Windows Analysis Report
3TpW2Sn68z.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 3TpW2Sn68z.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		2_2_004338C8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		8_2_004338C8

Source: RegAsymX.exe, 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_98b29fde-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00407538 _wcslen,CoGetObject,		2_2_00407538
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00407538 _wcslen,CoGetObject,		8_2_00407538

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 2.2.RegAsymX.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 8.2.RegAsymX.exe.400000.0.unpack

Source: 3TpW2Sn68z.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005CDBBE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D68EE FindFirstFileW,FindClose,	0_2_005D68EE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005D698F
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD076
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD3A9
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D9642
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D979D
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005D9B2B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005D5C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0084DBBE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008568EE FindFirstFileW,FindClose,	1_2_008568EE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	1_2_0085698F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D076
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D3A9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00859642
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0085979D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00859B2B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00855C97 FindFirstFileW,FindNextFileW,FindClose,	1_2_00855C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00407877 FindFirstFileW,FindNextFileW,	2_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_0327698F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032768EE FindFirstFileW,FindClose,	3_2_032768EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D3A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0327979D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_03279642
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_03279B2B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0326DBBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03275C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_03275C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00407877 FindFirstFileW,FindNextFileW,	8_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_0040BD72

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407CD2

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49730 -> 84.38.132.103:7001
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:53013 -> 84.38.132.103:7001
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:53009 -> 84.38.132.103:7001

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 84.38.132.103

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 84.38.132.103:7001

Source: Joe Sandbox View

ASN Name: DATACLUBLV DATACLUBLV

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005DCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_005DCE44

Source: RegAsymX.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: RegAsymX.exe, 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

2_2_0040A2F3

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005DEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_005DEAFF

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005DED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_005DED6A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	1_2_0085ED6A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	2_2_004168FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_0327ED6A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	8_2_004168FC

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

0_2_005DEAFF

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005CAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_005CAA57

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005F9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_005F9576
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00879576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	1_2_00879576
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	3_2_03299576

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041CA6D SystemParametersInfoW,	2_2_0041CA6D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041CA73 SystemParametersInfoW,	2_2_0041CA73
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041CA6D SystemParametersInfoW,	8_2_0041CA6D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041CA73 SystemParametersInfoW,	8_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: 3TpW2Sn68z.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 3TpW2Sn68z.exe, 00000000.00000002.1682848717.0000000000622000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_814a09af-6
Source: 3TpW2Sn68z.exe, 00000000.00000002.1682848717.0000000000622000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_017a4c7f-1
Source: 3TpW2Sn68z.exe, 00000000.00000003.1681672618.0000000003DE1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_deae4797-6
Source: 3TpW2Sn68z.exe, 00000000.00000003.1681672618.0000000003DE1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3ebbe7c7-3
Source: RegAsymX.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: RegAsymX.exe, 00000001.00000000.1681932970.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d894eeb2-c
Source: RegAsymX.exe, 00000001.00000000.1681932970.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d93d97fc-5
Source: RegAsymX.exe, 00000002.00000002.4144768646.0000000003F72000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_610698ee-5
Source: RegAsymX.exe, 00000002.00000002.4144768646.0000000003F72000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_69ad603f-e
Source: RegAsymX.exe, 00000002.00000002.4144625611.0000000003DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7e079ba4-9
Source: RegAsymX.exe, 00000002.00000002.4144625611.0000000003DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bc41f37b-8
Source: RegAsymX.exe, 00000002.00000002.4143541171.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2f49fdef-1
Source: RegAsymX.exe, 00000002.00000002.4143541171.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5b8ae25b-2
Source: svchost.exe, 00000003.00000002.2005838898.00000000032C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4b7a6453-9
Source: svchost.exe, 00000003.00000002.2005838898.00000000032C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0407e11f-a
Source: RegAsymX.exe, 00000008.00000000.1810224415.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7002a894-9
Source: RegAsymX.exe, 00000008.00000000.1810224415.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c4435ec3-3
Source: RegAsymX.exe, 00000008.00000002.4144091090.0000000004276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_095845a4-a
Source: RegAsymX.exe, 00000008.00000002.4144091090.0000000004276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f2a9c828-4
Source: 3TpW2Sn68z.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_959647dd-f
Source: 3TpW2Sn68z.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_745d09d1-8
Source: RegAsymX.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2e2a7c22-2
Source: RegAsymX.exe.0.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2fc89a24-2

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	2_2_0041812A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	2_2_0041330D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	2_2_0041BBC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	2_2_0041BB9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0329A2D7 NtdllDialogWndProc_W,	3_2_0329A2D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032987B2 NtdllDialogWndProc_W,CallWindowProcW,	3_2_032987B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03218BA4 NtdllDialogWndProc_W,	3_2_03218BA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03298AAA NtdllDialogWndProc_W,	3_2_03298AAA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03298FC9 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	3_2_03298FC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299380 NtdllDialogWndProc_W,	3_2_03299380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032993CB NtdllDialogWndProc_W,	3_2_032993CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0329911E DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	3_2_0329911E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03203170 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	3_2_03203170
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03219052 NtdllDialogWndProc_W,	3_2_03219052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032190A7 NtdllDialogWndProc_W,	3_2_032190A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032990A1 SendMessageW,NtdllDialogWndProc_W,	3_2_032990A1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032197C0 GetParent,NtdllDialogWndProc_W,	3_2_032197C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0329953A GetWindowLongW,NtdllDialogWndProc_W,	3_2_0329953A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	3_2_03299576
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299400 ClientToScreen,NtdllDialogWndProc_W,	3_2_03299400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321997D NtdllDialogWndProc_W,GetSysColor,SetBkColor,NtdllDialogWndProc_W,	3_2_0321997D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299F86 GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	3_2_03299F86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299E74 NtdllDialogWndProc_W,	3_2_03299E74
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299EF3 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	3_2_03299EF3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	8_2_0041330D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	8_2_0041BBC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	8_2_0041BB9A

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005CD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_005CD5EB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005C1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_005C1201

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_005CE8F6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	1_2_0084E8F6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	2_2_004167EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	3_2_0326E8F6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	8_2_004167EF

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0056BF40	0_2_0056BF40
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D2046	0_2_005D2046
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00568060	0_2_00568060
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005C8298	0_2_005C8298
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0059E4FF	0_2_0059E4FF
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0059676B	0_2_0059676B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005F4873	0_2_005F4873
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0056CAF0	0_2_0056CAF0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0058CAA0	0_2_0058CAA0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057CC39	0_2_0057CC39
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00596DD9	0_2_00596DD9
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057B119	0_2_0057B119
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005691C0	0_2_005691C0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581394	0_2_00581394
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581706	0_2_00581706
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0058781B	0_2_0058781B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057997D	0_2_0057997D
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00567920	0_2_00567920
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005819B0	0_2_005819B0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00587A4A	0_2_00587A4A
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581C77	0_2_00581C77
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00587CA7	0_2_00587CA7
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005EBE44	0_2_005EBE44
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00599EEE	0_2_00599EEE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581F32	0_2_00581F32
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02023660	0_2_02023660
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007E8060	1_2_007E8060
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00852046	1_2_00852046
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00848298	1_2_00848298
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0081E4FF	1_2_0081E4FF
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0081676B	1_2_0081676B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00874873	1_2_00874873
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0080CAA0	1_2_0080CAA0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007ECAF0	1_2_007ECAF0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007FCC39	1_2_007FCC39
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00816DD9	1_2_00816DD9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007FB119	1_2_007FB119
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007E91C0	1_2_007E91C0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801394	1_2_00801394
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801706	1_2_00801706
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0080781B	1_2_0080781B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007F997D	1_2_007F997D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008019B0	1_2_008019B0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007E7920	1_2_007E7920
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00807A4A	1_2_00807A4A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00807CA7	1_2_00807CA7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801C77	1_2_00801C77
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00819EEE	1_2_00819EEE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0086BE44	1_2_0086BE44
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801F32	1_2_00801F32
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00603660	1_2_00603660
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043706A	2_2_0043706A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00414005	2_2_00414005
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043E11C	2_2_0043E11C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004541D9	2_2_004541D9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004381E8	2_2_004381E8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041F18B	2_2_0041F18B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00446270	2_2_00446270
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043E34B	2_2_0043E34B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004533AB	2_2_004533AB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0042742E	2_2_0042742E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00437566	2_2_00437566
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043E5A8	2_2_0043E5A8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004387F0	2_2_004387F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043797E	2_2_0043797E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004339D7	2_2_004339D7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0044DA49	2_2_0044DA49
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00427AD7	2_2_00427AD7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041DBF3	2_2_0041DBF3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00427C40	2_2_00427C40
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00437DB3	2_2_00437DB3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00435EEB	2_2_00435EEB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043DEED	2_2_0043DEED
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00426E9F	2_2_00426E9F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01033660	2_2_01033660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03268298	3_2_03268298
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03208060	3_2_03208060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03272046	3_2_03272046
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0323676B	3_2_0323676B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0323E4FF	3_2_0323E4FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0322CAA0	3_2_0322CAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0320CAF0	3_2_0320CAF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03294873	3_2_03294873
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03236DD9	3_2_03236DD9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321CC39	3_2_0321CC39
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221394	3_2_03221394
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321B119	3_2_0321B119
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032091C0	3_2_032091C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221706	3_2_03221706
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03227A4A	3_2_03227A4A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03207920	3_2_03207920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321997D	3_2_0321997D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032219B0	3_2_032219B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0322781B	3_2_0322781B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221F32	3_2_03221F32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0328BE44	3_2_0328BE44
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03239EEE	3_2_03239EEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221C77	3_2_03221C77
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03227CA7	3_2_03227CA7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043706A	8_2_0043706A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00414005	8_2_00414005
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043E11C	8_2_0043E11C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004541D9	8_2_004541D9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004381E8	8_2_004381E8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041F18B	8_2_0041F18B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00446270	8_2_00446270
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043E34B	8_2_0043E34B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004533AB	8_2_004533AB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0042742E	8_2_0042742E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00437566	8_2_00437566
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043E5A8	8_2_0043E5A8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004387F0	8_2_004387F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043797E	8_2_0043797E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004339D7	8_2_004339D7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0044DA49	8_2_0044DA49
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00427AD7	8_2_00427AD7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041DBF3	8_2_0041DBF3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00427C40	8_2_00427C40
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00437DB3	8_2_00437DB3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00435EEB	8_2_00435EEB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043DEED	8_2_0043DEED
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00426E9F	8_2_00426E9F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A3660	8_2_018A3660

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 007FF9F2 appears 31 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00800A30 appears 46 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00401E65 appears 70 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00401FAB appears 44 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03220A30 appears 46 times
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: String function: 00580A30 appears 46 times
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: String function: 0057F9F2 appears 31 times

Source: C:\Windows\SysWOW64\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568

Source: 3TpW2Sn68z.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@11/18@0/1

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D37B5 GetLastError,FormatMessageW,

0_2_005D37B5

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005C10BF AdjustTokenPrivileges,CloseHandle,	0_2_005C10BF
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005C16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_005C16C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008410BF AdjustTokenPrivileges,CloseHandle,	1_2_008410BF
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	1_2_008416C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	2_2_0041798D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032610BF AdjustTokenPrivileges,CloseHandle,	3_2_032610BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032616C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	3_2_032616C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	8_2_0041798D

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005D51CD

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005EA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_005EA67C

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_005D648E

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_005642A2

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AADB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File created: C:\Users\user\AppData\Local\directory

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7660
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R-W
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File created: C:\Users\user\AppData\Local\Temp\autA43A.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"

Source: 3TpW2Sn68z.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 3TpW2Sn68z.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File read: C:\Users\user\Desktop\3TpW2Sn68z.exe

Source: unknown	Process created: C:\Users\user\Desktop\3TpW2Sn68z.exe "C:\Users\user\Desktop\3TpW2Sn68z.exe"
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\Desktop\3TpW2Sn68z.exe"
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\Desktop\3TpW2Sn68z.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Detected unpacking (creates a PE file in dynamic memory)

Source: 3TpW2Sn68z.exe

Static file information: File size 1426944 > 1048576

Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 3TpW2Sn68z.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 2.2.RegAsymX.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 8.2.RegAsymX.exe.400000.0.unpack

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00580A76 push ecx; ret	0_2_00580A89
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00800A76 push ecx; ret	1_2_00800A89
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00457186 push ecx; ret	2_2_00457199
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041C7F3 push eax; retf	2_2_0041C7FD
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00457AA8 push eax; ret	2_2_00457AC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00434EB6 push ecx; ret	2_2_00434EC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03220A76 push ecx; ret	3_2_03220A89
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00457186 push ecx; ret	8_2_00457199
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041C7F3 push eax; retf	8_2_0041C7FD
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00457AA8 push eax; ret	8_2_00457AC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00434EB6 push ecx; ret	8_2_00434EC9

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_00406EEB ShellExecuteW,URLDownloadToFileW,

2_2_00406EEB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File created: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Delayed program exit found

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AADB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_0057F98E
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005F1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_005F1C41
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	1_2_007FF98E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00871C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	1_2_00871C41
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	3_2_0321F98E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03291C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	3_2_03291C41

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

2_2_0041CBE1

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040F7E2 Sleep,ExitProcess,		2_2_0040F7E2
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040F7E2 Sleep,ExitProcess,		8_2_0040F7E2

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep			graph_0-96870
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		2_2_0041A7D9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		8_2_0041A7D9

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Window / User API: threadDelayed 1632	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Window / User API: threadDelayed 1623	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Window / User API: threadDelayed 3312	Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	API coverage: 3.8 %
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	API coverage: 3.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 1.0 %
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	API coverage: 7.9 %

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7640	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7644	Thread sleep count: 1632 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7644	Thread sleep time: -4896000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7652	Thread sleep count: 1623 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7652	Thread sleep time: -4869000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 5804	Thread sleep count: 3312 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 5804	Thread sleep time: -3312000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005CDBBE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D68EE FindFirstFileW,FindClose,	0_2_005D68EE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005D698F
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD076
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD3A9
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D9642
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D979D
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005D9B2B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005D5C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0084DBBE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008568EE FindFirstFileW,FindClose,	1_2_008568EE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	1_2_0085698F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D076
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D3A9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00859642
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0085979D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00859B2B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00855C97 FindFirstFileW,FindNextFileW,FindClose,	1_2_00855C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00407877 FindFirstFileW,FindNextFileW,	2_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_0327698F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032768EE FindFirstFileW,FindClose,	3_2_032768EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D3A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0327979D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_03279642
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_03279B2B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0326DBBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03275C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_03275C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00407877 FindFirstFileW,FindNextFileW,	8_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_0040BD72

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407CD2

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll81
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005DEAA2 BlockInput,

0_2_005DEAA2

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_00592622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00592622

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00584CE8 mov eax, dword ptr fs:[00000030h]	0_2_00584CE8
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_020234F0 mov eax, dword ptr fs:[00000030h]	0_2_020234F0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02023550 mov eax, dword ptr fs:[00000030h]	0_2_02023550
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02021E7E mov eax, dword ptr fs:[00000030h]	0_2_02021E7E
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02021E90 mov eax, dword ptr fs:[00000030h]	0_2_02021E90
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00804CE8 mov eax, dword ptr fs:[00000030h]	1_2_00804CE8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_006034F0 mov eax, dword ptr fs:[00000030h]	1_2_006034F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00603550 mov eax, dword ptr fs:[00000030h]	1_2_00603550
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00601E7E mov eax, dword ptr fs:[00000030h]	1_2_00601E7E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00601E90 mov eax, dword ptr fs:[00000030h]	1_2_00601E90
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00443355 mov eax, dword ptr fs:[00000030h]	2_2_00443355
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01033550 mov eax, dword ptr fs:[00000030h]	2_2_01033550
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_010334F0 mov eax, dword ptr fs:[00000030h]	2_2_010334F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01031E7E mov eax, dword ptr fs:[00000030h]	2_2_01031E7E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01031E90 mov eax, dword ptr fs:[00000030h]	2_2_01031E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03224CE8 mov eax, dword ptr fs:[00000030h]	3_2_03224CE8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00443355 mov eax, dword ptr fs:[00000030h]	8_2_00443355
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A3550 mov eax, dword ptr fs:[00000030h]	8_2_018A3550
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A34F0 mov eax, dword ptr fs:[00000030h]	8_2_018A34F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A1E90 mov eax, dword ptr fs:[00000030h]	8_2_018A1E90
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A1E7E mov eax, dword ptr fs:[00000030h]	8_2_018A1E7E

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005C0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_005C0B62

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00592622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00592622
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0058083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0058083F
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005809D5 SetUnhandledExceptionFilter,	0_2_005809D5
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00580C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00580C21
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00812622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00812622
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0080083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0080083F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008009D5 SetUnhandledExceptionFilter,	1_2_008009D5
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00800C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00800C21
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043503C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00434A8A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0043BB71
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00434BD8 SetUnhandledExceptionFilter,	2_2_00434BD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03232622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_03232622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032209D5 SetUnhandledExceptionFilter,	3_2_032209D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0322083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0322083F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03220C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_03220C21
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0043503C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00434A8A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0043BB71
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00434BD8 SetUnhandledExceptionFilter,	8_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

2_2_0041812A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3179008

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		2_2_00412132
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		8_2_00412132

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

0_2_005C1201

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005A2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_005A2BA5

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005CB226 SendInput,keybd_event,

0_2_005CB226

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005E22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_005E22DA

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"			Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

0_2_005C0B62

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005C1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_005C1663

Source: 3TpW2Sn68z.exe, RegAsymX.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RegAsymX.exe, 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2R\
Source: 3TpW2Sn68z.exe, RegAsymX.exe	Binary or memory string: Shell_TrayWnd
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2R\G
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2R\Y
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager@
Source: RegAsymX.exe, 00000002.00000002.4143971478.0000000001168000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp, logs.dat.2.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_00580698 cpuid

0_2_00580698

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_0045201B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_004520B6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452143
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	2_2_00452393
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_00448484
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004524BC
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	2_2_004525C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452690
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	2_2_0044896D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoA,	2_2_0040F90C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00451D58
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_00451FD0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_0045201B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_004520B6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00452143
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	8_2_00452393
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_00448484
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_004524BC
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	8_2_004525C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00452690
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	8_2_0044896D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoA,	8_2_0040F90C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_00451D58
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_00451FD0

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_005D8195

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005BD27A GetUserNameW,

0_2_005BD27A

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_0059BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0059BB6F

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		2_2_0040BA4D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		8_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \key3.db	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	8_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \key3.db	8_2_0040BB6B

Source: RegAsymX.exe	Binary or memory string: WIN_81
Source: RegAsymX.exe	Binary or memory string: WIN_XP
Source: RegAsymX.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: RegAsymX.exe	Binary or memory string: WIN_XPe
Source: RegAsymX.exe	Binary or memory string: WIN_VISTA
Source: RegAsymX.exe	Binary or memory string: WIN_7
Source: RegAsymX.exe	Binary or memory string: WIN_8

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R-W			Jump to behavior

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: cmd.exe		2_2_0040569A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: cmd.exe		8_2_0040569A

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005E1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_005E1204
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005E1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_005E1806
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00861204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	1_2_00861204
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00861806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	1_2_00861806
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03281204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	3_2_03281204
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03281806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	3_2_03281806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	1 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	2 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	26 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Bypass User Account Control	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	322 Process Injection	1 Masquerading	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	322 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3TpW2Sn68z.exe	50%	ReversingLabs	Win32.Trojan.Strab
3TpW2Sn68z.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\directory\RegAsymX.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\directory\RegAsymX.exe	50%	ReversingLabs	Win32.Trojan.Strab

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp/C	0%	Avira URL Cloud	safe
http://upx.sf.net	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp	0%	Avira URL Cloud	safe
84.38.132.103	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
84.38.132.103	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	RegAsymX.exe	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	RegAsymX.exe, 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
84.38.132.103	unknown	Latvia		52048	DATACLUBLV	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1504845
Start date and time:	2024-09-05 14:16:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3TpW2Sn68z.exe renamed because original name is a hash value
Original Sample Name:	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@11/18@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 51 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 3TpW2Sn68z.exe

Simulations

Behavior and APIs

Time	Type	Description
08:17:28	API Interceptor	1x Sleep call for process: WerFault.exe modified
08:17:31	API Interceptor	6118164x Sleep call for process: RegAsymX.exe modified
13:17:00	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACLUBLV	1q4wVJgStc.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	46.183.223.107
	nleHhuZy1N.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	46.183.223.107
	Documenti di spedizione 0002838844.exe	Get hash	malicious	AgentTesla	Browse	46.183.223.107
	Shipping Documents.bat.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	46.183.220.28
	Document SWIFT Payment Copy Ref#8374837293.exe	Get hash	malicious	Remcos	Browse	84.38.132.40
	Nakliye belgeleri.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.183.220.65
	file.exe	Get hash	malicious	StormKitty, XWorm	Browse	84.38.132.25
	USED TROMMEL.js	Get hash	malicious	ADWIND	Browse	46.183.223.47
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	46.183.222.11
	XrAADcYten.rtf	Get hash	malicious	Remcos	Browse	46.183.222.11

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_54b38e612730b8c5952b2618de6f5b28d71e92_bac6fce3_69ee89ae-f8ea-433c-9a8e-e8d9b5708f58\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8632280976180019
Encrypted:	false
SSDEEP:	192:RQi5j1Js8pB0GdsyvjUUGzuiFXZ24IO8KR:Z5xJs8pCGdsyvjuzuiFXY4IO8KR
MD5:	026DD927C4D6BE0068F0454C7F0740D2
SHA1:	67B8F953D043B13834D1CF8A09AC52F43AF4DB81
SHA-256:	929DE90EE8009704356450B51B16ACB6B418CC257E73AAEFA1329833D56B8EF7
SHA-512:	B1E7BA759919AC53FA116EEA5567A0B88BF1F28BBA97D6EE8A739703821D6498B8E7A62CDDD90A9AFC0A3AAF1171699D985F06A7177B6E11464BEFC9D4C9DE6E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.0.1.2.2.2.4.7.2.6.0.8.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.0.1.2.2.2.6.7.1.0.4.6.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.e.e.8.9.a.e.-.f.8.e.a.-.4.3.3.c.-.9.a.8.e.-.e.8.d.9.b.5.7.0.8.f.5.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.d.6.9.e.2.6.-.0.3.c.4.-.4.7.3.8.-.8.8.e.f.-.d.5.2.1.7.7.b.4.2.c.c.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.e.c.-.0.0.0.1.-.0.0.1.4.-.8.c.1.a.-.b.2.8.1.8.d.f.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.3.1.9.6.f.4.5.b.2.6.9.a.6.1.4.a.3.9.2.6.e.f.c.0.3.2.f.c.9.d.7.5.0.1.7.f.2.7.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC84C.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 5 12:17:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	235386
Entropy (8bit):	0.7130156194278792
Encrypted:	false
SSDEEP:	192:kf7+b6stggzDO8u+HviOmVS1aF/Ji6uOvezhUp2dIP0KVjWS:2bsSw6r+HKOmVSs/BLGe2PS
MD5:	A37AD8656B2EC855C3A2552A121AA1C5
SHA1:	F2DC6CBF64F2286A2D792011FE806EE03E16ECE0
SHA-256:	B1D481FDA8B212241B4B20E762C6DDFDE41D016D8D8F5DA01088E051940083F4
SHA-512:	93CD7909D0B26F6D34FE1810ED86DAC3A8E9D4E1E28E23078B8350D5D32FC83E807DA54D38BB9538850E4257DB2D5ED06A049F77DF3D80985CCD9680062436B0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......B..f.........................................)..........T.......8...........T...........h...............<...........(...............................................................................eJ..............GenuineIntel............T...........;..f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCEB6.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.691054350716476
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4Mb6pD6YG76TPgmfpDcQhpDY89bcqrsfQeom:R6lXJ3696YK6DgmfpDcQx5wf5
MD5:	05A2789545096703989A8B9225BCA7AD
SHA1:	39505CD08075347BC0E3D012B5AC858BA2B4DD1E
SHA-256:	08184F8647583EDE0FD153BF1D9FCB898692F8B17ABCED16C189B5297D72B9B6
SHA-512:	249C2B85E886B2698571CDDB134BCFE78560B4E01DFA7CE645BDE2537FDC5AE47E1FC817CED3EF0547B90979D11025E402F3E27A6308F414E6E840E9A1A7583F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCEE6.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4655
Entropy (8bit):	4.449377431426201
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9N/+WpW8VYbpYm8M4JCaSE0Fs+q80Peg3dD0Fd:uIjfzI7b/7Vc4JC+PdD0Fd
MD5:	036AC7AB1992BFCC34EE1FFC27A3BF05
SHA1:	D4508420D934EE80A4FE9EBC678A57FA67E698C1
SHA-256:	CC87C083632C446FEDC3C1AE7A7B67B43E7B56977770932A8C3898012F1E4AA2
SHA-512:	721F917DB3F97D816B32E0C3805E50E2613A0436DB264105E4C3FCD703CADA4340DF640348FB3D6C739B2B5A4241C17D398BFCD1938B5FE1042211088E31FD76
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="486919" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\remcos\logs.dat

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	modified
Size (bytes):	204
Entropy (8bit):	3.370841607409535
Encrypted:	false
SSDEEP:	3:rhlKlTlQN1UljxQ55JWRal2Jl+7R0DAlBG45klovDl64oojklovDl6v:6l+Neljg5YcIeeDAlOWA41gWAv
MD5:	FB2127739913D6893E1ED596C117CA08
SHA1:	32FE605D19EB6419F13D729FF42A29C852A0949C
SHA-256:	6432387ADBCA135D4D175B97F0C60889CC22845AF405AFFA8CF2496DF5C62369
SHA-512:	70BE09BDB5C9D615105D5290B582B372478E2ED8945D9CC86D0CC6FD80238ADD05E33C819546302C329276AF38B15CFDE8DA5AECFCF8918F64C967EA1CCDA636
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.0.9./.0.5. .0.8.:.1.6.:.5.9. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\Lymnaeidae

Process:	C:\Users\user\Desktop\3TpW2Sn68z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	86022
Entropy (8bit):	4.180302087407891
Encrypted:	false
SSDEEP:	1536:bLNn7+q++YEUwFAJglvzOLlWkUrxf8LrfI041A:bLNnyq+ZLcvcWbUrfyA
MD5:	E9D80FF6FCD8CEEB2F0C63B6D84354FD
SHA1:	9E697F748635834B3B88F33FBB77323261B325B0
SHA-256:	91F5F7478FFCD500AD50E86ADA1FAFFC60979B449AF4D56B3BF1F71BB7DA0A3D
SHA-512:	ABA78FB40AAE7238B20BA9FBE9D975481DA595896A651962C41B89F6BEA323A7040AFAF35A33F0608A4F2D0AAF899537A5E1CC37887AFC6ECE0E468F9916B343
Malicious:	false
Reputation:	low
Preview:	30I78G35S35R38O62M65E63A38X31X65I63I63Z63M30I32Y30G30X30V30U35R36S35S37N62B38V36U62J30L30F30N30B30Y30H36B36V38E39S34L35U38D34Z62V39Z36M35S30L30X30Q30Y30I30I36M36J38D39D34U64R38H36R62W61J37V32M30F30J30W30I30S30U36M36H38J39Y35I35Y38M38M62O38R36F65Y30I30P30K30C30V30P36E36D38B39S34F35N38N61O62K39K36R35E30Q30I30A30A30M30W36A36Z38J39G34M64C38O63Q62E61B36D63P30K30I30P30N30Z30O36X36W38L39S35B35H38H65N62S38P33L33F30D30J30M30I30O30G36D36U38X39B34L35F39Y30C62B39E33N32Y30S30N30D30H30N30D36E36U38L39M34V64W39G32W62T61D32W65U30K30L30G30J30B30P36M36Q38K39B35E35W39U34C62E38A36G34J30Z30H30D30S30V30X36Z36I38S39D34P35R39F36Q62M39E36V63T30K30R30J30N30T30M36M36N38E39A34G64H39J38X62B61W36N63H30S30H30O30K30S30Z36N36R38V39H35A35W39A61Y33P33E63W30M36R36O38R39Y34M35V39R63O62W39Q36M65L30K30S30D30L30K30J36Z36X38G39Q38L64I34Q34D66J66Y66Q66X66D66K62K61P37W34X30H30P30G30G30U30L36G36E38G39B39G35P34U36P66W66P66R66T66F66N62Q38D36A34W30Z30R30D30F30U30Z36H36I38L39J38S35O34Y38I66Z66I66F66D66Y66G62I39C36O63M30X30R30J30H30I3

C:\Users\user\AppData\Local\Temp\autA43A.tmp

Process:	C:\Users\user\Desktop\3TpW2Sn68z.exe
File Type:	data
Category:	dropped
Size (bytes):	418074
Entropy (8bit):	7.966658027526016
Encrypted:	false
SSDEEP:	12288:vOd8E1V9sePhuuslNPUISS+lo3eWx9aBSvQNm5pcu:vOd8c9sePhuusl7XOmaeQN29
MD5:	CE86F406E025AB6C2D4619B42B06A10F
SHA1:	910EC8A487315A88F37D98E65C61886BFB6E5A8D
SHA-256:	C74E9A1BC00368E1CCE005364C3B8EC3822241D895FEBC6F018491EA368E6464
SHA-512:	6B999D9B150EB8B6ECBB37A4B0F3E0A0246A97BCE310044BDD90926945A4FD6942BFECE1B0F64C57108834EFC63A60FEB48497DB2D4A1A7DED076DC1FE162665
Malicious:	false
Reputation:	low
Preview:	EA06........E.oP.Ug3>O&mE.S.tz..R......Bm6.Qf......\|T..V.E..k......M.?.t~_?.]dS.]BE+.Fj.z.bUD..dWj\.yk..n...'[.......r.P..].._.......x9f...Di..o+a......V..,..2.\..M....o.js..(5....0.Pt.^Y......p....E\|....,..A"..6..D...PrnQ.......p2...A..V.`.......UjPz,...g.....Nj.:..sP.I.9..h.)u.uj....xq@....0..(...J.D..(S9.......J.@.d..m6..)..=ZR......(..$....n..9......(.k....V..X;....O.p..O...Qe...{.S...{..=Zx.....f.!.R.@...}N....eP.T@.>.].o0.I..^mE.M.Tz...R..<.......x".I.b.W.... .BSR.R.@...~.Q..,.....Q...4.....Pj..>i.~.R....h......f\|.....T....P.........PT@.>z.~.U.Q..@.LR..........~`...g.Az...Y..m^...T.~..V.D...d.%9..d.j-c.4.U.8+-".n....K.....).>..U.b.sJ.O-S.....4.-.....\.kY..R....&.6..o..<?.?.\|........~.....&,.@.B.......0.&#.p.B........&&x....0..5i...4.......go.....E/_/.U*R=."+J...Y...Z.....Wu\.M..-...6.HnS:\|K.....gz..@r.(......A s}.f.9...h..O...g0.....A@(.,......(.5....Up..5.m...ty._....1.jMV..........@Z.`.....A[l..."oU.H..p..m...{.....Q....N...V.....$...u.<.5...9

C:\Users\user\AppData\Local\Temp\autA489.tmp

Process:	C:\Users\user\Desktop\3TpW2Sn68z.exe
File Type:	data
Category:	dropped
Size (bytes):	43672
Entropy (8bit):	7.8285350146178185
Encrypted:	false
SSDEEP:	768:KfaBoBoap+msyc011tor5MNvmu8L175JdNlf4nC4vzzgEMpd7if9Iw2tAsVkjR:IaBosecK6r5MNm97BbJ4bssiXt7k9
MD5:	82867B0C21D8C24CF50C4408D8F9821B
SHA1:	08CDC310E08AE5E72502E4077134BB6DE08F3739
SHA-256:	900638A4DA24C03753D210EA0C53FF6D729C04563C67B533C5E4F5271F4A3FD5
SHA-512:	F416F2E257CAA70D47F152958C95F3F71443AFBDD1E641B37AE0CA5D15954F19D8F0461FE035DD3A23AFCB6D5E8C62577AE33AA192E35DA3AF3922BD868F2E0C
Malicious:	false
Reputation:	low
Preview:	EA06..P...)3y..g5...)..6.Sf.Z,.gA..+.9.bm5..`.ejm3....9.fg0.......3.U@....S....i..g8.L..Y..3.S&s.4.aN..(S9...H..S9.Zg8...59..3..fs.$.iZ.L..9.jg6..".....Q.3. .h..6...3...6..Q..eJm2..4...3.S@.`."..g.".P.j.3.R.s...kI..k39.4...L..9...F.M@.1P..)s9...2.L..Y..3.P.(.4.kN..).i...K..i`...kE....J.....U.sj..mZ.l..9.6m4...3:..eE.L@<.$.f..........3.V&sj..qL.lf.).....M..(.Ng8.L.t...T..l@.......O.`...3..Q0..0...3.,.gN...`....H.....U.l..9.Zm4..U.($.6....P.......T..:...Tfs....\|.....Vg4.l(.9.....R.3@.eS.D.5@...3.T.l...9..$.J...6.M.u@.....O...4.....T...6.R&s..R...M. ,E:m3..1.......4...T...&sZ...A.Lk30..f..U........)&.L..iR.L.u.....M.....Q.@.....V&`b..!8.M.....3.Q&.jT.mY..g.j...h.R.....3...sJ...P.D....2..L.........T.....6.U....Jm6.M.....d.......\.Z..HT`...4...T..x....Ze&m6.M.....3Q..L.sC......F..Huh.{@..,...F.J..cE..@".H..M..fTI......u..H.....@6e..J............:h....J..5L.H&s....0......E.p...=S.H.......&......T.$ ..eZ.Rf.`'j...R.H .@...Q.9.d.t.F&.....0..).`...\..

C:\Users\user\AppData\Local\Temp\autA870.tmp

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	418074
Entropy (8bit):	7.966658027526016
Encrypted:	false
SSDEEP:	12288:vOd8E1V9sePhuuslNPUISS+lo3eWx9aBSvQNm5pcu:vOd8c9sePhuusl7XOmaeQN29
MD5:	CE86F406E025AB6C2D4619B42B06A10F
SHA1:	910EC8A487315A88F37D98E65C61886BFB6E5A8D
SHA-256:	C74E9A1BC00368E1CCE005364C3B8EC3822241D895FEBC6F018491EA368E6464
SHA-512:	6B999D9B150EB8B6ECBB37A4B0F3E0A0246A97BCE310044BDD90926945A4FD6942BFECE1B0F64C57108834EFC63A60FEB48497DB2D4A1A7DED076DC1FE162665
Malicious:	false
Reputation:	low
Preview:	EA06........E.oP.Ug3>O&mE.S.tz..R......Bm6.Qf......\|T..V.E..k......M.?.t~_?.]dS.]BE+.Fj.z.bUD..dWj\.yk..n...'[.......r.P..].._.......x9f...Di..o+a......V..,..2.\..M....o.js..(5....0.Pt.^Y......p....E\|....,..A"..6..D...PrnQ.......p2...A..V.`.......UjPz,...g.....Nj.:..sP.I.9..h.)u.uj....xq@....0..(...J.D..(S9.......J.@.d..m6..)..=ZR......(..$....n..9......(.k....V..X;....O.p..O...Qe...{.S...{..=Zx.....f.!.R.@...}N....eP.T@.>.].o0.I..^mE.M.Tz...R..<.......x".I.b.W.... .BSR.R.@...~.Q..,.....Q...4.....Pj..>i.~.R....h......f\|.....T....P.........PT@.>z.~.U.Q..@.LR..........~`...g.Az...Y..m^...T.~..V.D...d.%9..d.j-c.4.U.8+-".n....K.....).>..U.b.sJ.O-S.....4.-.....\.kY..R....&.6..o..<?.?.\|........~.....&,.@.B.......0.&#.p.B........&&x....0..5i...4.......go.....E/_/.U*R=."+J...Y...Z.....Wu\.M..-...6.HnS:\|K.....gz..@r.(......A s}.f.9...h..O...g0.....A@(.,......(.5....Up..5.m...ty._....1.jMV..........@Z.`.....A[l..."oU.H..p..m...{.....Q....N...V.....$...u.<.5...9

C:\Users\user\AppData\Local\Temp\autA8DF.tmp

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	43672
Entropy (8bit):	7.8285350146178185
Encrypted:	false
SSDEEP:	768:KfaBoBoap+msyc011tor5MNvmu8L175JdNlf4nC4vzzgEMpd7if9Iw2tAsVkjR:IaBosecK6r5MNm97BbJ4bssiXt7k9
MD5:	82867B0C21D8C24CF50C4408D8F9821B
SHA1:	08CDC310E08AE5E72502E4077134BB6DE08F3739
SHA-256:	900638A4DA24C03753D210EA0C53FF6D729C04563C67B533C5E4F5271F4A3FD5
SHA-512:	F416F2E257CAA70D47F152958C95F3F71443AFBDD1E641B37AE0CA5D15954F19D8F0461FE035DD3A23AFCB6D5E8C62577AE33AA192E35DA3AF3922BD868F2E0C
Malicious:	false
Preview:	EA06..P...)3y..g5...)..6.Sf.Z,.gA..+.9.bm5..`.ejm3....9.fg0.......3.U@....S....i..g8.L..Y..3.S&s.4.aN..(S9...H..S9.Zg8...59..3..fs.$.iZ.L..9.jg6..".....Q.3. .h..6...3...6..Q..eJm2..4...3.S@.`."..g.".P.j.3.R.s...kI..k39.4...L..9...F.M@.1P..)s9...2.L..Y..3.P.(.4.kN..).i...K..i`...kE....J.....U.sj..mZ.l..9.6m4...3:..eE.L@<.$.f..........3.V&sj..qL.lf.).....M..(.Ng8.L.t...T..l@.......O.`...3..Q0..0...3.,.gN...`....H.....U.l..9.Zm4..U.($.6....P.......T..:...Tfs....\|.....Vg4.l(.9.....R.3@.eS.D.5@...3.T.l...9..$.J...6.M.u@.....O...4.....T...6.R&s..R...M. ,E:m3..1.......4...T...&sZ...A.Lk30..f..U........)&.L..iR.L.u.....M.....Q.@.....V&`b..!8.M.....3.Q&.jT.mY..g.j...h.R.....3...sJ...P.D....2..L.........T.....6.U....Jm6.M.....d.......\.Z..HT`...4...T..x....Ze&m6.M.....3Q..L.sC......F..Huh.{@..,...F.J..cE..@".H..M..fTI......u..H.....@6e..J............:h....J..5L.H&s....0......E.p...=S.H.......&......T.$ ..eZ.Rf.`'j...R.H .@...Q.9.d.t.F&.....0..).`...\..

C:\Users\user\AppData\Local\Temp\autAD71.tmp

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	418074
Entropy (8bit):	7.966658027526016
Encrypted:	false
SSDEEP:	12288:vOd8E1V9sePhuuslNPUISS+lo3eWx9aBSvQNm5pcu:vOd8c9sePhuusl7XOmaeQN29
MD5:	CE86F406E025AB6C2D4619B42B06A10F
SHA1:	910EC8A487315A88F37D98E65C61886BFB6E5A8D
SHA-256:	C74E9A1BC00368E1CCE005364C3B8EC3822241D895FEBC6F018491EA368E6464
SHA-512:	6B999D9B150EB8B6ECBB37A4B0F3E0A0246A97BCE310044BDD90926945A4FD6942BFECE1B0F64C57108834EFC63A60FEB48497DB2D4A1A7DED076DC1FE162665
Malicious:	false
Preview:	EA06........E.oP.Ug3>O&mE.S.tz..R......Bm6.Qf......\|T..V.E..k......M.?.t~_?.]dS.]BE+.Fj.z.bUD..dWj\.yk..n...'[.......r.P..].._.......x9f...Di..o+a......V..,..2.\..M....o.js..(5....0.Pt.^Y......p....E\|....,..A"..6..D...PrnQ.......p2...A..V.`.......UjPz,...g.....Nj.:..sP.I.9..h.)u.uj....xq@....0..(...J.D..(S9.......J.@.d..m6..)..=ZR......(..$....n..9......(.k....V..X;....O.p..O...Qe...{.S...{..=Zx.....f.!.R.@...}N....eP.T@.>.].o0.I..^mE.M.Tz...R..<.......x".I.b.W.... .BSR.R.@...~.Q..,.....Q...4.....Pj..>i.~.R....h......f\|.....T....P.........PT@.>z.~.U.Q..@.LR..........~`...g.Az...Y..m^...T.~..V.D...d.%9..d.j-c.4.U.8+-".n....K.....).>..U.b.sJ.O-S.....4.-.....\.kY..R....&.6..o..<?.?.\|........~.....&,.@.B.......0.&#.p.B........&&x....0..5i...4.......go.....E/_/.U*R=."+J...Y...Z.....Wu\.M..-...6.HnS:\|K.....gz..@r.(......A s}.f.9...h..O...g0.....A@(.,......(.5....Up..5.m...ty._....1.jMV..........@Z.`.....A[l..."oU.H..p..m...{.....Q....N...V.....$...u.<.5...9

C:\Users\user\AppData\Local\Temp\autADD0.tmp

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	43672
Entropy (8bit):	7.8285350146178185
Encrypted:	false
SSDEEP:	768:KfaBoBoap+msyc011tor5MNvmu8L175JdNlf4nC4vzzgEMpd7if9Iw2tAsVkjR:IaBosecK6r5MNm97BbJ4bssiXt7k9
MD5:	82867B0C21D8C24CF50C4408D8F9821B
SHA1:	08CDC310E08AE5E72502E4077134BB6DE08F3739
SHA-256:	900638A4DA24C03753D210EA0C53FF6D729C04563C67B533C5E4F5271F4A3FD5
SHA-512:	F416F2E257CAA70D47F152958C95F3F71443AFBDD1E641B37AE0CA5D15954F19D8F0461FE035DD3A23AFCB6D5E8C62577AE33AA192E35DA3AF3922BD868F2E0C
Malicious:	false
Preview:	EA06..P...)3y..g5...)..6.Sf.Z,.gA..+.9.bm5..`.ejm3....9.fg0.......3.U@....S....i..g8.L..Y..3.S&s.4.aN..(S9...H..S9.Zg8...59..3..fs.$.iZ.L..9.jg6..".....Q.3. .h..6...3...6..Q..eJm2..4...3.S@.`."..g.".P.j.3.R.s...kI..k39.4...L..9...F.M@.1P..)s9...2.L..Y..3.P.(.4.kN..).i...K..i`...kE....J.....U.sj..mZ.l..9.6m4...3:..eE.L@<.$.f..........3.V&sj..qL.lf.).....M..(.Ng8.L.t...T..l@.......O.`...3..Q0..0...3.,.gN...`....H.....U.l..9.Zm4..U.($.6....P.......T..:...Tfs....\|.....Vg4.l(.9.....R.3@.eS.D.5@...3.T.l...9..$.J...6.M.u@.....O...4.....T...6.R&s..R...M. ,E:m3..1.......4...T...&sZ...A.Lk30..f..U........)&.L..iR.L.u.....M.....Q.@.....V&`b..!8.M.....3.Q&.jT.mY..g.j...h.R.....3...sJ...P.D....2..L.........T.....6.U....Jm6.M.....d.......\.Z..HT`...4...T..x....Ze&m6.M.....3Q..L.sC......F..Huh.{@..,...F.J..cE..@".H..M..fTI......u..H.....@6e..J............:h....J..5L.H&s....0......E.p...=S.H.......&......T.$ ..eZ.Rf.`'j...R.H .@...Q.9.d.t.F&.....0..).`...\..

C:\Users\user\AppData\Local\Temp\autDA6D.tmp

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	418074
Entropy (8bit):	7.966658027526016
Encrypted:	false
SSDEEP:	12288:vOd8E1V9sePhuuslNPUISS+lo3eWx9aBSvQNm5pcu:vOd8c9sePhuusl7XOmaeQN29
MD5:	CE86F406E025AB6C2D4619B42B06A10F
SHA1:	910EC8A487315A88F37D98E65C61886BFB6E5A8D
SHA-256:	C74E9A1BC00368E1CCE005364C3B8EC3822241D895FEBC6F018491EA368E6464
SHA-512:	6B999D9B150EB8B6ECBB37A4B0F3E0A0246A97BCE310044BDD90926945A4FD6942BFECE1B0F64C57108834EFC63A60FEB48497DB2D4A1A7DED076DC1FE162665
Malicious:	false
Preview:	EA06........E.oP.Ug3>O&mE.S.tz..R......Bm6.Qf......\|T..V.E..k......M.?.t~_?.]dS.]BE+.Fj.z.bUD..dWj\.yk..n...'[.......r.P..].._.......x9f...Di..o+a......V..,..2.\..M....o.js..(5....0.Pt.^Y......p....E\|....,..A"..6..D...PrnQ.......p2...A..V.`.......UjPz,...g.....Nj.:..sP.I.9..h.)u.uj....xq@....0..(...J.D..(S9.......J.@.d..m6..)..=ZR......(..$....n..9......(.k....V..X;....O.p..O...Qe...{.S...{..=Zx.....f.!.R.@...}N....eP.T@.>.].o0.I..^mE.M.Tz...R..<.......x".I.b.W.... .BSR.R.@...~.Q..,.....Q...4.....Pj..>i.~.R....h......f\|.....T....P.........PT@.>z.~.U.Q..@.LR..........~`...g.Az...Y..m^...T.~..V.D...d.%9..d.j-c.4.U.8+-".n....K.....).>..U.b.sJ.O-S.....4.-.....\.kY..R....&.6..o..<?.?.\|........~.....&,.@.B.......0.&#.p.B........&&x....0..5i...4.......go.....E/_/.U*R=."+J...Y...Z.....Wu\.M..-...6.HnS:\|K.....gz..@r.(......A s}.f.9...h..O...g0.....A@(.,......(.5....Up..5.m...ty._....1.jMV..........@Z.`.....A[l..."oU.H..p..m...{.....Q....N...V.....$...u.<.5...9

C:\Users\user\AppData\Local\Temp\autDABC.tmp

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	43672
Entropy (8bit):	7.8285350146178185
Encrypted:	false
SSDEEP:	768:KfaBoBoap+msyc011tor5MNvmu8L175JdNlf4nC4vzzgEMpd7if9Iw2tAsVkjR:IaBosecK6r5MNm97BbJ4bssiXt7k9
MD5:	82867B0C21D8C24CF50C4408D8F9821B
SHA1:	08CDC310E08AE5E72502E4077134BB6DE08F3739
SHA-256:	900638A4DA24C03753D210EA0C53FF6D729C04563C67B533C5E4F5271F4A3FD5
SHA-512:	F416F2E257CAA70D47F152958C95F3F71443AFBDD1E641B37AE0CA5D15954F19D8F0461FE035DD3A23AFCB6D5E8C62577AE33AA192E35DA3AF3922BD868F2E0C
Malicious:	false
Preview:	EA06..P...)3y..g5...)..6.Sf.Z,.gA..+.9.bm5..`.ejm3....9.fg0.......3.U@....S....i..g8.L..Y..3.S&s.4.aN..(S9...H..S9.Zg8...59..3..fs.$.iZ.L..9.jg6..".....Q.3. .h..6...3...6..Q..eJm2..4...3.S@.`."..g.".P.j.3.R.s...kI..k39.4...L..9...F.M@.1P..)s9...2.L..Y..3.P.(.4.kN..).i...K..i`...kE....J.....U.sj..mZ.l..9.6m4...3:..eE.L@<.$.f..........3.V&sj..qL.lf.).....M..(.Ng8.L.t...T..l@.......O.`...3..Q0..0...3.,.gN...`....H.....U.l..9.Zm4..U.($.6....P.......T..:...Tfs....\|.....Vg4.l(.9.....R.3@.eS.D.5@...3.T.l...9..$.J...6.M.u@.....O...4.....T...6.R&s..R...M. ,E:m3..1.......4...T...&sZ...A.Lk30..f..U........)&.L..iR.L.u.....M.....Q.@.....V&`b..!8.M.....3.Q&.jT.mY..g.j...h.R.....3...sJ...P.D....2..L.........T.....6.U....Jm6.M.....d.......\.Z..HT`...4...T..x....Ze&m6.M.....3Q..L.sC......F..Huh.{@..,...F.J..cE..@".H..M..fTI......u..H.....@6e..J............:h....J..5L.H&s....0......E.p...=S.H.......&......T.$ ..eZ.Rf.`'j...R.H .@...Q.9.d.t.F&.....0..).`...\..

C:\Users\user\AppData\Local\Temp\ophiolatrous

Process:	C:\Users\user\Desktop\3TpW2Sn68z.exe
File Type:	data
Category:	dropped
Size (bytes):	494592
Entropy (8bit):	7.627198191106946
Encrypted:	false
SSDEEP:	12288:lBcQU30NZkjRqjCdKWIG887zQ09vegFpUDzzJRmJ:lu5jRrK2J9veIpUDzvmJ
MD5:	89669F54C2CF58A12E6EB05F0B0C8B45
SHA1:	9DD08035FB240B2D8C284C31786F20C04E4D871A
SHA-256:	7367A34C0B9D0C68678B8BD5BD02A54C94D7A60000AABC0525079B641C0F5E03
SHA-512:	000188DE8AF2C2886AB5085890835E29CF0E65F6C9FC01A52F47A709650D8C9F411BB8931E545C27EDC132EE14FA685EC063D5681BFFD9ECE56A52473E9F2686
Malicious:	false
Preview:	.c.RHD7PNU93..6E.OKGV9UR.D7PJU93666E0OKGV9URKD7PJU93666E0OKGN8URE[.^J.0...7..n./?Ju"9+P"+8.PWXX*Do)"vK <k-Yp..j.[YR .BFMr9URKD7PF...~,.;xU.9.#.,.....O.M..;.U.9..q,.^...7kM.,.;..Z9.#.,.../.O.M.r.:BU.9.}.-!^...7\|Mg,.;xU.9 ".,.../fO.M.r.;yU.9.}.-.^...<Z[~,.;0OKGV9URKD7PJU93666E0OKG.\|UR.E0P...U666E0OKG.9WS@E9PJ'<36 4E0OKG.sVRKT7PJ.<366vE0_KGV;URND6PJU93367E0OKGV.]RK@7PJU93466.0O[GV)URKD'PJE93666E OKGV9URKD7P.?3276E0.LG6rURKD7PJU93666E0OKGV.RR..7P..?3.66E0OKGV9URKD7PJU93..0E(OKG..SR.D7PJU93666E0.NGV<URKD7PJU93666E0OKGV9URKD7Pd!\KB66E.>NGV)URK62PJQ93666E0OKGV9URkD70d']RBW6E.6JGV.PRK>6PJ#<3666E0OKGV9UR.D7.d1XGW66Et.KGV)RRKJ7PJ.?3666E0OKGV9UR.D7.d!U@666E9OKGVIRRKF7PJ.?3666E0OKGV9UR.D7.d2_ZRE6E.MKGV.RRK@7PJU>3666E0OKGV9UR.D7.d'JAU66EP.KGV.RRK.7PJQ>3666E0OKGV9UR.D7.d'\_YU6E.tKGV.RRKx7PJ.>3666E0OKGV9UR.D7.JU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKGV9URKD7PJU93666E0OKG

C:\Users\user\AppData\Local\directory\RegAsymX.exe

Process:	C:\Users\user\Desktop\3TpW2Sn68z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1426944
Entropy (8bit):	7.297149515691595
Encrypted:	false
SSDEEP:	24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aIHo9Hi9Yc1St1R1M9p09oMMhDIGL0:2TvC/MTQYxsWR7aIHEC+coJ1OpwoMMhv
MD5:	C7FC0CEE8CA35D709ED276E9F88DDBED
SHA1:	CEEA9D76BF0429872F4D7420ADDD0ABDB5E8F4DC
SHA-256:	560DEF626FC69A10E4979B67107EFAAD102E2A01CE4733D005003DD47437A30E
SHA-512:	A1B93C9CB87993F77F2DECF0E4EE33277567651D7FB664B579F3E293F97C6B198CE701C02CFFD9D295B3E40F62CD6500F55BC252212C5EC81AC9E257831273DA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...j..f..........".................w.............@.......................... ......Q.....@...@.......@.....................d...\|....@...[.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....[...@...\..................@..@.reloc...u.......v...P..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Process:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
File Type:	data
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.4552422796735183
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfcloRKUEZ+lX1Al1A3lCatIBnriIM8lfQVn:DsO+vNloRKQ1A1g2mA2n
MD5:	E1B0A49C9952B924EBAD02E735AF889A
SHA1:	20A242A5C2B145769AFE8576A9783E72AFBE0364
SHA-256:	F41741E3B63854908BC9B70DABB6958E2C75087D463834AD0856DCD4447665E6
SHA-512:	E195CF020E1A376B536603E013E329814347F62CADFA3F0022F57DC1B15F04651273D28ACF7950A722FECE41C2436539850339029CF2BB75836E94A522383DF6
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.d.i.r.e.c.t.o.r.y.\.R.e.g.A.s.y.m.X...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466203376089056
Encrypted:	false
SSDEEP:	6144:wIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNqdwBCswSbZ:VXD94+WlLZMM6YFHI+Z
MD5:	71734B7E1DA5762F12DE83A7C426C47D
SHA1:	CE14CBF3763A92E892D6D1918039883A00658DAA
SHA-256:	A52D6D2C6E33F118412E1ED1899B0ED24ED601012D3DA92A9AF7E3C5F2CFA5CD
SHA-512:	96BE3673C5448462057AE2D0DBB52E2F2468C412CEA455FAC04984B4F2D8A7140880CF91A349EDDE98530FC278D3C4F16BCB63E73BDB6AA60157F8D717E99E2B
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmF...................................................................................................................................................................................................................................................................................................................................................m...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.297149515691595
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3TpW2Sn68z.exe
File size:	1'426'944 bytes
MD5:	c7fc0cee8ca35d709ed276e9f88ddbed
SHA1:	ceea9d76bf0429872f4d7420addd0abdb5e8f4dc
SHA256:	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e
SHA512:	a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da
SSDEEP:	24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aIHo9Hi9Yc1St1R1M9p09oMMhDIGL0:2TvC/MTQYxsWR7aIHEC+coJ1OpwoMMhv
TLSH:	EB65D00273D1C062FF9B92734B9AF6115BBC79260123AA1F13A81D7ABD701B1563E763
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C4846A [Tue Aug 20 11:56:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FE5E8CA9013h
jmp 00007FE5E8CA891Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE5E8CA8AFDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE5E8CA8ACAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FE5E8CAB6BDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FE5E8CAB708h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FE5E8CAB6F1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x85b04	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15a000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x85b04	0x85c00	026debb6a481ad8c2dafe1207de58f51	False	0.9509747371495327	data	7.941152305886364	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15a000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x7cdcc	data			1.0003245762910706
RT_GROUP_ICON	0x159584	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1595fc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x159610	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x159624	0x14	data	English	Great Britain	1.25
RT_VERSION	0x159638	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x159714	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-05T14:17:21.343263+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49730	84.38.132.103	7001	TCP
2024-09-05T14:17:43.736278+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	53009	84.38.132.103	7001	TCP
2024-09-05T14:18:06.103034+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	53013	84.38.132.103	7001	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 14:16:59.959072113 CEST	49730	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:16:59.964044094 CEST	7001	49730	84.38.132.103	192.168.2.4
Sep 5, 2024 14:16:59.964139938 CEST	49730	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:16:59.968744993 CEST	49730	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:16:59.973802090 CEST	7001	49730	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:21.343199968 CEST	7001	49730	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:21.343262911 CEST	49730	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:21.343383074 CEST	49730	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:21.348794937 CEST	7001	49730	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:22.348432064 CEST	53009	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:22.353336096 CEST	7001	53009	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:22.353423119 CEST	53009	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:22.357135057 CEST	53009	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:22.362447023 CEST	7001	53009	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:43.736099005 CEST	7001	53009	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:43.736278057 CEST	53009	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:43.736347914 CEST	53009	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:43.741338968 CEST	7001	53009	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:44.742913008 CEST	53013	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:44.748009920 CEST	7001	53013	84.38.132.103	192.168.2.4
Sep 5, 2024 14:17:44.748114109 CEST	53013	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:44.767834902 CEST	53013	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:17:44.772671938 CEST	7001	53013	84.38.132.103	192.168.2.4
Sep 5, 2024 14:18:06.102931023 CEST	7001	53013	84.38.132.103	192.168.2.4
Sep 5, 2024 14:18:06.103034019 CEST	53013	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:18:06.103122950 CEST	53013	7001	192.168.2.4	84.38.132.103
Sep 5, 2024 14:18:06.107887030 CEST	7001	53013	84.38.132.103	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 14:17:16.261231899 CEST	53	55982	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	08:16:55
Start date:	05/09/2024
Path:	C:\Users\user\Desktop\3TpW2Sn68z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3TpW2Sn68z.exe"
Imagebase:	0x560000
File size:	1'426'944 bytes
MD5 hash:	C7FC0CEE8CA35D709ED276E9F88DDBED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	08:16:56
Start date:	05/09/2024
Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3TpW2Sn68z.exe"
Imagebase:	0x7e0000
File size:	1'426'944 bytes
MD5 hash:	C7FC0CEE8CA35D709ED276E9F88DDBED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:16:57
Start date:	05/09/2024
Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Imagebase:	0x7e0000
File size:	1'426'944 bytes
MD5 hash:	C7FC0CEE8CA35D709ED276E9F88DDBED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	08:16:59
Start date:	05/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x900000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	08:17:02
Start date:	05/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568
Imagebase:	0x500000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	08:17:08
Start date:	05/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"
Imagebase:	0x7ff66f9c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	08:17:09
Start date:	05/09/2024
Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Imagebase:	0x7e0000
File size:	1'426'944 bytes
MD5 hash:	C7FC0CEE8CA35D709ED276E9F88DDBED
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false