Edit tour

Windows Analysis Report
RemComSvc.exe

Overview

General Information

Sample Name:	RemComSvc.exe
Analysis ID:	1327968
MD5:	25891cd0cf75100fdd544fb2ffdb3641
SHA1:	b3b6098271e9120bb3399251735a779fd55630f9
SHA256:	9bdf9e71e71108f7a7ca43797e03cad75b402d3f6637299da6a9f5dc961e28ca
Infos:

Detection

RemCom RemoteAdmin

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Found evasive API chain checking for process token information

Uses code obfuscation techniques (call, push, ret)

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Yara detected RemCom RemoteAdmin tool

Contains functionality to delete services

Program does not show much activity (idle)

Classification

Analysis Advice

Initial sample is implementing a service and should be registered / started as service

Sample is a service DLL but no service has been registered

Sample may be VM or Sandbox-aware, try analysis on a native machine

Process Tree

System is w10x64

RemComSvc.exe (PID: 6544 cmdline: C:\Users\user\Desktop\RemComSvc.exe MD5: 25891CD0CF75100FDD544FB2FFDB3641)

conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RemComSvc.exe	JoeSecurity_RemComRemoteAdmin	Yara detected RemCom RemoteAdmin tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1977390117.0000000000959000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RemComRemoteAdmin	Yara detected RemCom RemoteAdmin tool	Joe Security
00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RemComRemoteAdmin	Yara detected RemCom RemoteAdmin tool	Joe Security
Process Memory Space: RemComSvc.exe PID: 6544	JoeSecurity_RemComRemoteAdmin	Yara detected RemCom RemoteAdmin tool	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.RemComSvc.exe.950000.0.unpack	JoeSecurity_RemComRemoteAdmin	Yara detected RemCom RemoteAdmin tool	Joe Security
0.2.RemComSvc.exe.950000.0.unpack	JoeSecurity_RemComRemoteAdmin	Yara detected RemCom RemoteAdmin tool	Joe Security

Joe Sandbox Signatures

• Compliance
• System Summary
• Data Obfuscation
• Boot Survival
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: RemComSvc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RemComSvc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RemComSvc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00951450 OpenSCManagerA,WaitForSingleObject,OpenServiceA,CloseServiceHandle,DeleteService,SetServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_00951450

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00951800 _wprintf,StartServiceCtrlDispatcherA,

0_2_00951800

Source: RemComSvc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RemComSvc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00951800 _wprintf,StartServiceCtrlDispatcherA,

0_2_00951800

Source: unknown	Process created: C:\Users\user\Desktop\RemComSvc.exe C:\Users\user\Desktop\RemComSvc.exe
Source: C:\Users\user\Desktop\RemComSvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03

Source: classification engine

Classification label: clean5.winEXE@2/1@0/0

Source: RemComSvc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RemComSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RemComSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RemComSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RemComSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RemComSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00953935 push ecx; ret

0_2_00953948

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00956B54 LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00956B54

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00951800 _wprintf,StartServiceCtrlDispatcherA,

0_2_00951800

Source: C:\Users\user\Desktop\RemComSvc.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-4721

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\RemComSvc.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-3952

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_009518DA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_009518DA

Source: C:\Users\user\Desktop\RemComSvc.exe

0_2_00956B54

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RemComSvc.exe	Code function: 0_2_00953EBF SetUnhandledExceptionFilter,	0_2_00953EBF
Source: C:\Users\user\Desktop\RemComSvc.exe	Code function: 0_2_009518DA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009518DA
Source: C:\Users\user\Desktop\RemComSvc.exe	Code function: 0_2_00952BA7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00952BA7

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00951000 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,_sprintf,_sprintf,_sprintf,CreateNamedPipeA,CreateNamedPipeA,CreateNamedPipeA,CreateNamedPipeA,ConnectNamedPipe,ConnectNamedPipe,ConnectNamedPipe,ConnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

0_2_00951000

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00951540 GetCurrentProcessId,OpenProcess,OpenProcessToken,GetLastError,LocalAlloc,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetLastError,GetLastError,LocalFree,LocalAlloc,GetLastError,GetTokenInformation,GetLastError,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,GetLastError,EqualSid,EqualSid,FreeSid,FreeSid,FreeSid,LocalFree,CloseHandle,FindCloseChangeNotification,CloseHandle,

0_2_00951540

Source: C:\Users\user\Desktop\RemComSvc.exe

0_2_00951000

Source: C:\Users\user\Desktop\RemComSvc.exe

Code function: 0_2_00954752 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00954752

Source: Yara match	File source: RemComSvc.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RemComSvc.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RemComSvc.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1977390117.0000000000959000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RemComSvc.exe PID: 6544, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Service Execution	13 Windows Service	13 Windows Service	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	3 Native API	Boot or Logon Initialization Scripts	2 Process Injection	2 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RemComSvc.exe	10%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1327968
Start date and time:	2023-10-18 14:02:27 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 1m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	RemComSvc.exe
Detection:	CLEAN
Classification:	clean5.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 5 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: RemComSvc.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\RemComSvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.055295335502323
Encrypted:	false
SSDEEP:	3:MzjE/K7gWREXRk7WjR4yn:MzfTiX27mR1
MD5:	3607DE4A999A76DBF817582CE621CF00
SHA1:	072BEB6F77B48F38EA3F28727C545EC96B46CAD0
SHA-256:	350E7FACDD96AAC04FA000A98CBB134538DE90820A76D556E466AEB78DB255B0
SHA-512:	6C3177C9CA1B21B8263199EF39B566B915E0A9EF9858082D9332D76FC5336004F12C3DA7DD54B7FEB0E90A12B92CC8B487BAA168D536E8711180DDEDF0F75CF8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	A service Cannot be started directly...

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.023612300106761
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RemComSvc.exe
File size:	49'664 bytes
MD5:	25891cd0cf75100fdd544fb2ffdb3641
SHA1:	b3b6098271e9120bb3399251735a779fd55630f9
SHA256:	9bdf9e71e71108f7a7ca43797e03cad75b402d3f6637299da6a9f5dc961e28ca
SHA512:	9136c105e490a970196b8330ca84bea1df981d915bd05b8776aef22d4d98a4ed5e8130bf24f6ef0c0358ab11844e1432c3082d5d585287586ebce2e9a863fbc6
SSDEEP:	1536:Y8Xu96vKu/yfH36AOrIhFVg81CPIoi5t:Y/uaSAJhFe8voi5
TLSH:	4823391673A1C032D156153459B4C2B24BBFB83256B9878B7B8407BD9FB12D09E39367
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.............................................................Rich............................PE..L....'6a.................x.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401d50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x613627E2 [Mon Sep 6 14:38:26 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ba9923d9bf7b1cc87486a23ff9cc2c57

Entrypoint Preview

Instruction
call 00007FAD4C743412h
jmp 00007FAD4C7408AAh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007FAD4C743E77h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007FAD4C740A29h
call 00007FAD4C741A0Fh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007FAD4C740B44h
test al, 40h
je 00007FAD4C740A1Fh
call 00007FAD4C7419F4h
mov dword ptr [eax], 00000022h
jmp 00007FAD4C7409F5h
push ebx
xor ebx, ebx
test al, 01h
je 00007FAD4C740A28h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007FAD4C740A9Dh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
test eax, 0000010Ch
jne 00007FAD4C740A3Eh
call 00007FAD4C742835h
add eax, 20h
cmp esi, eax
je 00007FAD4C740A1Eh
call 00007FAD4C742829h
add eax, 40h
cmp esi, eax
jne 00007FAD4C740A1Fh
push dword ptr [ebp+0Ch]
call 00007FAD4C743D98h
pop ecx
test eax, eax
jne 00007FAD4C740A19h
push esi
call 00007FAD4C743D44h
pop ecx
test dword ptr [esi+0Ch], 00000108h
push edi
je 00007FAD4C740A96h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xade4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x800	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xaaa8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x769a	0x7800	False	0.6081380208333333	data	6.443964684632098	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2666	0x2800	False	0.33583984375	data	4.80891912179072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x2ecc	0xe00	False	0.19559151785714285	data	2.2407790787477224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf000	0x1b4	0x200	False	0.490234375	data	5.097979088823027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xce2	0xe00	False	0.5027901785714286	data	4.656937952632236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xf058	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL

Import

KERNEL32.dll

OpenProcess, LocalAlloc, CreateEventA, LocalFree, GetLastError, InterlockedIncrement, ReadFile, WriteFile, DisconnectNamedPipe, InterlockedDecrement, SetEvent, CreateProcessA, WaitForSingleObject, GetExitCodeProcess, CreateNamedPipeA, ConnectNamedPipe, GetCurrentProcessId, CloseHandle, ExitThread, ResumeThread, CreateThread, GetCommandLineA, HeapSetInformation, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, IsProcessorFeaturePresent, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, SetLastError, GetCurrentThreadId, GetProcAddress, ExitProcess, HeapFree, Sleep, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, GetStartupInfoW, DeleteCriticalSection, HeapCreate, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryW, RtlUnwind, HeapAlloc, HeapReAlloc, SetStdHandle, WriteConsoleW, MultiByteToWideChar, LCMapStringW, GetStringTypeW, HeapSize, FlushFileBuffers, CreateFileW

ADVAPI32.dll

RegisterServiceCtrlHandlerA, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeleteService, SetServiceStatus, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, StartServiceCtrlDispatcherA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• RemComSvc.exe
• conhost.exe

Click to jump to process

Click to jump to process

Behavior

• RemComSvc.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	14:03:11
Start date:	18/10/2023
Path:	C:\Users\user\Desktop\RemComSvc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\RemComSvc.exe
Imagebase:	0x950000
File size:	49'664 bytes
MD5 hash:	25891CD0CF75100FDD544FB2FFDB3641
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RemComRemoteAdmin, Description: Yara detected RemCom RemoteAdmin tool, Source: 00000000.00000000.1977390117.0000000000959000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RemComRemoteAdmin, Description: Yara detected RemCom RemoteAdmin tool, Source: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:03:11
Start date:	18/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	1550
Total number of Limit Nodes:	14

Executed Functions

Function 00951540 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 202
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00951559
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 00951588
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00951598
GetLastError.KERNEL32 ref: 009515A2
LocalAlloc.KERNEL32(00000000,00000032), ref: 009515B5
GetLastError.KERNEL32 ref: 009515C1
FreeSid.ADVAPI32(?), ref: 009516F0
FreeSid.ADVAPI32(?), ref: 009516FA
LocalFree.KERNEL32(00000000), ref: 00951701
FindCloseChangeNotification.KERNELBASE(?), ref: 00951715
CloseHandle.KERNEL32(?), ref: 0095171F

Strings

2, xrefs: 0095156B

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: FreeProcess$CloseErrorLastLocalOpen$AllocChangeCurrentFindHandleNotificationToken
String ID: 2
API String ID: 608825413-450215437
Opcode ID: 06ea9af5303ad647815ce6577a4d2fd418f27cca8647594b5d86fe641b2a3168
Instruction ID: a741a3435e98c212c7d026ab95151d1d9b4c702ab57389571d06388dc65bec46
Opcode Fuzzy Hash: 06ea9af5303ad647815ce6577a4d2fd418f27cca8647594b5d86fe641b2a3168
Instruction Fuzzy Hash: 6F61F9B0A0131AEFEB10DFA6CC84BAFB7B8BF48342F244919E905A7250D7749D05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00951800 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00951540: GetCurrentProcessId.KERNEL32 ref: 00951559
Part of subcall function 00951540: OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 00951588
Part of subcall function 00951540: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00951598
Part of subcall function 00951540: GetLastError.KERNEL32 ref: 009515A2
Part of subcall function 00951540: FreeSid.ADVAPI32(?), ref: 009516F0
Part of subcall function 00951540: FreeSid.ADVAPI32(?), ref: 009516FA
Part of subcall function 00951540: LocalFree.KERNEL32(00000000), ref: 00951701
Part of subcall function 00951540: FindCloseChangeNotification.KERNELBASE(?), ref: 00951715
Part of subcall function 00951540: CloseHandle.KERNEL32(?), ref: 0095171F

_wprintf.LIBCMT ref: 00951840
StartServiceCtrlDispatcherA.ADVAPI32(RemComSvc), ref: 0095184C

Strings

RemComSvc, xrefs: 0095180A, 0095184B
A service Cannot be started directly., xrefs: 0095183B

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: FreeProcess$CloseOpen$ChangeCtrlCurrentDispatcherErrorFindHandleLastLocalNotificationServiceStartToken_wprintf
String ID: A service Cannot be started directly.$RemComSvc
API String ID: 2955876789-1801173105
Opcode ID: f92b2101731b35318db491d949ce3518a715f3609c67114fad119da463efe7cb
Instruction ID: 03b6d856f9b18591310943783ff2fbb3bc335d403a9d84f00aaf5a9016b2b9fe
Opcode Fuzzy Hash: f92b2101731b35318db491d949ce3518a715f3609c67114fad119da463efe7cb
Instruction Fuzzy Hash: CCE065B0C0120CEBDB10EFD6D90579EBBB8AB4030AF100094DC1962241E7B5570CCBD2

Uniqueness

Uniqueness Score: -1.00%

Function 009534D7 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 009534DF

Part of subcall function 009534AC: GetModuleHandleW.KERNEL32(mscoree.dll,?,009534E4,00955E50,?,00956791,000000FF,0000001E,00000001,00000000,00000000,?,00953B2A,00955E50,00000001,00955E50), ref: 009534B6
Part of subcall function 009534AC: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009534C6

ExitProcess.KERNEL32 ref: 009534E8

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 574067bd7f100814df3b202fdcc32836e5d19eb55043dc98188c2717f6fd8827
Instruction ID: 884429b8083df61fb60593e03ee83459eb218582cbc74c2f79065de1f32d0731
Opcode Fuzzy Hash: 574067bd7f100814df3b202fdcc32836e5d19eb55043dc98188c2717f6fd8827
Instruction Fuzzy Hash: 48B09B31014208BFDB012F13DC098493F16DBC03A17148010FC0845071DF71DD95D780

Uniqueness

Uniqueness Score: -1.00%

Function 009567F6 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00953B74,00955E50,?,00000000,00000000,00000000,?,0095312C,00000001,00000214,?,?), ref: 00956839

Part of subcall function 00952D74: __getptd_noexit.LIBCMT ref: 00952D74

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 021c98ae2dede6e6674df02f6bfe801e4e919fa9a21fe5a0689f944d697aa2c9
Instruction ID: e7521471794ed3a5b4d97a7663ed96aa8c8daf918a25735f61606815721f7198
Opcode Fuzzy Hash: 021c98ae2dede6e6674df02f6bfe801e4e919fa9a21fe5a0689f944d697aa2c9
Instruction Fuzzy Hash: 4301D4312117119BEF28DF27DC04B6A3768AB91763F448629ED15CB1E0DB30C808CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0095372F Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 0095373B

Part of subcall function 009535EF: __lock.LIBCMT ref: 009535FD
Part of subcall function 009535EF: DecodePointer.KERNEL32(0095ABC0,00000020,00953756,00955E50,00000001,00000000,?,00953796,000000FF,?,009560CE,00000011,00955E50,?,00953097,0000000D), ref: 00953639
Part of subcall function 009535EF: DecodePointer.KERNEL32(?,00953796,000000FF,?,009560CE,00000011,00955E50,?,00953097,0000000D), ref: 0095364A
Part of subcall function 009535EF: DecodePointer.KERNEL32(-00000004,?,00953796,000000FF,?,009560CE,00000011,00955E50,?,00953097,0000000D), ref: 00953670
Part of subcall function 009535EF: DecodePointer.KERNEL32(?,00953796,000000FF,?,009560CE,00000011,00955E50,?,00953097,0000000D), ref: 00953683
Part of subcall function 009535EF: DecodePointer.KERNEL32(?,00953796,000000FF,?,009560CE,00000011,00955E50,?,00953097,0000000D), ref: 0095368D

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: e896a324807b9de648b1385447de7623af73056ff8748e96d97f730106751e34
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: EBB0123258030C33DA202543EC03F063F0D87C0BA0F254061FE0C1D1E1BDA3BA66A1D9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00951000 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 130pipeCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0095101E
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 0095102E
_sprintf.LIBCMT ref: 0095107E
_sprintf.LIBCMT ref: 0095109A

Part of subcall function 00951856: __output_l.LIBCMT ref: 009518B1

_sprintf.LIBCMT ref: 009510B6

Part of subcall function 00951856: __flsbuf.LIBCMT ref: 009518CC

CreateNamedPipeA.KERNEL32(0095CDC8,00000002,00000004,000000FF,00000000,00000000,000000FF,0000000C), ref: 009510DC
CreateNamedPipeA.KERNEL32(0095CFD8,00000002,00000004,000000FF,00000000,00000000,000000FF,0000000C), ref: 009510F9
CreateNamedPipeA.KERNEL32(0095CED0,00000001,00000004,000000FF,00000000,00000000,000000FF,0000000C), ref: 00951116
ConnectNamedPipe.KERNEL32(?,00000000), ref: 00951137
ConnectNamedPipe.KERNEL32(?,00000000), ref: 0095113F
ConnectNamedPipe.KERNEL32(?,00000000), ref: 00951147
CloseHandle.KERNEL32(?), ref: 0095115C
CloseHandle.KERNEL32(?), ref: 00951162
CloseHandle.KERNEL32(?), ref: 00951168

Strings

RemCom_stdin, xrefs: 0095108B
RemCom_stderr, xrefs: 009510A7
\\.\pipe\%s%s%d, xrefs: 00951063, 00951090, 009510AC
RemCom_stdout, xrefs: 0095105B

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: NamedPipe$CloseConnectCreateHandle_sprintf$DescriptorSecurity$DaclInitialize__flsbuf__output_l
String ID: RemCom_stderr$RemCom_stdin$RemCom_stdout$\\.\pipe\%s%s%d
API String ID: 3004125193-627055030
Opcode ID: c5366be4f04be050db21e3d9c2564bc865040509368d0d931142793108b06e7d
Instruction ID: 76e623b9dfed0148517e43c6ea3e76141ca70e1b211fe313906b619e80c0fb22
Opcode Fuzzy Hash: c5366be4f04be050db21e3d9c2564bc865040509368d0d931142793108b06e7d
Instruction Fuzzy Hash: CB418371A84704BFE720DB668C46FA9B3B8EB88726F104659FB25A75D0D7F0B4448B50

Uniqueness

Uniqueness Score: -1.00%

Function 00951450 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,0095143B), ref: 0095145B
OpenServiceA.ADVAPI32(00000000,RemComSvc,000F01FF,759230D0,?,?,0095143B), ref: 00951473
CloseServiceHandle.ADVAPI32(00000000,?,?,0095143B), ref: 00951480
DeleteService.ADVAPI32(00000000,?,?,0095143B), ref: 0095148B
SetServiceStatus.ADVAPI32(00000000,0095D0E0,?,?,0095143B), ref: 009514BE
CloseServiceHandle.ADVAPI32(00000000,?,?,0095143B), ref: 009514CB
CloseServiceHandle.ADVAPI32(00000000,?,?,0095143B), ref: 009514CE

Strings

RemComSvc, xrefs: 0095146D

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$DeleteManagerStatus
String ID: RemComSvc
API String ID: 3691197935-1342256991
Opcode ID: 016b5deb85996b96ca7b2683e2ff1e22f0a6e91c1feacc9673eddf56ff81f526
Instruction ID: 99ba93c3d4b52ee147c7d2b5b439e70d871eebf8a3cbdb8639ff884cc4dcd40c
Opcode Fuzzy Hash: 016b5deb85996b96ca7b2683e2ff1e22f0a6e91c1feacc9673eddf56ff81f526
Instruction Fuzzy Hash: 86F0AE72615311EFD7209F77ECC8D9B3B68F749767700442AFA05D21A0C7744845BB60

Uniqueness

Uniqueness Score: -1.00%

Function 009518DA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00952E78
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00952E8D
UnhandledExceptionFilter.KERNEL32(009592DC), ref: 00952E98
GetCurrentProcess.KERNEL32(C0000409), ref: 00952EB4
TerminateProcess.KERNEL32(00000000), ref: 00952EBB

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: fa2981f8e28caa208b57ff944662f83e2013b94f888b29baf1836ae50922e557
Instruction ID: a701f297f68601885cd2a7278706bb11f4f9756843f2c04dff7b8866afa1be98
Opcode Fuzzy Hash: fa2981f8e28caa208b57ff944662f83e2013b94f888b29baf1836ae50922e557
Instruction Fuzzy Hash: 9121C0B442A304DFDB20DF67F9856447BB4BB09317F504419E928872A0E7709985EF96

Uniqueness

Uniqueness Score: -1.00%

Function 00953EBF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003E7D), ref: 00953EC4

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 84030c6d0423fafdf2b8536331b67e22aa45e69e9b7bd0557e74b05ec786d6c8
Instruction ID: f75ece2c07e668c4b87e2190678661ff36907e68414e8de41b9da4aeafcaebf3
Opcode Fuzzy Hash: 84030c6d0423fafdf2b8536331b67e22aa45e69e9b7bd0557e74b05ec786d6c8
Instruction Fuzzy Hash: 1B9002612A52448B560057725C0E50737E06B8964B7814C50A482C4094DB514108E751

Uniqueness

Uniqueness Score: -1.00%

Function 00953331 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00951C6F,0095AB50,00000014), ref: 00953339
__mtterm.LIBCMT ref: 00953345

Part of subcall function 00953010: DecodePointer.KERNEL32(00000002,009534A7,?,00951C6F,0095AB50,00000014), ref: 00953021
Part of subcall function 00953010: TlsFree.KERNEL32(00000001,009534A7,?,00951C6F,0095AB50,00000014), ref: 0095303B
Part of subcall function 00953010: DeleteCriticalSection.KERNEL32(00000000,00000000,76EE5810,?,009534A7,?,00951C6F,0095AB50,00000014), ref: 00955F94
Part of subcall function 00953010: _free.LIBCMT ref: 00955F97
Part of subcall function 00953010: DeleteCriticalSection.KERNEL32(00000001,76EE5810,?,009534A7,?,00951C6F,0095AB50,00000014), ref: 00955FBE

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0095335B
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00953368
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00953375
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00953382
TlsAlloc.KERNEL32(?,00951C6F,0095AB50,00000014), ref: 009533D2
TlsSetValue.KERNEL32(00000000,?,00951C6F,0095AB50,00000014), ref: 009533ED
__init_pointers.LIBCMT ref: 009533F7
EncodePointer.KERNEL32(?,00951C6F,0095AB50,00000014), ref: 00953408
EncodePointer.KERNEL32(?,00951C6F,0095AB50,00000014), ref: 00953415
EncodePointer.KERNEL32(?,00951C6F,0095AB50,00000014), ref: 00953422
EncodePointer.KERNEL32(?,00951C6F,0095AB50,00000014), ref: 0095342F
DecodePointer.KERNEL32(Function_00003194,?,00951C6F,0095AB50,00000014), ref: 00953450
__calloc_crt.LIBCMT ref: 00953465
DecodePointer.KERNEL32(00000000,?,00951C6F,0095AB50,00000014), ref: 0095347F
GetCurrentThreadId.KERNEL32 ref: 00953491

Strings

FlsGetValue, xrefs: 0095335D
FlsFree, xrefs: 00953377
FlsAlloc, xrefs: 00953355
FlsSetValue, xrefs: 0095336A
KERNEL32.DLL, xrefs: 00953334

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 0af0b47fdf295e72a762711a8d1031b6ee7cc961595458c040f83c04e2fe1d61
Instruction ID: 01f02595596470fa8328931e86585eb42add6833ce661b1c08c8d480087dffdb
Opcode Fuzzy Hash: 0af0b47fdf295e72a762711a8d1031b6ee7cc961595458c040f83c04e2fe1d61
Instruction Fuzzy Hash: 56317031829310DFD731EF77AC496193FA9AB843A7B104516E808C31F0EB75A589EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00951180 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 96processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009511A6

Part of subcall function 00951000: InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0095101E
Part of subcall function 00951000: SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 0095102E
Part of subcall function 00951000: _sprintf.LIBCMT ref: 0095107E
Part of subcall function 00951000: _sprintf.LIBCMT ref: 0095109A
Part of subcall function 00951000: _sprintf.LIBCMT ref: 009510B6
Part of subcall function 00951000: CreateNamedPipeA.KERNEL32(0095CDC8,00000002,00000004,000000FF,00000000,00000000,000000FF,0000000C), ref: 009510DC
Part of subcall function 00951000: CreateNamedPipeA.KERNEL32(0095CFD8,00000002,00000004,000000FF,00000000,00000000,000000FF,0000000C), ref: 009510F9
Part of subcall function 00951000: CreateNamedPipeA.KERNEL32(0095CED0,00000001,00000004,000000FF,00000000,00000000,000000FF,0000000C), ref: 00951116
Part of subcall function 00951000: ConnectNamedPipe.KERNEL32(?,00000000), ref: 00951137

_sprintf.LIBCMT ref: 009511FC
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,?,00000000,?,00000044,?), ref: 00951243
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00951267
GetExitCodeProcess.KERNEL32(?,?), ref: 0095126F

Strings

D, xrefs: 009511B3
cmd.exe /q /c "%s", xrefs: 009511E6

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: CreateNamedPipe_sprintf$DescriptorProcessSecurity$CodeConnectDaclExitInitializeObjectSingleWait_memset
String ID: D$cmd.exe /q /c "%s"
API String ID: 3348913544-2994407908
Opcode ID: 1aa64b6edf6b4c68fff336ec37df895432b3cf83b2e285e4182fe50a625938a0
Instruction ID: a087b7330363f0e55efb742ee3e0882aad12809218392a3e547a25edb756bdde
Opcode Fuzzy Hash: 1aa64b6edf6b4c68fff336ec37df895432b3cf83b2e285e4182fe50a625938a0
Instruction Fuzzy Hash: F531C771A14218ABDB20DF65DC42BEBB3BCEB58312F1041D9FA09971C0D7B56A88CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00951A62 Relevance: 12.1, APIs: 8, Instructions: 66threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00951A88
__calloc_crt.LIBCMT ref: 00951A94
__getptd.LIBCMT ref: 00951AA1
CreateThread.KERNEL32(00000000,?,00951A09,00000000,00000004,00000000), ref: 00951AC8
ResumeThread.KERNEL32(00000000,?,00951406,Function_000012B0,00000000,00000000), ref: 00951AD8
GetLastError.KERNEL32(?,00951406,Function_000012B0,00000000,00000000), ref: 00951AE3
_free.LIBCMT ref: 00951AEC
__dosmaperr.LIBCMT ref: 00951AF7

Part of subcall function 00952D74: __getptd_noexit.LIBCMT ref: 00952D74

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 3638380555-0
Opcode ID: 4943f00bf5bb019f3de752bca9c03d8134af275f3ed3eec59f2a4d176bb23175
Instruction ID: 13d86f53179594b6e3fed9c8403f0c43e4d5c1192a22567d7ee5dfd2b81effbc
Opcode Fuzzy Hash: 4943f00bf5bb019f3de752bca9c03d8134af275f3ed3eec59f2a4d176bb23175
Instruction Fuzzy Hash: AD11E932106700ABD722EBB79C45B6B7768DFC2773F154616FD28871D1DB7589088361

Uniqueness

Uniqueness Score: -1.00%

Function 009512B0 Relevance: 10.6, APIs: 7, Instructions: 59filepipeCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(0095CDC0), ref: 009512D0
ReadFile.KERNEL32(?,?,00001214,?,00000000), ref: 009512F9
WriteFile.KERNEL32(?,?,00000008,?,00000000), ref: 0095133B
DisconnectNamedPipe.KERNEL32(?), ref: 00951342
CloseHandle.KERNEL32(?), ref: 00951349
InterlockedDecrement.KERNEL32(0095CDC0), ref: 00951354
SetEvent.KERNEL32(00000000), ref: 0095136A

Part of subcall function 00951180: _memset.LIBCMT ref: 009511A6

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: FileInterlocked$CloseDecrementDisconnectEventHandleIncrementNamedPipeReadWrite_memset
String ID:
API String ID: 767879101-0
Opcode ID: d5f396bd35b44a249bad3b6329e5a30f48ec895f6706b7ed976984a6e5b81681
Instruction ID: 5a056da34e6122f571d5b047fa80430c1f536488ca591660d44b7b8ab4e6926c
Opcode Fuzzy Hash: d5f396bd35b44a249bad3b6329e5a30f48ec895f6706b7ed976984a6e5b81681
Instruction Fuzzy Hash: 70114771950318EFDB10DBA6EC09BEE77B8EB48302F004595F909D6090EB70AA58CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0095304D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0095AB70,00000008,00953155,00000000,00000000,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 0095305E
__lock.LIBCMT ref: 00953092

Part of subcall function 009560A7: __mtinitlocknum.LIBCMT ref: 009560BD
Part of subcall function 009560A7: __amsg_exit.LIBCMT ref: 009560C9
Part of subcall function 009560A7: EnterCriticalSection.KERNEL32(00955E50,00955E50,?,00953097,0000000D), ref: 009560D1

InterlockedIncrement.KERNEL32(2464F7C6), ref: 0095309F
__lock.LIBCMT ref: 009530B3
___addlocaleref.LIBCMT ref: 009530D1

Strings

KERNEL32.DLL, xrefs: 00953059

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 2c22211f9fd441f3cfdd1dc52d055b00e596d5b6c5f1a8cc2b4a37bb090181ef
Instruction ID: cf092434ef5567c70d039c62a109f175669f10b1fd9723b6df769a8d03b6ac4f
Opcode Fuzzy Hash: 2c22211f9fd441f3cfdd1dc52d055b00e596d5b6c5f1a8cc2b4a37bb090181ef
Instruction Fuzzy Hash: F6015BB1444B00EFE720DF77D806759BBE0AF90326F10890AE899572E1CBB4A648CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00955415 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00955421

Part of subcall function 0095317A: __getptd_noexit.LIBCMT ref: 0095317D
Part of subcall function 0095317A: __amsg_exit.LIBCMT ref: 0095318A

__amsg_exit.LIBCMT ref: 00955441
__lock.LIBCMT ref: 00955451
InterlockedDecrement.KERNEL32(?), ref: 0095546E
_free.LIBCMT ref: 00955481
InterlockedIncrement.KERNEL32(00EC1670), ref: 00955499

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 5a96c5b1b4b7d193136f866873f8ba1a37be012443373db60c2778714bc82508
Instruction ID: 629a0ff8f44503a59fffb698eb0839905c09a52b6616b2538f38570febfc1b75
Opcode Fuzzy Hash: 5a96c5b1b4b7d193136f866873f8ba1a37be012443373db60c2778714bc82508
Instruction Fuzzy Hash: 0C01AD71905B10AFCB21EF67982676A77A4AB40763F068405EC00672A2C7346DC9DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00951380 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48pipeCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 009513AA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000001), ref: 009513B6
CreateNamedPipeA.KERNEL32(\\.\pipe\RemCom_communicaton,00000003,00000004,000000FF,00000000,00000000,000000FF,00000000), ref: 009513E4
ConnectNamedPipe.KERNEL32(00000000,00000000), ref: 009513F3

Strings

\\.\pipe\RemCom_communicaton, xrefs: 009513CE

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: DescriptorNamedPipeSecurity$ConnectCreateDaclInitialize
String ID: \\.\pipe\RemCom_communicaton
API String ID: 82124186-1156804775
Opcode ID: 4891e749428a8025ce812156af2ce7f265a6b2dea2c478cc4bc740fce0821692
Instruction ID: 50ee487a10617895ed8939e79110b3934edcb572dc42b521d4ed18e646c6d2f2
Opcode Fuzzy Hash: 4891e749428a8025ce812156af2ce7f265a6b2dea2c478cc4bc740fce0821692
Instruction Fuzzy Hash: 29017171D44318FBFB20DBA68C46FEDBBB8AB48B11F104115FA14BA1C0E7B466448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00951750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Service,Function_000014E0), ref: 00951793
SetServiceStatus.ADVAPI32(00000000,0095D0E0), ref: 009517BE
GetLastError.KERNEL32 ref: 009517C8
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 009517D6

Strings

Service, xrefs: 00951758

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Service$CreateCtrlErrorEventHandlerLastRegisterStatus
String ID: Service
API String ID: 2753365956-773890894
Opcode ID: a1124136ab18095916404d0a4509fa4e2f72234dd0f9a9bc2a13f4768c153ac1
Instruction ID: 691029e0bef475106a7d39a84d81e9c882a8a118007a688280538979946e40cc
Opcode Fuzzy Hash: a1124136ab18095916404d0a4509fa4e2f72234dd0f9a9bc2a13f4768c153ac1
Instruction Fuzzy Hash: A801ECB052B321DBD370DF37AC09B873E68E755767F10440AF915862E0E374404AEBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00956878 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00956886

Part of subcall function 00956762: __FF_MSGBANNER.LIBCMT ref: 0095677B
Part of subcall function 00956762: __NMSG_WRITE.LIBCMT ref: 00956782
Part of subcall function 00956762: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00953B2A,00955E50,00000001,00955E50,?,00956032,00000018,0095AC80,0000000C,009560C2), ref: 009567A7

_free.LIBCMT ref: 00956899

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 4eea3845fe2ae00da1104beab0adbd9757eadc615b61ce7227d0d922ab970947
Instruction ID: b9ab5e492fb2d640bc93cb215b4ffd026c2be17dc06b188c8d2c82292f111bae
Opcode Fuzzy Hash: 4eea3845fe2ae00da1104beab0adbd9757eadc615b61ce7227d0d922ab970947
Instruction Fuzzy Hash: D7119432404715ABCF35EB77EC0476937A9AB913B3B644925FD48971A0DB388C889750

Uniqueness

Uniqueness Score: -1.00%

Function 00955B96 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00955BA2

Part of subcall function 0095317A: __getptd_noexit.LIBCMT ref: 0095317D
Part of subcall function 0095317A: __amsg_exit.LIBCMT ref: 0095318A

__getptd.LIBCMT ref: 00955BB9
__amsg_exit.LIBCMT ref: 00955BC7
__lock.LIBCMT ref: 00955BD7
__updatetlocinfoEx_nolock.LIBCMT ref: 00955BEB

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 8d5ea6c76225bef7c0eaad488ef686343f223ba8f1cabef2e3e3293053b47f04
Instruction ID: 4a4595d01968d88f1efe25dabc4aa56cf5754a516c438991d512c12c4b7323b1
Opcode Fuzzy Hash: 8d5ea6c76225bef7c0eaad488ef686343f223ba8f1cabef2e3e3293053b47f04
Instruction Fuzzy Hash: DBF09072904B009FD721FB779827B1D77A0AF80763F228109FC106B2D3CB644A489B55

Uniqueness

Uniqueness Score: -1.00%

Function 00951A09 Relevance: 7.5, APIs: 5, Instructions: 29threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00951A0E

Part of subcall function 00952FBF: TlsGetValue.KERNEL32(?,00953118,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00952FC8
Part of subcall function 00952FBF: DecodePointer.KERNEL32(?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00952FDA
Part of subcall function 00952FBF: TlsSetValue.KERNEL32(00000000,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00952FE9

Part of subcall function 00952F9F: TlsGetValue.KERNEL32(?,?,00951A1E,00000000), ref: 00952FAD

___fls_setvalue@8.LIBCMT ref: 00951A2B

Part of subcall function 00952FF3: DecodePointer.KERNEL32(?,?,?,00951A30,00000000,?,00000000), ref: 00953004

GetLastError.KERNEL32(00000000,?,00000000), ref: 00951A34
ExitThread.KERNEL32 ref: 00951A3B
__freefls@4.LIBCMT ref: 00951A57

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Value$DecodePointer$ErrorExitLastThread___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1318250341-0
Opcode ID: 8b2c3c50fb3d31722239ce826fff85633d7a09d59dba1aac355f53a05014ac9e
Instruction ID: 21d7f68e5d9c79b5cd668e63e549200d67fd46b9d3c7e0bb1a8841f59e769a38
Opcode Fuzzy Hash: 8b2c3c50fb3d31722239ce826fff85633d7a09d59dba1aac355f53a05014ac9e
Instruction Fuzzy Hash: 49F01C78505740AFDB08FF73D989A0EBFB9AFC93067208554BD0887226DA34D84A9B90

Uniqueness

Uniqueness Score: -1.00%

Function 00957180 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009571B4
__isleadbyte_l.LIBCMT ref: 009571E7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,?,?,00000000,?,?,?), ref: 00957218
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000,?,?,?), ref: 00957286

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e2407794eb3cdf67f9edeaaac6a343c186f28d02e68538ca02c009e03b18774d
Instruction ID: cbb7f33beb0758518c377978d7a8f66e33cb14c4721819968d9748a5d94dc8dc
Opcode Fuzzy Hash: e2407794eb3cdf67f9edeaaac6a343c186f28d02e68538ca02c009e03b18774d
Instruction Fuzzy Hash: 1231B53150C246EFDB21DFE6DC84A7ABBB9AF41312F158569F8608B191D730DE48DB50

Uniqueness

Uniqueness Score: -1.00%

Function 009519FD Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00953745: _doexit.LIBCMT ref: 00953751

___set_flsgetvalue.LIBCMT ref: 00951A0E

Part of subcall function 00952FBF: TlsGetValue.KERNEL32(?,00953118,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00952FC8
Part of subcall function 00952FBF: DecodePointer.KERNEL32(?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00952FDA
Part of subcall function 00952FBF: TlsSetValue.KERNEL32(00000000,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00952FE9

Part of subcall function 00952F9F: TlsGetValue.KERNEL32(?,?,00951A1E,00000000), ref: 00952FAD

___fls_setvalue@8.LIBCMT ref: 00951A2B

Part of subcall function 00952FF3: DecodePointer.KERNEL32(?,?,?,00951A30,00000000,?,00000000), ref: 00953004

GetLastError.KERNEL32(00000000,?,00000000), ref: 00951A34
ExitThread.KERNEL32 ref: 00951A3B
__freefls@4.LIBCMT ref: 00951A57

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: Value$DecodePointer$ErrorExitLastThread___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 2004460516-0
Opcode ID: 4a6126b6ef99814b4aa64e69ac67a06ac04e50fb14edded1bc5bef8fe68d1650
Instruction ID: 1cf8b49895cf666ab6778b65d232c0b11896c29da913e9e2a3980ccae8364640
Opcode Fuzzy Hash: 4a6126b6ef99814b4aa64e69ac67a06ac04e50fb14edded1bc5bef8fe68d1650
Instruction Fuzzy Hash: 63E0EC74909305BBDF41BBB3AC4AB5E7F3C5EC5343B104810BE14D2016EA74D8195BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0095199B Relevance: 6.0, APIs: 4, Instructions: 16threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0095199E

Part of subcall function 00953101: GetLastError.KERNEL32(?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00953105
Part of subcall function 00953101: ___set_flsgetvalue.LIBCMT ref: 00953113
Part of subcall function 00953101: __calloc_crt.LIBCMT ref: 00953127
Part of subcall function 00953101: DecodePointer.KERNEL32(00000000,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 00953141
Part of subcall function 00953101: GetCurrentThreadId.KERNEL32 ref: 00953157
Part of subcall function 00953101: SetLastError.KERNEL32(00000000,?,?,00953182,?,00951ED6,?,?,00955E50,?), ref: 0095316F

CloseHandle.KERNEL32(?,?,009519E9), ref: 009519B2
__freeptd.LIBCMT ref: 009519B9
ExitThread.KERNEL32 ref: 009519C1

Memory Dump Source

Source File: 00000000.00000002.1980530493.0000000000951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1980399025.0000000000950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980544340.0000000000959000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980558910.000000000095C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1980572857.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_RemComSvc.jbxd

Yara matches

Similarity

API ID: ErrorLastThread$CloseCurrentDecodeExitHandlePointer___set_flsgetvalue__calloc_crt__freeptd__getptd_noexit
String ID:
API String ID: 2242352317-0
Opcode ID: e4f1d15b89d80fbc02303a86c34cd460f3fe5dcedc643ae72e14b297f0549651
Instruction ID: 62b0bbb5312dee8ef3cbef0938dd143f9b024eded0f800948de1cc0ccae13b9f
Opcode Fuzzy Hash: e4f1d15b89d80fbc02303a86c34cd460f3fe5dcedc643ae72e14b297f0549651
Instruction Fuzzy Hash: 5FD0A73150EE1067D321A3765C2DB5E36195F80733B140B00FD35C61D0CB28DD454390

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RemComSvc.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: RemComSvc.exePID: 6544, Parent PID: 1028

General

File Activities

File Opened

File Created

Windows Analysis Report
RemComSvc.exe

Function 00951540 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 202
memoryCOMMON