Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

jcXViWLNuc.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.562026880509969
Filename:	jcXViWLNuc.exe
Filesize:	440320
MD5:	a8ca71060dae68d7ae75ea3156301407
SHA1:	9e116e2ce2a01fdbc2587725fa5261b26758fc77
SHA256:	9701b7e2c0cd3f562f2b817e94993309429963d2cec3424e7f77345f31ded0ae
SHA512:	2adae876a6db5ac8ef80357b1c8f2b28348fdb20fd5c14bc02275cd5bd416550d518b7b65c07429a2e049fa9feb346db4667d53b3b6f799a9581089bd0f813c2
SSDEEP:	6144:VCJBSkHyP4DivRrO+d3cyU6320ho4nbJAj0N91EU7ZUFbz68AO2ZjXH76crV6B3:VCJB/RuFhU6ho0ej0N91HFAAZ77iB3
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............,...,...,MEj,...,MEh,X..,MEi,...,...,...,gy\,...,T..-...,T..-...,T..-...,...,...,...,...,N..-...,N.d,...,N..-...,Rich...

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Found malware configuration	AV Detection	Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery Ingress Tool Transfer
Machine Learning detection for sample	AV Detection
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery Ingress Tool Transfer
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation Security Software Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion	Security Software Discovery
Found evasive API chain (may stop execution after accessing registry keys)	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
Uses 32bit PE files	Compliance, System Summary
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information Security Software Discovery
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation System Time Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Might use command line arguments	System Summary
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Public key (encryption) found	Cryptography	Account Discovery Security Software Discovery System Owner/User Discovery Archive Collected Data
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

\Device\ConDrv

ISO-8859 text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\jcXViWLNuc.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.6858370653291965
Encrypted:	false
Ssdeep:	96:U5d9n9X9LHhyyCR3j8hORxsnJNK+Mfz74nx4:Y9njD8yKznxsnJNK17si
Size:	8899
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\jcXViWLNuc.exe

"C:\Users\user\Desktop\jcXViWLNuc.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7836
Target ID:	1
Parent PID:	4084
Name:	jcXViWLNuc.exe
Path:	C:\Users\user\Desktop\jcXViWLNuc.exe
Commandline:	"C:\Users\user\Desktop\jcXViWLNuc.exe"
Size:	440320
MD5:	A8CA71060DAE68D7AE75EA3156301407
Time:	02:25:39
Date:	02/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	479232
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7856
Target ID:	2
Parent PID:	7836
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	02:25:39
Date:	02/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6ee680000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

127.0.0.1

http://geoplugin.net/json.gp

unknown

http://geoplugin.net/json.gp/C

unknown

IPs

Domain

Country

Malicious

127.0.0.1

unknown

Details

IP:	127.0.0.1
TargetID:	1
Current Path:	C:\Users\user\Desktop\jcXViWLNuc.exe
Private:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-MG8NXC

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-MG8NXC

time

Memdumps

Base Address

Regiontype

Protect

Malicious

44D000

unkown

page readonly

44D000

unkown

page readonly

81E000

heap

page read and write

464000

unkown

page write copy

690000

heap

page read and write

401000

unkown

page execute read

401000

unkown

page execute read

23AB000

stack

page read and write

650000

heap

page read and write

46B000

unkown

page readonly

22AF000

stack

page read and write

670000

heap

page read and write

81A000

heap

page read and write

9C000

stack

page read and write

1F0000

heap

page read and write

A0F000

stack

page read and write

800000

heap

page read and write

400000

unkown

page readonly

600000

heap

page read and write

550000

heap

page read and write

680000

heap

page read and write

24AF000

stack

page read and write

46B000

unkown

page readonly

810000

heap

page read and write

19D000

stack

page read and write

7FE000

stack

page read and write

400000

unkown

page readonly

675000

heap

page read and write

64E000

stack

page read and write

7BC000

stack

page read and write

464000

unkown

page read and write

5AE000

stack

page read and write

467000

unkown

page read and write

There are 23 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
jcXViWLNuc.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportjcXViWLNuc.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
jcXViWLNuc.exe