strftime atoi _ftol ??2@YAPAXI@Z rand _itoa

msvcp60

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV01@@Z ??0logic_error@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z

shlwapi

PathFileExistsA PathFileExistsW StrToIntA

winmm

PlaySoundW mciSendStringA waveInStop waveInStart waveInClose waveInUnprepareHeader waveInPrepareHeader mciSendStringW waveInAddBuffer waveInOpen

ws2_32

htons gethostbyname closesocket inet_ntoa socket connect recv send WSAStartup

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipAlloc GdipSaveImageToStream GdipSaveImageToFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenA InternetReadFile