Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SC_TR126089907.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.886043126359652
Filename:	SC_TR126089907.exe
Filesize:	1132032
MD5:	d8f15666d25a32702106b56dfd962cd6
SHA1:	b680052ba6f10f87595df8e6f06065546109c9e2
SHA256:	b0724a50f077a8652bbe0972e059aadde07ea247057e239b8b28ed720a083ae8
SHA512:	0bda9df65f34d05ff4448783bd0c747631621bdea98d716f3b3fb77f6b05784efd4aa67cf55e60e966375e2590df7bb30f4651865345f0995f50fcad31458f8b
SSDEEP:	24576:e2xjcLCnYnIXrbmcfjyTinYxorzPMFZYXX+Wjj8GLgv:lZnYIXrbFm6YSzPwYXX+G4GL
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Gg..............0......\........... ... ....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation
.NET source code contains potential unpacker	Data Obfuscation	Access Token Manipulation
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools Input Capture
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Machine Learning detection for sample	AV Detection
Abnormal high CPU Usage	System Summary	Access Token Manipulation
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery Ingress Tool Transfer
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Process Discovery
Enables debug privileges	Anti Debugging
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	File and Directory Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API System Information Discovery
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Queries a list of all running processes	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary
Uses Microsoft Silverlight	System Summary	Access Token Manipulation

C:\ProgramData\remcos\logs.dat

data

dropped

Details

File:	C:\ProgramData\remcos\logs.dat
Category:	dropped
Dump:	logs.dat.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Users\user\Desktop\SC_TR126089907.exe
Type:	data
Entropy:	3.402054886640339
Encrypted:	false
Ssdeep:	3:rhlKlf3FbQRQ55JWRal2Jl+7R0DAlBG45klovDl6v:6lf32C55YcIeeDAlOWAv
Size:	144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SC_TR126089907.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SC_TR126089907.exe.log
Category:	dropped
Dump:	SC_TR126089907.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SC_TR126089907.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json
Category:	dropped
Dump:	json[1].json.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Users\user\Desktop\SC_TR126089907.exe
Type:	JSON data
Entropy:	5.013758486871551
Encrypted:	false
Ssdeep:	12:tkluJnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkw7x:qluNdVauKyGX85jvXhNlT3/7AcV9Wro
Size:	963
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SC_TR126089907.exe

"C:\Users\user\Desktop\SC_TR126089907.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7448
Target ID:	0
Parent PID:	2580
Name:	SC_TR126089907.exe
Class:	system-tools
Path:	C:\Users\user\Desktop\SC_TR126089907.exe
Commandline:	"C:\Users\user\Desktop\SC_TR126089907.exe"
Size:	1132032
MD5:	D8F15666D25A32702106B56DFD962CD6
Time:	07:51:54
Date:	28/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x790000
Modulesize:	1155072
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\SC_TR126089907.exe

"C:\Users\user\Desktop\SC_TR126089907.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7580
Target ID:	2
Parent PID:	7448
Name:	SC_TR126089907.exe
Class:	system-tools
Path:	C:\Users\user\Desktop\SC_TR126089907.exe
Commandline:	"C:\Users\user\Desktop\SC_TR126089907.exe"
Size:	1132032
MD5:	D8F15666D25A32702106B56DFD962CD6
Time:	07:51:56
Date:	28/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe0000
Modulesize:	1155072
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\SC_TR126089907.exe

"C:\Users\user\Desktop\SC_TR126089907.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7588
Target ID:	3
Parent PID:	7448
Name:	SC_TR126089907.exe
Class:	system-tools
Path:	C:\Users\user\Desktop\SC_TR126089907.exe
Commandline:	"C:\Users\user\Desktop\SC_TR126089907.exe"
Size:	1132032
MD5:	D8F15666D25A32702106B56DFD962CD6
Time:	07:51:56
Date:	28/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x5a0000
Modulesize:	1155072
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

URLs

Name

Malicious

yayabeloo.duckdns.org

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.fontbureau.com/designersG

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.fontbureau.com/designers?

unknown

http://www.tiro.com

unknown

https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac

unknown

http://geoplugin.net/son.gp

unknown

http://www.fontbureau.com/designers

unknown

http://geoplugin.net/json.gpQQJ

unknown

http://www.goodfont.co.kr

unknown

http://geoplugin.net/json.gpSystem32

unknown

http://www.carterandcone.coml

unknown

http://geoplugin.net/json.gp=

unknown

http://www.sajatypeworks.com

unknown

http://geoplugin.net/json.gp

178.237.33.50

http://www.typography.netD

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

http://geoplugin.net/json.gp/C

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.fontbureau.com/designers8

unknown

http://geoplugin.net/json.gpzb

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://www.sakkal.com

unknown

There are 24 hidden URLs, click here to show them.

Domains

Name

Malicious

yayabeloo.duckdns.org

135.148.195.248

Details

Name:	yayabeloo.duckdns.org
IP:	135.148.195.248
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

135.148.195.248

yayabeloo.duckdns.org

United States

Details

IP:	135.148.195.248
TargetID:	3
Current Path:	C:\Users\user\Desktop\SC_TR126089907.exe
Country:	United States
Countrycode:	USA
ASN number:	18676
ASN name:	AVAYAUS
Private:	false
Domain:	yayabeloo.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	3
Current Path:	C:\Users\user\Desktop\SC_TR126089907.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-VPA6N9

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-VPA6N9

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-VPA6N9

time

Memdumps

Base Address

Regiontype

Protect

Malicious

400000

remote allocation

page execute and read and write

469D000

trusted library allocation

page read and write

3B92000

trusted library allocation

page read and write

28DF000

stack

page read and write

BF7000

heap

page read and write

3B59000

trusted library allocation

page read and write

5660000

trusted library section

page read and write

2BA9000

trusted library allocation

page read and write

C36000

heap

page read and write

7730000

trusted library section

page read and write

7E2E000

heap

page read and write

E46000

heap

page read and write

5030000

trusted library allocation

page read and write

514B000

trusted library allocation

page read and write

297B000

trusted library allocation

page execute and read and write

7BCE000

stack

page read and write

7E72000

heap

page read and write

1330000

trusted library allocation

page read and write

E0E000

stack

page read and write

1324000

trusted library allocation

page read and write

506D000

trusted library allocation

page read and write

2A1B000

stack

page read and write

12E0000

heap

page read and write

AFC000

stack

page read and write

E1A000

heap

page read and write

50D0000

trusted library allocation

page read and write

93A000

stack

page read and write

9A0000

heap

page read and write

274E000

stack

page read and write

5170000

heap

page read and write

5E27000

heap

page read and write

E50000

heap

page read and write

5120000

heap

page read and write

7C0000

heap

page read and write

565E000

stack

page read and write

5090000

trusted library allocation

page read and write

9B0000

heap

page read and write

29DF000

stack

page read and write

5710000

trusted library allocation

page read and write

361E000

stack

page read and write

50A5000

trusted library allocation

page read and write

CF0000

heap

page read and write

2B51000

trusted library allocation

page read and write

27CC000

stack

page read and write

4B58000

trusted library allocation

page read and write

371F000

stack

page read and write

BD0000

heap

page read and write

BF0000

heap

page read and write

7B8E000

stack

page read and write

5440000

trusted library section

page readonly

278C000

stack

page read and write

1323000

trusted library allocation

page execute and read and write

5720000

trusted library allocation

page execute and read and write

2977000

trusted library allocation

page execute and read and write

114E000

stack

page read and write

5072000

trusted library allocation

page read and write

6F40000

trusted library allocation

page read and write

133D000

trusted library allocation

page execute and read and write

1310000

trusted library allocation

page read and write

5080000

trusted library allocation

page read and write

542A000

trusted library allocation

page read and write

50B0000

trusted library allocation

page read and write

E2E000

stack

page read and write

5070000

trusted library allocation

page read and write

92EE000

stack

page read and write

6F62000

trusted library allocation

page read and write

C6C000

heap

page read and write

E1E000

heap

page read and write

53A0000

heap

page execute and read and write

6F20000

trusted library allocation

page execute and read and write

B950000

heap

page read and write

5600000

heap

page read and write

9E0000

heap

page read and write

5610000

heap

page read and write

2ADF000

stack

page read and write

5DFE000

heap

page read and write

5410000

trusted library allocation

page read and write

2990000

trusted library allocation

page read and write

9B5000

heap

page read and write

27D0000

heap

page read and write

55F0000

trusted library allocation

page execute and read and write

2B4E000

stack

page read and write

53FB000

stack

page read and write

C55000

heap

page read and write

7E24000

heap

page read and write

7E28000

heap

page read and write

E10000

heap

page read and write

74C000

stack

page read and write

E53000

heap

page read and write

D00000

heap

page read and write

29DE000

stack

page read and write

2C1F000

stack

page read and write

2970000

trusted library allocation

page read and write

132D000

trusted library allocation

page execute and read and write

2972000

trusted library allocation

page read and write

7E5000

heap

page read and write

100E000

stack

page read and write

2A30000

heap

page execute and read and write

7B0000

heap

page read and write

2A20000

trusted library allocation

page execute and read and write

7B4E000

stack

page read and write

5140000

trusted library allocation

page read and write

296A000

trusted library allocation

page execute and read and write

1320000

trusted library allocation

page read and write

5150000

trusted library allocation

page read and write

1340000

heap

page read and write

7C0E000

stack

page read and write

CF7000

stack

page read and write

5066000

trusted library allocation

page read and write

4CEC000

stack

page read and write

5130000

trusted library allocation

page execute and read and write

792000

unkown

page readonly

5390000

trusted library allocation

page read and write

3B51000

trusted library allocation

page read and write

5110000

heap

page read and write

5044000

trusted library allocation

page read and write

5040000

trusted library allocation

page read and write

7E52000

heap

page read and write

5061000

trusted library allocation

page read and write

9C0000

heap

page read and write

2B96000

trusted library allocation

page read and write

7F100000

trusted library allocation

page execute and read and write

55ED000

stack

page read and write

2D5F000

stack

page read and write

C63000

heap

page read and write

50A0000

trusted library allocation

page read and write

7E66000

heap

page read and write

7340000

heap

page read and write

5DE0000

heap

page read and write

8A2000

unkown

page readonly

505E000

trusted library allocation

page read and write

5DF0000

heap

page read and write

BC4F000

stack

page read and write

2966000

trusted library allocation

page execute and read and write

134A000

heap

page read and write

7E18000

heap

page read and write

7E10000

heap

page read and write

790000

unkown

page readonly

5615000

heap

page read and write

2962000

trusted library allocation

page read and write

2960000

trusted library allocation

page read and write

473000

remote allocation

page execute and read and write

5430000

heap

page read and write

2C5E000

stack

page read and write

5420000

trusted library allocation

page read and write

5400000

trusted library allocation

page read and write

2A40000

heap

page read and write

5700000

trusted library allocation

page read and write

5142000

trusted library allocation

page read and write

104E000

stack

page read and write

1333000

trusted library allocation

page read and write

2B1D000

stack

page read and write

E38000

heap

page read and write

476000

remote allocation

page execute and read and write

BD4E000

stack

page read and write

5173000

heap

page read and write

F2F000

stack

page read and write

504B000

trusted library allocation

page read and write

7E0000

heap

page read and write

5DDE000

stack

page read and write

BB4E000

stack

page read and write

There are 151 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SC_TR126089907.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSC_TR126089907.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
SC_TR126089907.exe