RemCom[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

RemCom.exe
Size

83KB
MD5

60ced79a47109c691affae4e7202cd33
SHA1

59960a3a273145d2c7a19e873bcee0d3ac69a8e0
SHA256

9ebe8d9f6cd1d4a44dbd52aa72cb1e0499aa53646fed4c138a2514df7cddbcfc
SHA512

ecdbed76c9b96785224fb10ad051d156d70b3b5f48ded03699fccfd2710a53ba8bcbfbf5472c5ad22ade55245771408875d370895a9f8a4d9440c8f28ec57a10
SSDEEP

1536:Qw5/vraoHZTXR2AMdoN5vRRZn7CLE7uexXAYDPDBn5caMjIKI5L:Qw5/V5TXR2AMANxCLEWiBn5caMkx5L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RemCom.exe

Files

RemCom.exe
.exe windows:5 windows x86 arch:x86

217c7b77e786dc14e1d9e7170b300440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\compilation\remcom_1_2\Release\RemCom.pdb

Imports

mpr

WNetCancelConnection2A
WNetAddConnection2A

kernel32

Sleep
WaitNamedPipeA
SetConsoleTitleA
GetCurrentProcessId
ExitThread
SetConsoleCursorPosition
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
ReadFile
WaitForSingleObject
CreateProcessA
GetModuleHandleA
GetComputerNameA
SetConsoleCtrlHandler
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
FindResourceA
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
CreateFileA
WriteFile
CreateDirectoryA
CopyFileA
SetLastError
GetStdHandle
ReadConsoleA
GetConsoleMode
SetConsoleMode
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
GetCurrentProcess
CloseHandle
GetLastError
FormatMessageA
LocalFree
GetTickCount
GetCurrentThreadId
DeleteFileA

user32

SetProcessWindowStation
OpenDesktopA
CloseWindowStation
CloseDesktop
GetUserObjectSecurity
SetUserObjectSecurity
OpenWindowStationA
GetProcessWindowStation

advapi32

LogonUserA
CreateProcessAsUserA
AddAccessAllowedAce
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
AddAce
CreateProcessWithLogonW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
StartServiceA
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
AllocateAndInitializeSid
RevertToSelf
ImpersonateLoggedOnUser

msvcr90

_mbsicmp
_mbsnbicmp
fflush
fprintf
__iob_func
free
malloc
__argv
__argc
strlen
strcat
sprintf
_splitpath
memset
strcpy
_beginthread
printf
_except_handler4_common
_amsg_exit
__getmainargs
_cexit
_mbscmp
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
_exit

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

217c7b77e786dc14e1d9e7170b300440

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

kernel32

user32

advapi32

msvcr90

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 61KB - Virtual size: 60KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 61KB - Virtual size: 60KB