RemComSvc[.]exe | Triage™

General

Target
RemComSvc.exe
Size 48KB
Sample240613-q146ca1emg
SHA256 4a374fd0003c3f2b02c35da900e27ad72ce9e8be1e2d9be006f689ac8ade0f60
MD5 08a64da84a16a001a74c710cf6fc7f0d
SHA1 cabc12cf59b1ba1fc76a5d4c87852965d5958a45
SHA512 eda30585200e82565fe692fff7be0240cb431766b27dd3f5dd24f027d0b91989f4343d05796c7f6bf37fb1b4ea6f5417b146ba269886a3744b20b9386ecfd1c3
SSDEEP 1536:O8Xu96vKu/yfH36AOrIhFVg81CPIoi5t:O/uaSAJhFe8voi5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RemComSvc.exe

File Explorer

RemComSvc.exe

.exe 48KB

RemComSvc.exe

IMPHASH ba9923d9bf7b1cc87486a23ff9cc2c57
SHA256 4a374fd0003c3f2b02c35da900e27ad72ce9e8be1e2d9be006f689ac8ade0f60
MD5 08a64da84a16a001a74c710cf6fc7f0d
SHA1 cabc12cf59b1ba1fc76a5d4c87852965d5958a45
SHA512 eda30585200e82565fe692fff7be0240cb431766b27dd3f5dd24f027d0b91989f4343d05796c7f6bf37fb1b4ea6f5417b146ba269886a3744b20b9386ecfd1c3
SSDEEP 1536:O8Xu96vKu/yfH36AOrIhFVg81CPIoi5t:O/uaSAJhFe8voi5
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess LocalAlloc CreateEventA LocalFree GetLastError InterlockedIncrement ReadFile WriteFile DisconnectNamedPipe InterlockedDecrement SetEvent CreateProcessA WaitForSingleObject GetExitCodeProcess CreateNamedPipeA ConnectNamedPipe GetCurrentProcessId CloseHandle ExitThread ResumeThread CreateThread GetCommandLineA HeapSetInformation DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress ExitProcess HeapFree Sleep EnterCriticalSection LeaveCriticalSection GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryW RtlUnwind HeapAlloc HeapReAlloc SetStdHandle WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW HeapSize FlushFileBuffers CreateFileW

advapi32

RegisterServiceCtrlHandlerA OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService SetServiceStatus InitializeSecurityDescriptor SetSecurityDescriptorDacl StartServiceCtrlDispatcherA

Sharing