Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Shipping documents PO 16103 INV.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	7.218568267888465
Filename:	Shipping documents PO 16103 INV.exe
Filesize:	2672640
MD5:	671423091cbffb473016291d68a5b49b
SHA1:	07f1a0c895fa372f6043fbf013b78321a6939193
SHA256:	31fdf75cd3cf71f770eb158141183b08ed0845b27ecd2e90ce20eb3c4e4642c0
SHA512:	23782fee548af5a284ac9d833041604a4e1965df0c7f7bad6f4eaa7c1f13a0712c2d3218b868c06cb7779df57ec2f79fdb1dcc1b9f951cda95fa095e925f486e
SSDEEP:	49152:Qg7eO7kjTav5AwVZGKY3uS+s1vm1lOt+2QpTay:F7lQfjQd
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$n.K$n.K$n.K...J-n.K...J(n.K...J.n.K-.Kn.Ko..J-n.K$n.K.n.K...J/n.K...J`n.K$n.K%n.K7..J%n.K7.FK%n.K7..J%n.KRich$n.K.......

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Process Injection
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Security Software Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Native API Software Packing
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to register its own exception handler	Anti Debugging
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Process Injection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a high image base, often used for DLLs	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\ProgramData\remcos\logs.dat

data

dropped

Details

File:	C:\ProgramData\remcos\logs.dat
Category:	dropped
Dump:	logs.dat.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Type:	data
Entropy:	3.38816599775145
Encrypted:	false
Ssdeep:	3:rhlKlVjfOlWEQFb5JWRal2Jl+7R0DAlBG45klovDl6v:6lVClpQFb5YcIeeDAlOWAv
Size:	144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json
Category:	dropped
Dump:	json[1].json.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Type:	JSON data
Entropy:	5.013130376969173
Encrypted:	false
Ssdeep:	12:tklu+mnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdVauKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Temp\bhvC750.tmp

Extensible storage user DataBase, version 0x620, checksum 0x3b6fe592, page size 32768, DirtyShutdown, Windows version 10.0

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\bhvC750.tmp
Category:	dropped
Dump:	bhvC750.tmp.6.dr
ID:	dr_2
Target ID:	6
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Type:	Extensible storage user DataBase, version 0x620, checksum 0x3b6fe592, page size 32768, DirtyShutdown, Windows version 10.0
Entropy:	1.0235410987242815
Encrypted:	false
Ssdeep:	6144:7vQPYV7AyUO+xBGA611GJxBGA611Gv0M6JKX3XX35X3khTAvhTA/hTATX3t8nqks:wyUt3F0TkT0TAitKxK9JdIC4Ago
Size:	17301504
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\vunykblr

Unicode text, UTF-16, little-endian text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\vunykblr
Category:	dropped
Dump:	vunykblr.6.dr
ID:	dr_3
Target ID:	6
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Entropy:	1.0
Encrypted:	false
Ssdeep:	3:Qn:Qn
Size:	2
Whitelisted:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Shipping documents PO 16103 INV.exe

"C:\Users\user\Desktop\Shipping documents PO 16103 INV.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5896
Target ID:	0
Parent PID:	4004
Name:	Shipping documents PO 16103 INV.exe
Path:	C:\Users\user\Desktop\Shipping documents PO 16103 INV.exe
Commandline:	"C:\Users\user\Desktop\Shipping documents PO 16103 INV.exe"
Size:	2672640
MD5:	671423091CBFFB473016291D68A5B49B
Time:	17:54:54
Date:	26/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff694860000
Modulesize:	3137536
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Initial sample is a PE file and has a suspicious name	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a high image base, often used for DLLs	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Details

Is windows:	true
Is dropped:	false
PID:	3212
Target ID:	4
Parent PID:	5896
Name:	AddInProcess32.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Size:	43008
MD5:	9827FF3CDF4B83F9C86354606736CA9C
Time:	17:54:55
Date:	26/07/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xb70000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found strings which match to known social media urls	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\vunykblr"

Details

Is windows:	true
Is dropped:	false
PID:	3088
Target ID:	6
Parent PID:	3212
Name:	AddInProcess32.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\vunykblr"
Size:	43008
MD5:	9827FF3CDF4B83F9C86354606736CA9C
Time:	17:54:57
Date:	26/07/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7d0000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found strings which match to known social media urls	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\xosqltwlown"

Details

Is windows:	true
Is dropped:	false
PID:	2828
Target ID:	7
Parent PID:	3212
Name:	AddInProcess32.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\xosqltwlown"
Size:	43008
MD5:	9827FF3CDF4B83F9C86354606736CA9C
Time:	17:54:57
Date:	26/07/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x340000
Modulesize:	49152
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found strings which match to known social media urls	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\xosqltwlown"

Details

Is windows:	true
Is dropped:	false
PID:	3896
Target ID:	8
Parent PID:	3212
Name:	AddInProcess32.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\xosqltwlown"
Size:	43008
MD5:	9827FF3CDF4B83F9C86354606736CA9C
Time:	17:54:57
Date:	26/07/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x9e0000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found strings which match to known social media urls	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\hqgjmdgmcefhebf"

Details

Is windows:	true
Is dropped:	false
PID:	5368
Target ID:	9
Parent PID:	3212
Name:	AddInProcess32.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\user\AppData\Local\Temp\hqgjmdgmcefhebf"
Size:	43008
MD5:	9827FF3CDF4B83F9C86354606736CA9C
Time:	17:54:57
Date:	26/07/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xb90000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found strings which match to known social media urls	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1472
Target ID:	2
Parent PID:	5896
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	17:54:54
Date:	26/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff66e660000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"

Details

Is windows:	true
Is dropped:	false
PID:	3516
Target ID:	3
Parent PID:	5896
Name:	MSBuild.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Size:	262432
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
Time:	17:54:55
Date:	26/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

178.23.190.118

http://geoplugin.net/json.gp$

unknown

https://www.office.com/

unknown

http://www.imvu.comr

unknown

https://aefd.nelreports.net/api/report?cat=bingth

unknown

https://aka.ms/nativeaot-c

unknown

https://login.li

unknown

https://aka.ms/nativeaot-compatibilityy

unknown

http://www.imvu.com

unknown

https://aefd.nelreports.net/api/report?cat=wsb

unknown

http://www.nirsoft.net

unknown

https://aefd.nelreports.net/api/report?cat=bingaotak

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

http://geoplugin.net/json.gp

178.237.33.50

https://www.google.com

unknown

https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL

unknown

https://aefd.nelreports.net/api/report?cat=bingaot

unknown

http://geoplugin.net/json.gp/C

unknown

https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat

unknown

https://aka.ms/nativeaot-compatibility

unknown

https://aka.ms/nativeaot-compatibilityY

unknown

https://aka.ms/nativeaot-compatibilityX

unknown

https://aefd.nelreports.net/api/report?cat=bingrms

unknown

https://www.google.com/accounts/servicelogin

unknown

https://aka.ms/GlobalizationInvariantMode

unknown

https://login.yahoo.com/config/login

unknown

http://www.nirsoft.net/

unknown

https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&

unknown

http://www.ebuddy.com

unknown

There are 21 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

178.23.190.118

unknown

Details

IP:	178.23.190.118
TargetID:	4
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
ASN number:	196724
ASN name:	LYNERO-ASDK
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

178.237.33.50

geoplugin.net

Netherlands

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-SJ9MVF

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-SJ9MVF

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-SJ9MVF

time

Memdumps

Base Address

Regiontype

Protect

Malicious

1077000

heap

page read and write

400000

remote allocation

page execute and read and write

21724562000

direct allocation

page read and write

10C2000

heap

page read and write

2DDE000

stack

page read and write

2F68000

heap

page read and write

7FF694AC7000

unkown

page read and write

2171EF65000

heap

page read and write

B64000

stack

page read and write

FBE000

stack

page read and write

7FF694860000

unkown

page readonly

2171F01E000

heap

page read and write

2F30000

heap

page read and write

86F33FF000

stack

page read and write

134E000

stack

page read and write

3EC0000

heap

page read and write

7FF694ACF000

unkown

page readonly

7FF694ACC000

unkown

page read and write

400000

system

page execute and read and write

13C0000

heap

page read and write

7FF69499B000

unkown

page read and write

C7C000

stack

page read and write

3FC0000

heap

page read and write

BE0000

heap

page read and write

10E0000

heap

page read and write

1038000

heap

page read and write

D88000

heap

page read and write

E2E000

stack

page read and write

F3A000

stack

page read and write

D70000

heap

page read and write

12E0000

heap

page read and write

86F2FD9000

stack

page read and write

86F34FE000

stack

page read and write

D7B000

stack

page read and write

2171EFC6000

heap

page read and write

478000

remote allocation

page execute and read and write

1070000

heap

page read and write

F3C000

stack

page read and write

21726600000

direct allocation

page read and write

45D000

system

page execute and read and write

21725C00000

direct allocation

page read and write

86F32FF000

stack

page read and write

2CD0000

heap

page read and write

2171EF60000

heap

page read and write

2171EFCC000

heap

page read and write

1000000

heap

page read and write

2171EE30000

heap

page read and write

FE0000

heap

page read and write

7FF694AC0000

unkown

page read and write

7FF694ACF000

unkown

page readonly

325F000

stack

page read and write

10D3000

heap

page read and write

2171EFC0000

heap

page read and write

10F5000

heap

page read and write

2171F021000

heap

page read and write

2573488F000

direct allocation

page read and write

1030000

heap

page read and write

A6C000

stack

page read and write

21720C00000

direct allocation

page read and write

400000

system

page execute and read and write

143F000

stack

page read and write

2F51000

heap

page read and write

10EB000

heap

page read and write

104E000

heap

page read and write

107F000

stack

page read and write

2171EF30000

heap

page read and write

21722C00000

direct allocation

page read and write

1420000

heap

page read and write

E3C000

stack

page read and write

B5F000

stack

page read and write

FDE000

stack

page read and write

7FF694AC0000

unkown

page write copy

D40000

heap

page read and write

D3E000

stack

page read and write

473000

system

page execute and read and write

86F35FE000

stack

page read and write

1240000

heap

page read and write

2C5C000

stack

page read and write

D80000

heap

page read and write

474000

remote allocation

page execute and read and write

45C000

system

page execute and read and write

2C1E000

stack

page read and write

2F4E000

heap

page read and write

10001000

direct allocation

page execute and read and write

2F3B000

heap

page read and write

130F000

stack

page read and write

7FF694860000

unkown

page readonly

459000

system

page execute and read and write

257B547E000

heap

page read and write

101D000

heap

page read and write

E3C000

stack

page read and write

3110000

heap

page read and write

7FF6949FB000

unkown

page readonly

F7D000

stack

page read and write

F6E000

stack

page read and write

1170000

heap

page read and write

DE0000

heap

page read and write

10B1000

heap

page read and write

2A18000

heap

page read and write

CFE000

stack

page read and write

2F3F000

heap

page read and write

2171EF80000

direct allocation

page read and write

456000

system

page execute and read and write

2EDF000

stack

page read and write

1250000

heap

page read and write

311F000

stack

page read and write

B46000

stack

page read and write

7FF694861000

unkown

page execute read

2171EF10000

heap

page read and write

1130000

heap

page read and write

BD0000

heap

page read and write

315E000

stack

page read and write

293E000

heap

page read and write

3D2F000

stack

page read and write

E30000

heap

page read and write

D9D000

heap

page read and write

10FA000

heap

page read and write

E50000

heap

page read and write

BE5000

heap

page read and write

21724200000

direct allocation

page read and write

10016000

direct allocation

page execute and read and write

1020000

heap

page read and write

41B000

system

page execute and read and write

B62000

stack

page read and write

FF0000

heap

page read and write

1040000

heap

page read and write

2FDF000

stack

page read and write

301D000

stack

page read and write

10000000

direct allocation

page read and write

2DCF000

stack

page read and write

2171EF70000

direct allocation

page read and write

2C9C000

stack

page read and write

B4B000

stack

page read and write

FC0000

heap

page read and write

21723800000

direct allocation

page read and write

117E000

heap

page read and write

1045000

heap

page read and write

257B5390000

heap

page read and write

415B000

heap

page read and write

F90000

heap

page read and write

7FF694861000

unkown

page execute read

2B8F000

stack

page read and write

7FF6949FB000

unkown

page readonly

11FF000

stack

page read and write

2920000

heap

page read and write

10DC000

heap

page read and write

21727000000

direct allocation

page read and write

257B5458000

heap

page read and write

10E6000

heap

page read and write

F70000

heap

page read and write

1008000

heap

page read and write

3C2E000

stack

page read and write

2E30000

heap

page read and write

400000

system

page execute and read and write

There are 144 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Shipping documents PO 16103 INV.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportShipping documents PO 16103 INV.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Shipping documents PO 16103 INV.exe