Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe

PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy:	7.780636801665315
Filename:	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Filesize:	238592
MD5:	e6fb3c2d5e9f76ca4baf55502ff092d7
SHA1:	5d342d87ce25d4ed552c0d93dd8d901991d9eb3f
SHA256:	f8bc2849bf3f4a9ce0aba93aba2d9eb3f2bd55b03f7a8a6325cca1279c8d92b4
SHA512:	ce0f53df6882651a659fa869e0722feca19c9ac7e3f8e66387c283e6e49abd5cf944c4ca6b28c784bc292a8713afd4cf5282fa94d8dfc8db7db75064081bfab0
SSDEEP:	6144:LUlYMbAiFZx5pq6G1hYtOa0aIuoeFSGVuOVt3E8:SY2VpFihYEmlFL4OVpF
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.-H..~H..~H..~..'~[..~..%~...~..$~V..~AbR~I..~...~J..~.D..R..~.D..r..~.D..j..~AbE~Q..~H..~v..~.D..,..~.D)~I..~.D..I..~RichH..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Ingress Tool Transfer
Machine Learning detection for sample	AV Detection
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Ingress Tool Transfer
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Detected potential crypto function	System Summary	Access Token Manipulation Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Might use command line arguments	System Summary	Masquerading
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
Category:	dropped
Dump:	json[1].json.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Type:	JSON data
Entropy:	5.0171731747546415
Encrypted:	false
Ssdeep:	12:tkTLJend6CsGkMyGWKyGXPVGArwY3AoQasHuGvB+Arpv/mOAaNO+ao9W7iN5zzkq:qpSdRNuKyGX85MEBZvXhNlT3/7l1DYro
Size:	956
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe

"C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1480
Target ID:	0
Parent PID:	1028
Name:	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Commandline:	"C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe"
Size:	238592
MD5:	E6FB3C2D5E9F76CA4BAF55502FF092D7
Time:	10:43:55
Date:	18/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	565248
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Public key (encryption) found	Cryptography	Archive Collected Data
Sample is known by Antivirus	System Summary

URLs

Name

Malicious

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Suricata IDS alerts with low severity for network traffic	Networking
URLs found in memory or binary data	Networking

http://geoplugin.net/O

unknown

Details

Name:	http://geoplugin.net/O
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Source:	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000003.2048111706.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, 172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000002.4483129441.0000000000700000.00000004.00000020.00020000.00000000.sdmp, 172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000003.2048221416.00000000006FE000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpq

unknown

Details

Name:	http://geoplugin.net/json.gpq
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Source:	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000002.4483018836.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, 172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000003.2048111706.00000000006CE000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpE

unknown

Details

Name:	http://geoplugin.net/json.gpE
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Source:	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000002.4483018836.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, 172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000003.2048111706.00000000006CE000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Source:	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe, 00000000.00000002.4482591118.0000000000401000.00000040.00000001.01000000.00000003.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

198.187.3.20.in-addr.arpa

unknown

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

23.227.193.34

unknown

United States

Details

IP:	23.227.193.34
TargetID:	0
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Country:	United States
Countrycode:	USA
ASN number:	29802
ASN name:	HVC-ASUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	0
Current Path:	C:\Users\user\Desktop\172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-13UDOF

exepath

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Rmc-13UDOF
Value name:	exepath
Value data:	A1 1E AF 39 34 BF 54 AC F6 CA 36 15 E2 FD B1 F5 4E 32 E8 03 15 6B 56 77 4D 53 C1 4D 39 87 69 23 C7 B8 EE C1 CD 1B 2D 99 D1 79 4C 1B D5 5D EB F6 E8 97 D3 94 85 64 EA 4C 52 40 46 A1 A3 3B F5 D6 02 6F 99 9D 30 DA FE 1D DD E3 12 40 22 21 C6 4E DB 00 C5 13 26 0B D7 A0 3C 1F 70 2C 75 E9 C2 A3 46 0B 75 DE 01 41 84 30 32 5F 90 74 C3 D5 E5 BB 70 EF A6 02 F2 A9 67 9A 04 60 80 9A 82 48 9F 60 A2 28 72 DA 13 A2 4E CE FC D2 51 D7 22 1C 10 5E 37 F4 03 53 FA 92 E4 F0 D0 44 9D F7 0B DE 97 AA FB 32 CF 89 26 59 22 AF B2 BF FD 68 DE 43 22 DD D4 DC 0F 89 8E CE FE F8 92 1B 94 4C 59 7F 1C DD AD 55 F9 02 8D 44 35 CD 5F D2 E0 3A 3F 9E 1C 20 98 74 5F C8 D3 AC CF 03 CC 0F F4 B6 6B 97 17 F3 61 FD 8B 10 25 17 10 91 25 36 9E 00

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information

HKEY_CURRENT_USER\SOFTWARE\Rmc-13UDOF

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-13UDOF

time

Memdumps

Base Address

Regiontype

Protect

Malicious

68E000

heap

page read and write

401000

unkown

page execute and read and write

228C000

heap

page read and write

707000

heap

page read and write

2280000

heap

page read and write

485000

unkown

page write copy

707000

heap

page read and write

650000

heap

page read and write

6CE000

heap

page read and write

64E000

stack

page read and write

6F8000

heap

page read and write

2D2E000

stack

page read and write

560000

heap

page read and write

6EF000

heap

page read and write

707000

heap

page read and write

6BF000

heap

page read and write

6F8000

heap

page read and write

478000

unkown

page execute and read and write

6CE000

heap

page read and write

1F0000

heap

page read and write

247F000

stack

page read and write

B60000

heap

page read and write

400000

unkown

page readonly

700000

heap

page read and write

400000

unkown

page readonly

87F000

stack

page read and write

719000

heap

page read and write

227F000

stack

page read and write

70F000

heap

page read and write

719000

heap

page read and write

5BE000

stack

page read and write

2E2F000

stack

page read and write

680000

heap

page read and write

576000

heap

page read and write

474000

unkown

page execute and read and write

6FE000

heap

page read and write

482000

unkown

page execute and read and write

68A000

heap

page read and write

B4E000

stack

page read and write

9C000

stack

page read and write

484000

unkown

page execute and write copy

570000

heap

page read and write

47D000

unkown

page execute and read and write

485000

unkown

page read and write

70F000

heap

page read and write

471000

unkown

page execute and read and write

6EF000

heap

page read and write

719000

heap

page read and write

19D000

stack

page read and write

44F000

unkown

page execute and write copy

70F000

heap

page read and write

There are 41 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe