REIMANOS[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
REIMANOS.exe
Size 26.4MB
Sample261002-tg7c5sdf49
SHA256 49f1aed137ecda7eb168253f31e87f36c898728a738e6c3dcc5dd9e92d708ac7
MD5 f51a243f3e73a1be453ebf78e92b616a
SHA1 df9f99d0ec5d8749953b1fdfba901f941e914841
SHA512 34ee2d52e14df9498cc50bc109c55645e7073a345e8ced6249e811ccf4de9ba47e4a8400611826a7ba78f2b9e66b2c1c807cdefab356895a22b85cd6b44a9cd1
SSDEEP 393216:dL2tg8rRW99rmiVeegB2mKK9T54dcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoBg:szBedclNJNfSpzAPXw
TLSH
T16C570243A2C64756DF92B93DA1129323E1A2FCD6231186C36F9D0F1ADB17AF0497DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
REIMANOS.exe

File Explorer

REIMANOS.exe

.exe 26.4MB

REIMANOS.exe

IMPHASH c070012381c9c44538cdf4faeb8b35cf
SHA256 49f1aed137ecda7eb168253f31e87f36c898728a738e6c3dcc5dd9e92d708ac7
MD5 f51a243f3e73a1be453ebf78e92b616a
SHA1 df9f99d0ec5d8749953b1fdfba901f941e914841
SHA512 34ee2d52e14df9498cc50bc109c55645e7073a345e8ced6249e811ccf4de9ba47e4a8400611826a7ba78f2b9e66b2c1c807cdefab356895a22b85cd6b44a9cd1
SSDEEP 393216:dL2tg8rRW99rmiVeegB2mKK9T54dcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoBg:szBedclNJNfSpzAPXw
TLSH
T16C570243A2C64756DF92B93DA1129323E1A2FCD6231186C36F9D0F1ADB17AF0497DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1158032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

advapi32

CryptEncrypt CryptImportKey AddAccessAllowedAce GetLengthSid CryptDestroyKey SystemFunction036 OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

kernel32

SetCurrentDirectoryA Process32NextW Process32FirstW CreateProcessA GetExitCodeProcess CreateDirectoryA WriteProcessMemory OutputDebugStringA InitializeCriticalSectionEx GetFileAttributesA VirtualProtectEx DeleteCriticalSection ReadProcessMemory GetTickCount VirtualQueryEx GetTickCount64 CreateFileA GetFileSizeEx GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA WaitForSingleObject CreatePipe TerminateProcess WriteFile SetHandleInformation GetModuleFileNameA ReadFile OpenThread SetThreadContext FlushInstructionCache GetModuleHandleW GetCurrentProcessId GetThreadContext HeapDestroy HeapAlloc CloseHandle HeapReAlloc GetLastError CreateToolhelp32Snapshot ResumeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SuspendThread GetCurrentThreadId Thread32First Thread32Next HeapFree VirtualProtect HeapCreate VirtualQuery GetSystemInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead InitOnceComplete InitOnceBeginInitialize OutputDebugStringW EnterCriticalSection LeaveCriticalSection CreateFileW AddVectoredExceptionHandler HeapSize CreateFileMappingW GetModuleFileNameW QueryFullProcessImageNameW VirtualAlloc VirtualFree Beep CreateThread SetLastError FormatMessageW InitializeCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetFileAttributesExW FindFirstFileW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW OpenProcess Sleep FreeLibraryAndExitThread GetCurrentProcess SetPriorityClass

user32

GetCursorInfo mouse_event FindWindowExA PostMessageA GetWindowThreadProcessId GetWindowTextW SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent GetClientRect SetCursor UnregisterClassA EnumWindows IsWindow UpdateWindow ClientToScreen GetCapture RegisterClassExA SetLayeredWindowAttributes CreateWindowExA MoveWindow MapWindowPoints ShowWindow ScreenToClient ReleaseCapture GetWindowTextA GetClassNameA EnumChildWindows MapVirtualKeyW SetForegroundWindow SetWindowLongPtrA SystemParametersInfoA MessageBoxA SetCursorPos LoadCursorA GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData GetCursorPos EmptyClipboard CloseClipboard OpenClipboard IsIconic PeekMessageA TranslateMessage SetWindowDisplayAffinity MessageBoxW DispatchMessageA GetSystemMetrics IsWindowUnicode GetWindowRect DefWindowProcA SetWindowPos GetKeyNameTextW GetAsyncKeyState

gdi32

CreateSolidBrush

shell32

SHGetFolderPathA ShellExecuteA

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ _Thrd_id ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Xtime_get_ticks _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z _Thrd_join ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

urlmon

URLDownloadToFileA

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

wtsapi32

WTSFreeMemoryExW WTSEnumerateProcessesExW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcschr _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __std_terminate __std_exception_destroy __std_exception_copy strstr __C_specific_handler strchr strrchr longjmp memcmp memcpy memmove memset memchr

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _invoke_watson terminate exit abort _wassert _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _resetstkoflw _get_wide_winmain_command_line __sys_nerr __sys_errlist _initterm _initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback system _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

fgets _pclose _set_fmode _popen ftell __acrt_iob_func fflush fclose fseek fputs feof __stdio_common_vfprintf fwrite _wopen _wfopen __stdio_common_vsprintf fread _lseeki64 __stdio_common_vsscanf __p__commode fopen _get_stream_buffer_pointers _fseeki64 fsetpos ungetc _close fgetpos fgetc __stdio_common_vsprintf_s _fileno fputc _write _read setvbuf

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-string-l1-1-0

_wcsdup strcspn wcspbrk strncpy_s strncpy _stricmp towlower strcmp _wcsicmp tolower strcpy_s strspn _strdup wcsncmp strncmp wcsncpy strpbrk

api-ms-win-crt-heap-l1-1-0

calloc _msize free _set_new_mode malloc realloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtol atof strtoul atoi strtod wcstombs strtoll strtoull

api-ms-win-crt-math-l1-1-0

atan2f acosf __setusermatherr ceilf cosf fmodf log _fdopen logf pow powf copysignf _hypotf _fdclass roundf _dsign sqrtf sinf sqrt

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _fstat64 _wstat64 remove _unlink

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 strftime _time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

ws2_32

sendto recv recvfrom freeaddrinfo setsockopt htons ioctlsocket WSAIoctl __WSAFDIsSet select accept getaddrinfo getsockname htonl listen socket gethostname getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop WSAStartup WSACleanup bind connect getpeername

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryW

psapi

GetModuleInformation

shlwapi

PathFindFileNameW