39848daa — remcos v1.7 Pro (Jan 2017)

Status: static-only (CAPE skipped: no Windows guest). Triage confidence high.

Build / RE

Toolchain & Language

MSVC 14.00 C++ GUI PE32, compiled 04 Jan 2017 06:11:39 UTC. Standard MSVCP60.dll STL (std::basic_string<char>, std::ios_base). GUI subsystem, 4 sections (.text .rdata .data .rsrc), no TLS or exception handlers. ^[pefile.txt:1] ^[triage.json]

Packing / Obfuscation

None. Entropy ~5.15; strings, imports, and rich-header intact. No UPX, VMProtect, or .NET obfuscator signatures. Builder is believed to emit plaintext C++ source compiled with a fixed legacy toolchain; every v1.7 Pro sample in this cluster shows the same linker/compiler stamps and import table. ^[pefile.txt]

Anti-Analysis

Weak sandbox string evasion only. Hardcoded blacklist substrings for VBOX, VMWARE, SANDBOX, VIRUS, MALWARE checked against process list or window titles. No debugger/VM register checks, no timing traps, no API obfuscation. Easily defeated by renaming the analysis host. ^[strings.txt:188] ^[strings.txt:194]

Embedded Resources

VS_VERSIONINFO present — FileDescription WinRAR, InternalName WinRAR, OriginalFilename WinRAR.exe. Masquerades as WinRAR self-extractor.

RCData resource SETTINGS is 803 bytes (offset 0x16DA4, size 0x323) — the largest encrypted config blob observed in this v1.7 cluster (previous record was 593 bytes for c6193af6, 616 bytes for 6114904c). Low entropy distribution (max byte frequency 9 across 803 bytes) indicates XOR or single-byte-add substitution rather than strong crypto. Likely decrypts in-memory to a semicolon-delimited key=value map identical to the plaintext .ini-style configs documented in other Remcos versions. ^[pefile.txt:264] ^[xxd:0x16DA4]

Second resource 6962/icon at offset 0x160FC (size 0xCA8 / 3240 bytes) is compressed/encoded — very high byte-frequency skew (max 757 repeats), suggesting run-length, simple XOR, or icon-specific bit-packed encoding rather than standard .ico. The resource directory labels it ICON type, so decoding may produce a real icon used for social-engineering decoys. ^[xxd:0x160FC]

Signing

Unsigned. Certificate table size zero. ^[pefile.txt:28]

Notable Functions

Entrypoint entry0 at 0x00401000 is tiny (≈12 instructions); standard MSVC __security_init_cookie then tail-jumps to WinMainCRTStartup. No custom unpacking stub here. Real work begins in WinMainCRTStartup/WinMain lower in .text (addresses not yet resolved in radare2 with analysis level 3). Future decompiles should focus on 0x00407452 and onward for the RCData loader and the C2 framing loop.

Deploy / ATT&CK

All TTPs below are inferred statically only; no dynamic detonation available. Where dynamic-analysis.md exists in sibling samples, runtime behaviours match identically.

Persistence

• T1547.001 — Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run registry key appears in decoded strings, used to relaunch the payload on boot/login. ^[strings.txt:215]
• T1547.004 — Userinit value in decoded strings for Winlogon hijack. ^[strings.txt:213]

Privilege Escalation

• T1548.002 — eventvwr.exe and mscfile references confirm the auto-elevated event viewer COM handler hijack (Forshaw UAC bypass) shipped in this builder version. ^[strings.txt:216] ^[strings.txt:217]
• Disable-UAC fallback: EnableLUA registry-write capability present via RegSetValueExA. ^[pefile.txt:198]

Credential Access

• T1555.003 — Browser credential theft (Chrome, Firefox, Internet Explorer storage paths) referenced in strings. ^[strings.txt:179] ^[strings.txt:181]

Collection

• T1056.001 / T1056.002 — Keylogging via SetWindowsHookExA (WH_KEYBOARD_LL); clipboard capture via standard clipboard APIs. ^[strings.txt:146] ^[strings.txt:170]
• T1113 — StretchBlt + BitBlt + GDIPlus GdipCreateBitmapFromScan0 for screen capture. ^[strings.txt:151] ^[strings.txt:153] ^[strings.txt:155]
• T1123 — waveInOpen / waveInStart microphone recording. ^[strings.txt:160] ^[strings.txt:162]
• T1125 — capGetVideoFormat / capCaptureSequence webcam capture. ^[strings.txt:164] ^[strings.txt:166]

Command & Control

• T1071.001 — Raw TCP sockets (WSASocketA, WSAConnect). C2 frame delimiter [DataStart] visible in plaintext strings. ^[strings.txt:136]
• Keep-alive / heartbeat mechanism implied by GetTickCount and recurring Sleep calls in import table. ^[pefile.txt:176]
• T1105 — URLDownloadToFileA + InternetOpenUrlA fallback for payload updates or secondary-stage retrieval. ^[strings.txt:138] ^[strings.txt:140]

Defense Evasion

• T1562.001 — Sandbox/host-name string checks (VBOX, VMWARE, etc.); exits or sleeps if matched. ^[strings.txt:188] ^[strings.txt:194]
• Mutex singleton: Remcos_Mutex_Inj hardcoded in import initialization path. Prevents concurrent instances. ^[strings.txt:134]
• T1055 — NtUnmapViewOfSection imported; consistent with process-hollowing engine observed in sibling sample 4818d00f (injecting decoded payload into a suspended child process). No dynamic confirmation here, but the API presence + family knowledge makes this highly probable. ^[pefile.txt:167]

Attribution Evidence

Builder branding identical to v1.7 Pro Jan 2017 cluster: same compilation date, same SETTINGS RCData schema, same Remcos_Mutex_Inj mutex, same MSVCP60 imports. Filename Backdoor.exe is the builder default before operator customization; paired with WinRAR masquerade resources suggests either lazy operator or rapid copy-paste deployment. No novel infrastructure or linguistic artifacts in this sample — a commodity Remcos drop from a well-documented MaaS kit.

Summary

39848daa is a textbook Remcos v1.7 Pro build from January 2017. Identical compiler fingerprint, import table, and string profile to the established corpus cluster (0f723826, 6114904c, c6193af6, d9950b15). Its only differentiator is an unusually large 803-byte encrypted SETTINGS RCData blob (vs the typical 245–593 bytes), suggesting either additional C2 hosts, extended keylogger options, or a newer builder config schema. Everything else — masquerade, persistence, UAC bypass, collection, and C2 mechanics — is stock Remcos.