Behavioral task
behavioral1
Sample
remcos_a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
remcos_a.exe
Resource
win10v2004-20240802-en
General
-
Target
remcos_a.exe
-
Size
429KB
-
MD5
d326632e1d027013114bb958480e95a2
-
SHA1
10166c50d433cc0f8f58029adb440478729e9fef
-
SHA256
ae796ccd550f13ec200f3f85cd6b74bbe4ec5dc340433df02ac5ae31abae292e
-
SHA512
4c8da9780cf7a330886847f791d9e4946636b7b649941121082740331bd17283d23b9931202d4be91fe54ecd069a8f16ea74b51f873e2164c4adb85e281cf63f
-
SSDEEP
6144:SvRscHtVzjwIRFzJZ2p26+jFWXYnj9iT2ebvXmUcCqkmAO2rjXH7ycDN3:SvRs4OIm2hWX4U2ebvRUAr7733
Malware Config
Extracted
remcos
5.1.3 Light
�������������
HexLogin-44867.portmap.host:44867
-
audio_folder
Ìèêðîôîííûå çàïèñè
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
6C@=0;K.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Ðìê-AFOW1J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Ñêðèíøîòû
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource remcos_a.exe
Files
-
remcos_a.exe.exe windows:5 windows x86 arch:x86
f635308d4c84ff7b67cc226030cba013
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetCurrentProcess
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetCurrentProcessId
GetTickCount
GlobalUnlock
LocalAlloc
GetModuleHandleA
GlobalFree
MulDiv
SizeofResource
QueryDosDeviceW
FindFirstVolumeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
lstrlenW
GetStdHandle
RemoveDirectoryW
FindResourceA
OpenProcess
lstrcatW
LockResource
LoadResource
LocalFree
GetFileSize
FindVolumeClose
GetVolumePathNamesForVolumeNameW
lstrcpyW
SetConsoleOutputCP
FormatMessageA
FindNextVolumeW
AllocConsole
SetLastError
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapReAlloc
GetACP
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
LoadLibraryExW
VirtualProtect
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetLocaleInfoA
ExitProcess
CreateMutexA
GetModuleFileNameW
GetLongPathNameW
GetLastError
WaitForSingleObject
ExpandEnvironmentStringsA
FindNextFileA
FindFirstFileA
MoveFileW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
SetFileAttributesW
GetFileAttributesW
CreateFileW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
CreateDirectoryW
CreateProcessA
Sleep
PeekNamedPipe
CreatePipe
TerminateProcess
WriteFile
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
CloseHandle
SetEvent
CreateEventW
lstrcmpW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
user32
ExitWindowsEx
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
SetForegroundWindow
SetClipboardData
GetClipboardData
EnumWindows
MessageBoxW
IsWindowVisible
CloseWindow
GetWindowThreadProcessId
SendInput
EnumDisplaySettingsW
mouse_event
MapVirtualKeyA
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetForegroundWindow
GetCursorPos
RegisterClassExA
AppendMenuA
CreateWindowExA
DefWindowProcA
TrackPopupMenu
CreatePopupMenu
SetWindowTextW
EmptyClipboard
CloseClipboard
OpenClipboard
ShowWindow
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyA
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
shlwapi
StrToIntA
PathFileExistsA
PathFileExistsW
winmm
PlaySoundW
mciSendStringW
mciSendStringA
ws2_32
connect
socket
recv
WSAGetLastError
WSAStartup
closesocket
htons
htonl
getservbyname
inet_ntoa
ntohs
getservbyport
inet_addr
gethostbyaddr
gethostbyname
send
WSASetLastError
urlmon
URLOpenBlockingStreamW
URLDownloadToFileW
gdiplus
GdipGetImageEncoders
GdipFree
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup
GdipGetImageEncodersSize
GdipCloneImage
GdipAlloc
GdipDisposeImage
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
Sections
.text Size: 302KB - Virtual size: 301KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ