remcos | remcos_a[.]exe

Resubmissions

01/11/2024, 17:55

241101-whv3lsvmgn10

28/10/2024, 13:51

241028-q5sywaykgr10

Sharing

Copy URL Twitter E-mail

General

Target
remcos_a.exe
Size 430KB
Sample241101-whv3lsvmgn
SHA256 660df70883cc41bbf47694496b03634471b05befea24cdf24d36ae4ee3a55e77
MD5 6e497aa5f3372a06bb6f94ebf81337e6
SHA1 beb3485417aad2c57b6c8943a6f47929dceba82a
SHA512 2d10a944f2cd118aa5e67353aa1f109e1ebd2d9810b45996afb86d458de87f96e3ba69014f560589c764a5f6a37fac854c67aaad9550f47fd17ce320315ae2d5
SSDEEP 6144:KvRscHtVzjwIRFzJZ2p26+jFWXYnj9iT2ebvXmUcCqkmAO2XjXH7icDv83:KvRs4OIm2hWX4U2ebvRUAX77u3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remotehost remcos

Malware Config

Extracted

Family

remcos

Version

5.2.0 Light

Botnet

RemoteHost

it-double.gl.at.ply.gg:37981

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-B44GK0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
remcos_a.exe

File Explorer

remcos_a.exe

.exe 430KB

remcos_a.exe

IMPHASH f635308d4c84ff7b67cc226030cba013
SHA256 660df70883cc41bbf47694496b03634471b05befea24cdf24d36ae4ee3a55e77
MD5 6e497aa5f3372a06bb6f94ebf81337e6
SHA1 beb3485417aad2c57b6c8943a6f47929dceba82a
SHA512 2d10a944f2cd118aa5e67353aa1f109e1ebd2d9810b45996afb86d458de87f96e3ba69014f560589c764a5f6a37fac854c67aaad9550f47fd17ce320315ae2d5
SSDEEP 6144:KvRscHtVzjwIRFzJZ2p26+jFWXYnj9iT2ebvXmUcCqkmAO2XjXH7icDv83:KvRs4OIm2hWX4U2ebvRUAX77u3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

181049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary IsBadReadPtr GetCurrentProcess GetSystemDirectoryA GlobalAlloc GlobalLock GetCurrentProcessId GetTickCount GlobalUnlock LocalAlloc GetModuleHandleA GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle RemoveDirectoryW FindResourceA OpenProcess lstrcatW LockResource LoadResource LocalFree GetFileSize FindVolumeClose GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole SetLastError GetModuleFileNameA lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetACP GetModuleHandleExW MoveFileExW RtlUnwind RaiseException LoadLibraryExW VirtualProtect Process32FirstW Process32NextW CreateToolhelp32Snapshot GetLocaleInfoA ExitProcess CreateMutexA GetModuleFileNameW GetLongPathNameW GetLastError WaitForSingleObject ExpandEnvironmentStringsA FindNextFileA FindFirstFileA MoveFileW SetFilePointerEx GetLogicalDriveStringsA DeleteFileW DeleteFileA SetFileAttributesW GetFileAttributesW CreateFileW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW CreateDirectoryW CreateProcessA Sleep PeekNamedPipe CreatePipe TerminateProcess WriteFile ReadFile HeapFree HeapCreate CreateEventA GetLocalTime CreateThread CloseHandle SetEvent CreateEventW lstrcmpW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount MultiByteToWideChar DecodePointer EncodePointer WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEndOfFile

user32

ExitWindowsEx TranslateMessage DispatchMessageA GetMessageA GetWindowTextW SetForegroundWindow SetClipboardData GetClipboardData EnumWindows MessageBoxW IsWindowVisible CloseWindow GetWindowThreadProcessId SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics GetIconInfo SystemParametersInfoW GetForegroundWindow GetCursorPos RegisterClassExA AppendMenuA CreateWindowExA DefWindowProcA TrackPopupMenu CreatePopupMenu SetWindowTextW EmptyClipboard CloseClipboard OpenClipboard ShowWindow

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCreateKeyA RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegDeleteKeyA

shell32

ShellExecuteExA Shell_NotifyIconA ExtractIconA ShellExecuteW

shlwapi

StrToIntA PathFileExistsA PathFileExistsW

winmm

PlaySoundW mciSendStringW mciSendStringA

ws2_32

connect socket recv WSAGetLastError WSAStartup closesocket htons htonl getservbyname inet_ntoa ntohs getservbyport inet_addr gethostbyaddr gethostbyname send WSASetLastError

urlmon

URLOpenBlockingStreamW URLDownloadToFileW

gdiplus

GdipGetImageEncoders GdipFree GdipLoadImageFromStream GdipSaveImageToStream GdiplusStartup GdipGetImageEncodersSize GdipCloneImage GdipAlloc GdipDisposeImage

wininet

InternetOpenUrlW InternetCloseHandle InternetReadFile InternetOpenW

Name

.text

Size

302KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

remcos_a.exe

kernel32

user32

gdi32

advapi32

shell32

shlwapi

winmm

ws2_32

urlmon

gdiplus

wininet

generic