2025-04-04_ce41fef45c3add8535e684ac28f408ea_amadey_remcos_smoke-loader

Sharing

Copy URL

Twitter E-mail

General

Target

2025-04-04_ce41fef45c3add8535e684ac28f408ea_amadey_remcos_smoke-loader
Size

2.0MB
MD5

ce41fef45c3add8535e684ac28f408ea
SHA1

e72cd6d6949bdad6c15f9af01a21476e16b2f6ff
SHA256

97aaada1264b8f2e044885248d8023caf084924ff4512cc9b617d239fea38a86
SHA512

9dcbc88dcfb53f119dae18a380c60119a86dbe4105fa53805c449abd60cc40eb5dfa06e97069c12b9346e89cc94c5cf75eb31e7163671cf354eba67782876371
SSDEEP

49152:yNiymhM+pnfth6N4ksLQkkIVyO2mS6hxDF4OnQn/8BF6fvyiUMBgd:yNiyx+pnVQsLQE2H6rDF4OnQn/8T6Xyf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-04-04_ce41fef45c3add8535e684ac28f408ea_amadey_remcos_smoke-loader

Files

2025-04-04_ce41fef45c3add8535e684ac28f408ea_amadey_remcos_smoke-loader
.exe windows:4 windows x86 arch:x86

a61005af6dc644551f6c20d8f87d18a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\infocenter_mt.pdb

Imports

kernel32

IsBadWritePtr
GetFileSizeEx
FileTimeToSystemTime
HeapAlloc
GetProcessHeap
HeapFree
FindNextFileW
VerSetConditionMask
OpenMutexW
VerifyVersionInfoW
MapViewOfFile
TerminateProcess
UnmapViewOfFile
WaitNamedPipeW
OpenFileMappingW
GetCurrentProcessId
CreateDirectoryW
RemoveDirectoryW
OutputDebugStringA
FileTimeToLocalFileTime
GetFileTime
SetEndOfFile
SetFilePointerEx
GetLogicalDriveStringsW
QueryDosDeviceW
Module32FirstW
TerminateThread
CreateThread
GetSystemDirectoryW
GetExitCodeProcess
LocalFileTimeToFileTime
SetFileTime
GetCurrentDirectoryW
GetSystemTimeAsFileTime
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
FindFirstFileW
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
ExitProcess
GetModuleHandleA
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVersionExA
GetThreadLocale
GetACP
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
GetLocaleInfoA
InterlockedExchange
InterlockedCompareExchange
SystemTimeToFileTime
MulDiv
lstrcmpW
GetModuleFileNameW
FreeResource
CreateFileW
GetFileSize
ReadFile
MoveFileExW
CloseHandle
WaitForSingleObject
CreateProcessW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
InitializeCriticalSection
LoadLibraryW
lstrlenW
LeaveCriticalSection
OutputDebugStringW
GetProcAddress
FindResourceExW
lstrlenA
GetLastError
GetWindowsDirectoryW
LoadResource
SetLastError
LockResource
MultiByteToWideChar
SizeofResource
GetLocalTime
RaiseException
FindResourceW
VirtualFreeEx
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
OpenEventW
CopyFileW
GetModuleFileNameA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
ProcessIdToSessionId
SetFilePointer
CreateFileA
LocalAlloc
ReleaseMutex
CreateMutexW
FlushFileBuffers
WriteFile
LocalFree
DeleteFileW
GetCommandLineW
GlobalAlloc
GlobalLock
Sleep
GlobalUnlock
GlobalFree
GetTickCount
WaitForMultipleObjects
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
GetFileAttributesW
CreateEventW
SetEvent
LoadLibraryExW
ResetEvent
DeleteCriticalSection
GetFileType
FindClose
WideCharToMultiByte
GetModuleHandleW
EnterCriticalSection
GetCurrentThreadId
GetVersionExW
FreeLibrary
FlushInstructionCache
GetCurrentProcess
GetConsoleOutputCP

user32

ReleaseDC
EndPaint
BeginPaint
ScreenToClient
SetWindowLongW
GetWindowLongW
PostQuitMessage
FindWindowW
FindWindowExW
SendMessageTimeoutW
GetClassNameW
GetSystemMetrics
EnumDisplayDevicesW
EnumDisplaySettingsW
GetWindowTextLengthW
RedrawWindow
GetWindowTextW
InvalidateRgn
FillRect
CreateAcceleratorTableW
IntersectRect
GetDesktopWindow
KillTimer
DrawTextW
GetSysColor
UnregisterClassA
UpdateLayeredWindow
GetClientRect
GetDlgCtrlID
CopyRect
SetActiveWindow
PostThreadMessageW
LoadBitmapW
CreatePopupMenu
DestroyMenu
MonitorFromPoint
TrackPopupMenu
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
DestroyAcceleratorTable
GetNextDlgTabItem
IsWindowVisible
CallWindowProcW
DrawIconEx
SetRectEmpty
DefWindowProcW
GetParent
EqualRect
CreateWindowExW
GetWindowRect
InvalidateRect
GetDC
RegisterClassExW
MapWindowPoints
GetDlgItem
RegisterWindowMessageW
IsWindow
SetFocus
SystemParametersInfoW
MoveWindow
GetWindow
ShowWindow
GetClassInfoExW
ReleaseCapture
SetRect
PtInRect
SetWindowPos
SetCapture
DrawFrameControl
LoadCursorW
DestroyWindow
PostMessageW
OffsetRect
LoadImageW
GetMonitorInfoW
MonitorFromWindow
SetCursor
LoadIconW
GetCursorPos
SendMessageW
ClientToScreen
InflateRect
DestroyIcon
SetForegroundWindow
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
GetFocus
DispatchMessageW
IsChild
SetTimer
IsDialogMessageW
SetWindowTextW
GetActiveWindow
wsprintfW
WindowFromPoint
GetShellWindow
AppendMenuW
IsWindowEnabled
EnableWindow

gdi32

CreateBitmap
CreateDIBSection
DeleteDC
GetCurrentObject
GetTextExtentPoint32W
TextOutW
SetBkMode
BitBlt
GetViewportOrgEx
ExtSelectClipRgn
SelectObject
RestoreDC
CreateRectRgnIndirect
OffsetRgn
SetViewportOrgEx
SetTextColor
SaveDC
CreateCompatibleBitmap
CreatePen
RoundRect
CreateFontIndirectW
CreateCompatibleDC
CreateRectRgn
DeleteObject
GetClipRgn
RectInRegion
CreateRoundRectRgn
SelectClipRgn
ExtTextOutW
SetBkColor
GetObjectW
Rectangle
GetStockObject
GetTextColor
MoveToEx
LineTo
StretchBlt
SetStretchBltMode
CreateSolidBrush
CombineRgn
GetDeviceCaps

advapi32

RegOpenKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
GetUserNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
SetSecurityDescriptorDacl
OpenServiceW
OpenSCManagerW
InitializeSecurityDescriptor
QueryServiceStatusEx
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceConfigW
ChangeServiceConfigW
RegEnumKeyExW

shell32

SHBindToParent
CommandLineToArgvW
SHCreateDirectoryExW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteW
ord680
Shell_NotifyIconW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

StringFromGUID2
OleLockRunning
CLSIDFromString
CoGetClassObject
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoTaskMemRealloc
CoUninitialize

oleaut32

SysFreeString
SysAllocString
SysStringByteLen
OleCreateFontIndirect
SysAllocStringLen
LoadRegTypeLi
VariantClear
LoadTypeLi
SysStringLen
VariantInit
DispCallFunc
VarUI4FromStr

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
SHGetValueW
PathFindExtensionW
StrRetToBufW
PathAppendW
PathAddBackslashW
PathFileExistsW
StrToIntW
StrToIntA

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipLoadImageFromStream
GdipImageRotateFlip
GdipAddPathArcI
GdipDeleteGraphics
GdipCreatePen1
GdipFillPath
GdipTranslateWorldTransform
GdipCloneBrush
GdipSetCompositingQuality
GdipPrivateAddFontFile
GdipCreateStringFormat
GdipDeletePen
GdipDeletePath
GdipGetFontCollectionFamilyCount
GdipDeleteStringFormat
GdipDrawImagePointsRectI
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipRotateWorldTransform
GdipResetWorldTransform
GdipDeleteBrush
GdipCreatePath
GdipFillRectangle
GdipAlloc
GdipSetStringFormatFlags
GdipDrawLinesI
GdipAddPathPieI
GdipGetFontCollectionFamilyList
GdipClosePathFigure
GdipCloneFontFamily
GdipSetPenEndCap
GdipSetStringFormatLineAlign
GdipCreateBitmapFromScan0
GdipSetPenStartCap
GdipSetStringFormatTrimming
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipSetPenDashStyle
GdipSetPenMode
GdipAddPathRectangleI
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawImageRectRect
GdipCreateImageAttributes
GdipDrawLine
GdipDrawString
GdipSetPixelOffsetMode
GdipFillRectangleI
GdipDisposeImageAttributes
GdipDrawImageRectRectI
GdipGetFamily
GdipDrawRectangleI
GdipSetSmoothingMode
GdipCreateFont
GdipMeasureString
GdipSetClipPath
GdipGetImageHeight
GdipDrawPath
GdipAddPathStringI
GdipGetImageWidth
GdipSetImageAttributesColorMatrix
GdipDisposeImage
GdipGetFontSize
GdiplusShutdown
GdipDeleteFont
GdipCloneImage
GdipGraphicsClear
GdipCreateFontFromLogfontW
GdipDrawImageRectI
GdipCreateFromHDC
GdiplusStartup
GdipLoadImageFromFile
GdipDrawImageI
GdipFree
GdipDeleteFontFamily
GdipSetStringFormatAlign

ws2_32

ioctlsocket
select
__WSAFDIsSet
getaddrinfo
freeaddrinfo
WSASetLastError
socket
connect
WSACleanup
WSAStartup
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

crypt32

CertNameToStrW

psapi

GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 24KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 648KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a61005af6dc644551f6c20d8f87d18a9

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

version

crypt32

psapi

wtsapi32

userenv

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 284KB - Virtual size: 283KB

.data Size: 24KB - Virtual size: 34KB

.rsrc Size: 648KB - Virtual size: 648KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 284KB - Virtual size: 283KB

.data
Size: 24KB - Virtual size: 34KB

.rsrc
Size: 648KB - Virtual size: 648KB