Edit tour

Windows Analysis Report
ub16vsLP6y.zip

Overview

General Information

Sample name:	ub16vsLP6y.zip renamed because original name is a hash value
Original sample name:	Shared Folders 2023-Documents-185d3ad07050c2100c225b5d2de56c05.zip
Analysis ID:	1514109
MD5:	185d3ad07050c2100c225b5d2de56c05
SHA1:	5adc8c81f93de473591b8cc028334896c2e22f16
SHA256:	c12289182c24af57db335a63c77db2fec8f80b128724fa4fdfdaf6798280b324
Infos:

Detection

Remcos

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Malicious sample detected (through community Yara rule)

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Creates autostart registry keys with suspicious names

Uses cmd line tools excessively to alter registry or file data

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

HTTP GET or POST without a user agent

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Suricata IDS alerts with low severity for network traffic

Uses reg.exe to modify the Windows registry

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6460 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

-1-Shared 2023-Documents pdf.exe (PID: 4248 cmdline: "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe" MD5: 4864A55CFF27F686023456A22371E790)

-1-Shared 2023-Documents pdf.exe (PID: 1732 cmdline: "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe" MD5: 4864A55CFF27F686023456A22371E790)

cmd.exe (PID: 5532 cmdline: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2840 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

-1-Shared 2023-Documents pdf.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe" MD5: 4864A55CFF27F686023456A22371E790)

-1-Shared 2023-Documents pdf.exe (PID: 5488 cmdline: "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe" MD5: 4864A55CFF27F686023456A22371E790)

cmd.exe (PID: 5720 cmdline: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1788 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b162:$a1: Remcos restarted by watchdog! 0x6b6da:$a3: %02i:%02i:%02i:%03i
00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4b8:$a1: Remcos restarted by watchdog! 0x6ca30:$a3: %02i:%02i:%02i:%03i
00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x6650c:$str_a1: C:\Windows\System32\cmd.exe 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6657c:$str_b2: Executing file: 0x675fc:$str_b3: GetDirectListeningPort 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67128:$str_b7: \update.vbs 0x665a4:$str_b9: Downloaded file: 0x66590:$str_b10: Downloading file: 0x66634:$str_b12: Failed to upload file: 0x675c4:$str_b13: StartForward 0x675e4:$str_b14: StopForward 0x67080:$str_b15: fso.DeleteFile " 0x67014:$str_b16: On Error Resume Next 0x670b0:$str_b17: fso.DeleteFolder " 0x66624:$str_b18: Uploaded file: 0x665e4:$str_b19: Unable to delete: 0x67048:$str_b20: while fso.FileExists(" 0x66ac1:$str_c0: [Firefox StoredLogins not found]
00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6638c:$s1: CoGetObject 0x663a0:$s1: CoGetObject 0x663bc:$s1: CoGetObject 0x7035e:$s1: CoGetObject 0x6634c:$s2: Elevation:Administrator!new:
0000000F.00000002.1954934637.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000002.2121841806.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll,EntryPoint, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 2840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*UpdaterCisco

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f , CommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5532, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f , ProcessId: 2840, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit, CommandLine: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe" , ParentImage: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe, ParentProcessId: 4248, ParentProcessName: -1-Shared 2023-Documents pdf.exe, ProcessCommandLine: cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit, ProcessId: 5532, ProcessName: cmd.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: 54 96 57 35 6A A2 4A 7C 67 9B AE 18 FD A7 A0 78 D2 99 D2 BE 5C 24 A9 B0 3C 81 10 9D 5A 9C 34 50 33 58 7A 5E B5 A2 6C D5 B5 A2 46 E1 CF 8C DB 33 B1 66 B8 97 77 1E F1 F0 F8 06 D5 D2 32 80 C6 D7 70 03 A6 22 37 B2 5D EE 44 58 31 7E A4 17 7D A8 68 A1 4A 13 CA 74 65 81 51 7C DB BD 32 D0 C1 98 54 9B 90 37 95 70 42 D4 77 53 21 F4 2F 29 76 54 EE 45 5F E3 33 43 85 23 4D 84 9B 08 6B 5B 2B 51 86 BD CD 55 D7 B5 D8 B4 C8 56 E4 BE 27 4E C0 7D 70 B1 91 DF 6F 27 6B 41 32 54 BC A9 32 3F A2 3A 0D FF 95 6A 42 A3 DB E1 4E 39 53 98 B7 F7 C9 3C 46 D3 F1 DB A9 D4 8B C0 B8 D0 1D D2 20 D1 AA 92 , EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe, ProcessId: 1732, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-ZM1M40\exepath

Suricata Signatures

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-19T20:58:55.032410+0200	2036594	1	Malware Command and Control Activity Detected	192.168.2.16	49710	193.142.146.203	2405	TCP
2024-09-19T20:58:55.032410+0200	2036594	1	Malware Command and Control Activity Detected	192.168.2.16	49710	193.142.146.203	2405	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-19T20:58:56.363452+0200	2803304	3	Unknown Traffic	192.168.2.16	49711	178.237.33.50	80	TCP
2024-09-19T20:58:56.363452+0200	2803304	3	Unknown Traffic	192.168.2.16	49711	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected Remcos RAT

Source: Yara match	File source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1954934637.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2121841806.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.16:49710 -> 193.142.146.203:2405

Source: global traffic

TCP traffic: 192.168.2.16:49710 -> 193.142.146.203:2405

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.16:49711 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.203

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geoplugin.net

Source: Yara match	File source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1954934637.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2121841806.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f

Source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal96.troj.expl.winZIP@17/1@1/12

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe

File created: C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4680:120:WilError_03

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
Source: unknown	Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: oledlg.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: k7rn7l32.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ntd3ll.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: oledlg.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: k7rn7l32.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ntd3ll.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: ub16vsLP6y.zip

Static file information: File size 67258370 > 1048576

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Windows\SysWOW64\reg.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *UpdaterCisco

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *UpdaterCisco
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run *UpdaterCisco

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe TID: 4180

Thread sleep time: -33000s >= -30000s

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe

Process created: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe "C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe"

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\user\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1954934637.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2121841806.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-ZM1M40
Source: C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-ZM1M40

Yara detected Remcos RAT

Source: Yara match	File source: 00000007.00000002.1655583711.0000000010248000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1654569565.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1954934637.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2121841806.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Disable or Modify Tools	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.142.146.203	unknown	Netherlands		208046	HOSTSLICK-GERMANYNL	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1514109
Start date and time:	2024-09-19 20:57:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	ub16vsLP6y.zip renamed because original name is a hash value
Original Sample Name:	Shared Folders 2023-Documents-185d3ad07050c2100c225b5d2de56c05.zip
Detection:	MAL
Classification:	mal96.troj.expl.winZIP@17/1@1/12
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ub16vsLP6y.zip

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\json[1].json

Download File

Process:	C:\Users\user\Desktop\ub16vsLP6y\Shared Folders 2023-Documents\-1-Shared 2023-Documents pdf.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013130376969173
Encrypted:	false
SSDEEP:
MD5:	F61E5CC20FBBA892FF93BFBFC9F41061
SHA1:	36CD25DFAD6D9BC98697518D8C2F5B7E12A5864E
SHA-256:	28B330BB74B512AFBD70418465EC04C52450513D3CC8609B08B293DBEC847568
SHA-512:	5B6AD2F42A82AC91491C594714638B1EDCA26D60A9932C96CBA229176E95CA3FD2079B68449F62CBFFFFCA5DA6F4E25B7B49AF8A8696C95A4F11C54BCF451933
Malicious:	false
Reputation:	unknown
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=store
Entropy (8bit):	7.997794270983537
TrID:	ZIP compressed archive (8000/1) 99.91% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
File name:	ub16vsLP6y.zip
File size:	67'258'370 bytes
MD5:	185d3ad07050c2100c225b5d2de56c05
SHA1:	5adc8c81f93de473591b8cc028334896c2e22f16
SHA256:	c12289182c24af57db335a63c77db2fec8f80b128724fa4fdfdaf6798280b324
SHA512:	44c65a32236cf1f9534ebba4077c7aecec017244716736b0e33c487d9ffdbd85a93b76a35b20053ca16e765876d5ad0b9febd0a6f047bcd17f9f393cbd40e447
SSDEEP:	1572864:I/8Ep7PnCeq2FMPjeyJ445zHx6lfCdiGbHQuWCagVjhrdi6TiH:I7ZPvnM7elgzHclfUbzva2FrM2iH
TLSH:	83E733A15C2DF4241E0EE599A76E701CBDAB25B1D26F7E452DC9C403A40CEAF2874BCD
File Content Preview:	PK.........k3Y............ ...Shared Folders 2023-Documents/-/PK.........k3YT..{....ju..,...Shared Folders 2023-Documents/-/REname_mebb3.{.<\.....!....A..`...>:A.D...w.......=z.....=J.h1.F....7.9.=.....w..ky..O.?e=.=g.X,..+H.1.08BF"...:.......Z;...X{[.Ca\|

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ub16vsLP6y.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\json[1].json

Static File Info

General

File Icon

Windows Analysis Report
ub16vsLP6y.zip