Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20240508-en
General
-
Target
Server.exe
-
Size
469KB
-
MD5
bd94649269e70da15b1bbc6d8c42cbf0
-
SHA1
2ed8a385eccb9f9d82cf85a3c5bfab64a75cf68a
-
SHA256
23a8ef813c54db77e7d1e7b56b43211dea27b3f63bd47318616c1d62f946334e
-
SHA512
97597d9c8252cd6b2ce17939e1e80d75e5148502d0d814dd3cc8a0daa765b3b0f8d16e770d5d7a1a57d512fbc5bb4f5e6f375b7fef8b872c6490979bcd70bfdd
-
SSDEEP
12288:Imnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSJn9:4iLJbpI7I2WhQqZ7J9
Malware Config
Extracted
remcos
Hosting
az-evolution.gl.at.ply.gg:17672
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
wd defender.exe
-
copy_folder
WD
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%SystemDrive%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PMKG1L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
WD Defender
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Server.exe
Files
-
Server.exe.exe windows:5 windows x86 arch:x86
5d354883fe6f15fcf48045037a99fb7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileW
CreateMutexA
GetLocaleInfoA
CreateToolhelp32Snapshot
OpenMutexA
Process32NextW
Process32FirstW
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
OpenProcess
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetCurrentProcess
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
SetFilePointer
FindResourceA
LockResource
LoadResource
LocalFree
FormatMessageA
AllocConsole
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
GetLongPathNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetACP
GetStdHandle
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
LoadLibraryExW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
ExpandEnvironmentStringsA
FindNextFileA
FindFirstFileA
GetFileSize
TerminateThread
GetLastError
SetFileAttributesW
GetModuleHandleA
RemoveDirectoryW
MoveFileW
CreateDirectoryW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
GetFileAttributesW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
ExitProcess
GetProcAddress
LoadLibraryA
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
GetModuleFileNameW
CloseHandle
ExitThread
CreateFileW
WriteFile
QueryPerformanceCounter
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
user32
CallNextHookEx
GetKeyboardLayoutNameA
GetKeyState
GetWindowTextLengthW
GetWindowThreadProcessId
SetForegroundWindow
SetClipboardData
EnumWindows
ExitWindowsEx
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
mouse_event
CreateWindowExA
DefWindowProcA
TrackPopupMenu
CreatePopupMenu
EnumDisplaySettingsW
SendInput
CloseWindow
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyA
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
shlwapi
StrToIntA
PathFileExistsW
PathFileExistsA
winmm
waveInPrepareHeader
waveInStop
waveInUnprepareHeader
mciSendStringA
PlaySoundW
waveInOpen
waveInStart
waveInAddBuffer
waveInClose
mciSendStringW
ws2_32
WSAGetLastError
recv
connect
socket
send
WSAStartup
closesocket
inet_ntoa
gethostbyname
WSASetLastError
inet_addr
gethostbyaddr
getservbyport
ntohs
getservbyname
htons
htonl
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
gdiplus
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipLoadImageFromStream
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
Sections
.text Size: 337KB - Virtual size: 336KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ