Windows Analysis Report
MLxloAVuCZ.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3876562999.0000000003200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876896183.0000000004E1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876601412.0000000003212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\miaou\derogates.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: MLxloAVuCZ.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		3_2_004338C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		7_2_004338C8

Source: derogates.exe, 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_f5729dfa-0

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00407538 _wcslen,CoGetObject,		3_2_00407538
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00407538 _wcslen,CoGetObject,		7_2_00407538

Source: MLxloAVuCZ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: derogates.exe, 00000002.00000003.1452126318.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000002.00000003.1451776465.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1565765032.0000000003680000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1567346824.0000000003570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: derogates.exe, 00000002.00000003.1452126318.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000002.00000003.1451776465.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1565765032.0000000003680000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1567346824.0000000003570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: svchost.exe, 00000003.00000003.1455985205.0000000003021000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1456512162.0000000002FC0000.00000040.10000000.00040000.00000000.sdmp, iexplore.exe, iexplore.exe, 00000004.00000002.1456171063.0000000000630000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: svchost.exe, 00000003.00000003.1455985205.0000000003021000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1456512162.0000000002FC0000.00000040.10000000.00040000.00000000.sdmp, iexplore.exe, 00000004.00000002.1456171063.0000000000630000.00000040.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0010445A
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010C6D1 FindFirstFileW,FindClose,	0_2_0010C6D1
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0010C75C
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0010EF95
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0010F0F2
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0010F3F3
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_001037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_001037EF
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00103B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00103B12
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0010BCBC
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0091445A
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091C6D1 FindFirstFileW,FindClose,	2_2_0091C6D1
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0091C75C
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0091EF95
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0091F0F2
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0091F3F3
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_009137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_009137EF
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00913B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00913B12
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0091BCBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00407877 FindFirstFileW,FindNextFileW,	3_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0044E8F9 FindFirstFileExA,	3_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	7_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	7_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	7_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	7_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	7_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00407877 FindFirstFileW,FindNextFileW,	7_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0044E8F9 FindFirstFileExA,	7_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	7_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	7_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	7_2_0040BD72

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00407CD2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:63891 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49804 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49802 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49803 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:63892 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49799 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49705 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49805 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49801 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49806 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49800 -> 192.3.64.152:2559
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.8:49807 -> 192.3.64.152:2559

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 192.3.64.152 2559

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 192.3.64.152

Source: global traffic	TCP traffic: 192.168.2.8:49796 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:63886 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 192.3.64.152 192.3.64.152

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: unknown

DNS traffic detected: query: 171.39.242.20.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_001122EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_001122EE

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: svchost.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: derogates.exe, 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, derogates.exe, 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

3_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\SysWOW64\svchost.exe

Windows user hook set: 0 keyboard low level C:\Windows\SysWOW64\svchost.exe

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_00114164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00114164

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00114164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00114164
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00924164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00924164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	3_2_004168FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	7_2_004168FC

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_00113F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00113F66

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_0010001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0010001C

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0012CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_0012CABC
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0093CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_0093CABC

Source: Yara match	File source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3876562999.0000000003200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876896183.0000000004E1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876601412.0000000003212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041CA73 SystemParametersInfoW,		3_2_0041CA73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041CA73 SystemParametersInfoW,		7_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: This is a third-party compiled AutoIt script.	0_2_000A3B3A
Source: MLxloAVuCZ.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: MLxloAVuCZ.exe, 00000000.00000003.1433226327.0000000003B83000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1ee70dea-6
Source: MLxloAVuCZ.exe, 00000000.00000003.1433226327.0000000003B83000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_b66d9bf2-6
Source: MLxloAVuCZ.exe, 00000000.00000000.1423016365.0000000000154000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e0156cda-a
Source: MLxloAVuCZ.exe, 00000000.00000000.1423016365.0000000000154000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_e7a032b9-b
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: This is a third-party compiled AutoIt script.	2_2_008B3B3A
Source: derogates.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: derogates.exe, 00000002.00000000.1433722723.0000000000964000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d3897278-b
Source: derogates.exe, 00000002.00000000.1433722723.0000000000964000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_a2da74e1-4
Source: derogates.exe, 00000006.00000002.1569373716.0000000000964000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_359de1fa-4
Source: derogates.exe, 00000006.00000002.1569373716.0000000000964000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_f5f63f53-4
Source: MLxloAVuCZ.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5571c604-5
Source: MLxloAVuCZ.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_b085a12c-6
Source: derogates.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2196b966-a
Source: derogates.exe.0.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_ab4b6369-6

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Windows\SysWOW64\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	3_2_0041812A
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633360 ExitProcess,NtSetInformationProcess,SetErrorMode,	4_2_00633360
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_006333C0 NtSetInformationProcess,SetErrorMode,	4_2_006333C0

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_0010A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0010A1EF

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000F8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_000F8310

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_001051BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_001051BD
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_009151BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	2_2_009151BD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	3_2_004167EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	7_2_004167EF

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000CD975	0_2_000CD975
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C21C5	0_2_000C21C5
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000D62D2	0_2_000D62D2
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_001203DA	0_2_001203DA
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000D242E	0_2_000D242E
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C25FA	0_2_000C25FA
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000FE616	0_2_000FE616
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000AE6A0	0_2_000AE6A0
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B66E1	0_2_000B66E1
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000D878F	0_2_000D878F
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B8808	0_2_000B8808
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00120857	0_2_00120857
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000D6844	0_2_000D6844
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00108889	0_2_00108889
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000CCB21	0_2_000CCB21
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000D6DB6	0_2_000D6DB6
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B6F9E	0_2_000B6F9E
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B3030	0_2_000B3030
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C3187	0_2_000C3187
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000CF1D9	0_2_000CF1D9
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000A1287	0_2_000A1287
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C1484	0_2_000C1484
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B5520	0_2_000B5520
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C7696	0_2_000C7696
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B5760	0_2_000B5760
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C1978	0_2_000C1978
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000D9AB5	0_2_000D9AB5
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000AFCE0	0_2_000AFCE0
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C1D90	0_2_000C1D90
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000CBDA6	0_2_000CBDA6
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00127DDB	0_2_00127DDB
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000ADF00	0_2_000ADF00
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000B3FE0	0_2_000B3FE0
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_01377E78	0_2_01377E78
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008DD975	2_2_008DD975
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D21C5	2_2_008D21C5
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008E62D2	2_2_008E62D2
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_009303DA	2_2_009303DA
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008E242E	2_2_008E242E
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D25FA	2_2_008D25FA
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008BE6A0	2_2_008BE6A0
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C66E1	2_2_008C66E1
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0090E616	2_2_0090E616
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008E878F	2_2_008E878F
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00918889	2_2_00918889
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C8808	2_2_008C8808
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00930857	2_2_00930857
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008E6844	2_2_008E6844
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008DCB21	2_2_008DCB21
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008E6DB6	2_2_008E6DB6
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C6F9E	2_2_008C6F9E
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C3030	2_2_008C3030
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D3187	2_2_008D3187
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008DF1D9	2_2_008DF1D9
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008B1287	2_2_008B1287
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D1484	2_2_008D1484
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C5520	2_2_008C5520
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D7696	2_2_008D7696
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C5760	2_2_008C5760
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D1978	2_2_008D1978
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008E9AB5	2_2_008E9AB5
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008BFCE0	2_2_008BFCE0
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D1D90	2_2_008D1D90
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008DBDA6	2_2_008DBDA6
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00937DDB	2_2_00937DDB
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008C3FE0	2_2_008C3FE0
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008BDF00	2_2_008BDF00
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_01486940	2_2_01486940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043706A	3_2_0043706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00414005	3_2_00414005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043E11C	3_2_0043E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004541D9	3_2_004541D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004381E8	3_2_004381E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041F18B	3_2_0041F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00446270	3_2_00446270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043E34B	3_2_0043E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004533AB	3_2_004533AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0042742E	3_2_0042742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00437566	3_2_00437566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043E5A8	3_2_0043E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004387F0	3_2_004387F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043797E	3_2_0043797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004339D7	3_2_004339D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0044DA49	3_2_0044DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00427AD7	3_2_00427AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041DBF3	3_2_0041DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00427C40	3_2_00427C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00437DB3	3_2_00437DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00435EEB	3_2_00435EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043DEED	3_2_0043DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00426E9F	3_2_00426E9F
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00632720	4_2_00632720
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 6_2_00F20760	6_2_00F20760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043706A	7_2_0043706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00414005	7_2_00414005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043E11C	7_2_0043E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004541D9	7_2_004541D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004381E8	7_2_004381E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041F18B	7_2_0041F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00446270	7_2_00446270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043E34B	7_2_0043E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004533AB	7_2_004533AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042742E	7_2_0042742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00437566	7_2_00437566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043E5A8	7_2_0043E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004387F0	7_2_004387F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043797E	7_2_0043797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004339D7	7_2_004339D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0044DA49	7_2_0044DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00427AD7	7_2_00427AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041DBF3	7_2_0041DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00427C40	7_2_00427C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00437DB3	7_2_00437DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00435EEB	7_2_00435EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043DEED	7_2_0043DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00426E9F	7_2_00426E9F

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00401E65 appears 68 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00401FAB appears 38 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: String function: 008D8900 appears 42 times
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: String function: 008D0AE3 appears 70 times
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: String function: 008B7DE1 appears 35 times
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: String function: 000A7DE1 appears 35 times
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: String function: 000C8900 appears 42 times
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: String function: 000C0AE3 appears 70 times

Source: MLxloAVuCZ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@12/7@1/1

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_0010A06A GetLastError,FormatMessageW,

0_2_0010A06A

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000F81CB AdjustTokenPrivileges,CloseHandle,	0_2_000F81CB
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000F87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_000F87E1
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_009081CB AdjustTokenPrivileges,CloseHandle,	2_2_009081CB
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_009087E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_009087E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	3_2_0041798D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	7_2_0041798D

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_0010B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0010B333

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_0011EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0011EE0D

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_0010C397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0010C397

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_000A4E89

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_0041AADB

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

File created: C:\Users\user\AppData\Local\miaou

Source: C:\Windows\SysWOW64\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-ZFXG9Y

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

File created: C:\Users\user\AppData\Local\Temp\aut92C7.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs"

Source: MLxloAVuCZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: MLxloAVuCZ.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

File read: C:\Users\user\Desktop\MLxloAVuCZ.exe

Source: unknown	Process created: C:\Users\user\Desktop\MLxloAVuCZ.exe "C:\Users\user\Desktop\MLxloAVuCZ.exe"
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Process created: C:\Users\user\AppData\Local\miaou\derogates.exe "C:\Users\user\Desktop\MLxloAVuCZ.exe"
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MLxloAVuCZ.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "c:\program files (x86)\internet explorer\iexplore.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\miaou\derogates.exe "C:\Users\user\AppData\Local\miaou\derogates.exe"
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\miaou\derogates.exe"
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Process created: C:\Users\user\AppData\Local\miaou\derogates.exe "C:\Users\user\Desktop\MLxloAVuCZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MLxloAVuCZ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "c:\program files (x86)\internet explorer\iexplore.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\miaou\derogates.exe "C:\Users\user\AppData\Local\miaou\derogates.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\miaou\derogates.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Drops VBS files to the startup folder

Source: MLxloAVuCZ.exe

Static file information: File size 1351680 > 1048576

Source: MLxloAVuCZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MLxloAVuCZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MLxloAVuCZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MLxloAVuCZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MLxloAVuCZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MLxloAVuCZ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MLxloAVuCZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: derogates.exe, 00000002.00000003.1452126318.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000002.00000003.1451776465.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1565765032.0000000003680000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1567346824.0000000003570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: derogates.exe, 00000002.00000003.1452126318.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000002.00000003.1451776465.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1565765032.0000000003680000.00000004.00001000.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1567346824.0000000003570000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: svchost.exe, 00000003.00000003.1455985205.0000000003021000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1456512162.0000000002FC0000.00000040.10000000.00040000.00000000.sdmp, iexplore.exe, iexplore.exe, 00000004.00000002.1456171063.0000000000630000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: svchost.exe, 00000003.00000003.1455985205.0000000003021000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1456512162.0000000002FC0000.00000040.10000000.00040000.00000000.sdmp, iexplore.exe, 00000004.00000002.1456171063.0000000000630000.00000040.80000000.00040000.00000000.sdmp

Source: MLxloAVuCZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MLxloAVuCZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MLxloAVuCZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MLxloAVuCZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MLxloAVuCZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A4B37 LoadLibraryA,GetProcAddress,

0_2_000A4B37

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000C8945 push ecx; ret	0_2_000C8958
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008D8945 push ecx; ret	2_2_008D8958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00457186 push ecx; ret	3_2_00457199
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0045E55D push esi; ret	3_2_0045E566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00457AA8 push eax; ret	3_2_00457AC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00434EB6 push ecx; ret	3_2_00434EC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00457186 push ecx; ret	7_2_00457199
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0045E55D push esi; ret	7_2_0045E566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00457AA8 push eax; ret	7_2_00457AC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00434EB6 push ecx; ret	7_2_00434EC9

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_00406EEB ShellExecuteW,URLDownloadToFileW,

3_2_00406EEB

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

File created: C:\Users\user\AppData\Local\miaou\derogates.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\miaou\derogates.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\miaou\derogates.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs

Source: C:\Users\user\AppData\Local\miaou\derogates.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs

Delayed program exit found

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_0041AADB

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_000A48D7
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00125376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00125376
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008B48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_008B48D7
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00935376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_00935376

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000C3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000C3187

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040F7E2 Sleep,ExitProcess,		3_2_0040F7E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040F7E2 Sleep,ExitProcess,		7_2_0040F7E2

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\miaou\derogates.exe	API/Special instruction interceptor: Address: 1486564
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	API/Special instruction interceptor: Address: F20384

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: derogates.exe, 00000006.00000003.1557690413.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1559943134.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000002.1570268620.0000000000E14000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1557549054.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXEQ
Source: MLxloAVuCZ.exe, 00000000.00000003.1425561599.000000000120C000.00000004.00000020.00020000.00000000.sdmp, MLxloAVuCZ.exe, 00000000.00000002.1436578928.0000000001265000.00000004.00000020.00020000.00000000.sdmp, MLxloAVuCZ.exe, 00000000.00000003.1425658003.0000000001265000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000002.00000003.1436296027.000000000131C000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000002.00000002.1453942163.0000000001375000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000002.00000003.1436582733.0000000001375000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1557690413.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1559943134.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000002.1570268620.0000000000E14000.00000004.00000020.00020000.00000000.sdmp, derogates.exe, 00000006.00000003.1557549054.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000B8C74 sldt word ptr [eax]

0_2_000B8C74

Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		3_2_0041A7D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		7_2_0041A7D9

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 551	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 8879	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: foregroundWindowGot 1738	Jump to behavior

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-102687
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	API coverage: 4.4 %
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	API coverage: 4.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 8124	Thread sleep count: 269 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8124	Thread sleep time: -134500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8128	Thread sleep count: 551 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8128	Thread sleep time: -1653000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8128	Thread sleep count: 8879 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8128	Thread sleep time: -26637000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0010445A
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010C6D1 FindFirstFileW,FindClose,	0_2_0010C6D1
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0010C75C
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0010EF95
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0010F0F2
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0010F3F3
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_001037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_001037EF
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00103B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00103B12
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_0010BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0010BCBC
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0091445A
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091C6D1 FindFirstFileW,FindClose,	2_2_0091C6D1
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0091C75C
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0091EF95
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0091F0F2
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0091F3F3
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_009137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_009137EF
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00913B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00913B12
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_0091BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0091BCBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00407877 FindFirstFileW,FindNextFileW,	3_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0044E8F9 FindFirstFileExA,	3_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	7_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	7_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	7_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	7_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	7_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00407877 FindFirstFileW,FindNextFileW,	7_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0044E8F9 FindFirstFileExA,	7_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	7_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	7_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	7_2_0040BD72

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00407CD2

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000A49A0

Source: wscript.exe, 00000005.00000002.1557433402.000001FEF4F84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.
Source: svchost.exe, 00000007.00000002.3876601412.0000000003212000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllfh,
Source: wscript.exe, 00000005.00000002.1557433402.000001FEF4F84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	API call chain: ExitProcess graph end node	graph_0-101100
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_00113F09 BlockInput,

0_2_00113F09

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_000A3B3A

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000D5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_000D5A7C

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A4B37 LoadLibraryA,GetProcAddress,

0_2_000A4B37

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_01376698 mov eax, dword ptr fs:[00000030h]	0_2_01376698
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_01377D08 mov eax, dword ptr fs:[00000030h]	0_2_01377D08
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_01377D68 mov eax, dword ptr fs:[00000030h]	0_2_01377D68
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_01485160 mov eax, dword ptr fs:[00000030h]	2_2_01485160
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_014867D0 mov eax, dword ptr fs:[00000030h]	2_2_014867D0
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_01486830 mov eax, dword ptr fs:[00000030h]	2_2_01486830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00443355 mov eax, dword ptr fs:[00000030h]	3_2_00443355
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633060 mov eax, dword ptr fs:[00000030h]	4_2_00633060
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633060 mov eax, dword ptr fs:[00000030h]	4_2_00633060
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633060 mov eax, dword ptr fs:[00000030h]	4_2_00633060
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633060 mov eax, dword ptr fs:[00000030h]	4_2_00633060
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633540 mov eax, dword ptr fs:[00000030h]	4_2_00633540
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633540 mov eax, dword ptr fs:[00000030h]	4_2_00633540
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00633540 mov eax, dword ptr fs:[00000030h]	4_2_00633540
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_006356A0 mov eax, dword ptr fs:[00000030h]	4_2_006356A0
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_006356A0 mov ecx, dword ptr fs:[00000030h]	4_2_006356A0
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00634610 mov eax, dword ptr fs:[00000030h]	4_2_00634610
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00634610 mov eax, dword ptr fs:[00000030h]	4_2_00634610
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00634610 mov eax, dword ptr fs:[00000030h]	4_2_00634610
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00634610 mov eax, dword ptr fs:[00000030h]	4_2_00634610
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00634410 mov eax, dword ptr fs:[00000030h]	4_2_00634410
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Code function: 4_2_00634410 mov eax, dword ptr fs:[00000030h]	4_2_00634410
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 6_2_00F205F0 mov eax, dword ptr fs:[00000030h]	6_2_00F205F0
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 6_2_00F20650 mov eax, dword ptr fs:[00000030h]	6_2_00F20650
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 6_2_00F1EF80 mov eax, dword ptr fs:[00000030h]	6_2_00F1EF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00443355 mov eax, dword ptr fs:[00000030h]	7_2_00443355

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000F80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_000F80A9

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000CA124 SetUnhandledExceptionFilter,	0_2_000CA124
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_000CA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000CA155
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008DA124 SetUnhandledExceptionFilter,	2_2_008DA124
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_008DA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_008DA155
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0043503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00434A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0043BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00434BD8 SetUnhandledExceptionFilter,	3_2_00434BD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0043503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00434A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0043BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00434BD8 SetUnhandledExceptionFilter,	7_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 192.3.64.152 2559

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

3_2_0041812A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\Internet Explorer\iexplore.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: A7B008	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Program Files (x86)\Internet Explorer\iexplore.exe base: 292E008	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D3F008	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		3_2_00412132
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		7_2_00412132

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000F87B1 LogonUserW,

0_2_000F87B1

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_000A3B3A

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_000A48D7

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_00104C27 mouse_event,

0_2_00104C27

Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MLxloAVuCZ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "c:\program files (x86)\internet explorer\iexplore.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\miaou\derogates.exe "C:\Users\user\AppData\Local\miaou\derogates.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\miaou\derogates.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000F7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_000F7CAF

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000F874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_000F874B

Source: MLxloAVuCZ.exe, derogates.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: svchost.exe, 00000007.00000002.3876734835.0000000003238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerProgram Manager
Source: svchost.exe, 00000007.00000002.3876734835.0000000003238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram Manager
Source: MLxloAVuCZ.exe, derogates.exe	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000007.00000002.3876734835.0000000003236000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager?
Source: svchost.exe, 00000007.00000002.3876734835.0000000003238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerProgram ManagerR
Source: svchost.exe, 00000007.00000002.3876657584.0000000003231000.00000004.00000020.00020000.00000000.sdmp, logs.dat.7.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000C862B cpuid

0_2_000C862B

Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_0045201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_004520B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00452143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	3_2_00452393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_00448484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004524BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	3_2_004525C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00452690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	3_2_0044896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	3_2_0040F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_00451D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_00451FD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	7_2_0045201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	7_2_004520B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_00452143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	7_2_00452393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	7_2_00448484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_004524BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	7_2_004525C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_00452690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	7_2_0044896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	7_2_0040F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	7_2_00451D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	7_2_00451FD0

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000D4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000D4E87

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000E1E06 GetUserNameW,

0_2_000E1E06

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000D3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_000D3F3A

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Code function: 0_2_000A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000A49A0

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3876562999.0000000003200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876896183.0000000004E1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876601412.0000000003212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		3_2_0040BA4D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		7_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	3_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	3_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	7_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	7_2_0040BB6B

Source: derogates.exe	Binary or memory string: WIN_81
Source: derogates.exe	Binary or memory string: WIN_XP
Source: derogates.exe	Binary or memory string: WIN_XPe
Source: derogates.exe	Binary or memory string: WIN_VISTA
Source: derogates.exe	Binary or memory string: WIN_7
Source: derogates.exe	Binary or memory string: WIN_8
Source: derogates.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-ZFXG9Y			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-ZFXG9Y			Jump to behavior

Source: Yara match	File source: 2.2.derogates.exe.b40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.derogates.exe.b40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.derogates.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3876562999.0000000003200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876896183.0000000004E1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3876601412.0000000003212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: derogates.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe		3_2_0040569A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe		7_2_0040569A

Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00116283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00116283
Source: C:\Users\user\Desktop\MLxloAVuCZ.exe	Code function: 0_2_00116747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00116747
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00926283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_00926283
Source: C:\Users\user\AppData\Local\miaou\derogates.exe	Code function: 2_2_00926747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_00926747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	221 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	2 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Bypass User Account Control	LSA Secrets	126 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Masquerading	Cached Domain Credentials	331 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	422 Process Injection	2 Valid Accounts	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	422 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MLxloAVuCZ.exe	79%	ReversingLabs	Win32.Backdoor.Remcos
MLxloAVuCZ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\miaou\derogates.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\miaou\derogates.exe	79%	ReversingLabs	Win32.Backdoor.Remcos

Name	IP	Active	Malicious	Antivirus Detection	Reputation
171.39.242.20.in-addr.arpa	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	svchost.exe	false		high
http://geoplugin.net/json.gp/C	derogates.exe, 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, derogates.exe, 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.3.64.152	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587959
Start date and time:	2025-01-10 19:47:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MLxloAVuCZ.exe renamed because original name is a hash value
Original Sample Name:	d51b3625115680dc3d6e0f5881f914f0373a277e2ef2ec56c88c3f45de997877.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@12/7@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 282
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 20.242.39.171, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: MLxloAVuCZ.exe

Simulations

Behavior and APIs

Time	Type	Description
13:49:30	API Interceptor	5173611x Sleep call for process: svchost.exe modified
19:48:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
192.3.64.152	1evAkYZpwDV0N4v.exe	Get hash	malicious	Remcos	Browse
	LdSbZG1iH6.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse
	EIuz8Bk9kGav2ix.exe	Get hash	malicious	Remcos	Browse
	6Ctc0o7vhqKgjU7.exe	Get hash	malicious	Remcos	Browse
	New Order.exe	Get hash	malicious	Remcos	Browse
	UsoOuMVYCv8QrxG.exe	Get hash	malicious	Remcos	Browse
	New Order.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Trojan.PackedNET.3042.4675.2937.exe	Get hash	malicious	Remcos	Browse
	Quote.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Win32.PWSX-gen.3135.16188.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.27.144
	sh4.elf	Get hash	malicious	Mirai	Browse	23.95.117.229
	sweetnessgoodforgreatnessthingswithgood.tIF.vbs	Get hash	malicious	SmokeLoader	Browse	192.3.27.144
	begoodforeverythinggreatthingsformebetterforgood.hta	Get hash	malicious	Cobalt Strike, SmokeLoader	Browse	192.3.27.144
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	192.3.27.144
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	192.3.27.144
	PO#3311-20250108003.xls	Get hash	malicious	Unknown	Browse	192.3.27.144

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.38816599775145
Encrypted:	false
SSDEEP:	3:rglsOlfUlWlNT+d4b5JWRal2Jl+7R0DAlBG45klovDl6v:Mls6UlWyCb5YcIeeDAlOWAv
MD5:	9BE3644D85269AA39F36AB99425888F1
SHA1:	3C451DA706656E8230F9F7CA5CBDC799E0C402A0
SHA-256:	729FE9576E94EEC5D41C98E9268424CAEAFDFEE8A2BDAFEE1691A9BA51B700F3
SHA-512:	01670764E772A71AB3DC757D4969FC7CF3BF39C227BDD44F4FD17E85E57C81A02B2CB993159960AEE23363972D382009D07D304F3C67AFBBEC6A83E6F9A0C234
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.5./.0.1./.1.0. .1.3.:.4.8.:.5.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\aut92C7.tmp

Process:	C:\Users\user\Desktop\MLxloAVuCZ.exe
File Type:	data
Category:	dropped
Size (bytes):	435204
Entropy (8bit):	7.988380266490117
Encrypted:	false
SSDEEP:	12288:MKU48175JWYme9crIadbkrdYUAilE8nKrR2JXi:ZUN17zWx1tkrdYUAilx824
MD5:	7A6DFA9FB95E532AD4BDB953FD850322
SHA1:	AACC7E3F1D407D4DC98EBAC26C9CEEA1D3A8DADD
SHA-256:	20545ED762F57FD5FA696DF46CB11D46407D0E20050A179BA4517E07F5C7F538
SHA-512:	ABB9194CE150615D9DE608BD4455F2C93263EAD25DCD8D56DE7D57DAEECD47690C1F0B928C476432AF4C95A0873266924D307957C59B16B71E3418461175B248
Malicious:	false
Reputation:	low
Preview:	EA06.....DzT...9.Rs..&mA..iT9.2.6.Rit.\.d....Y..5...H.g....m8.c......p.T.k.Z.+.FhS..~oW..j..$..8..&....Yw..c7h<.1(.........K.:Y..\e..m..Be.y..ok..i.....r.j$~I..}a.X+~9\|.Cc.F%.I.w.S..+..f./.Y%.z^....O.~.f.....k..=.U..E%..........zF......I...a..@.....5.J.R.$.U#.V03....%....).....T..u...(u..&s2.U..Y.......Sj.d.......ENqU.K&..U.cM.K.....#.........Uz.\.e.Qf.`..W.W...Ug..........p......Z.+...Tl..}...S.m\|.JML...e'.....83:.&.....$ry.4.d..&sj...d..j3j.......f6I.V[%..9y...B..&T.H.i@.....z.....L..@.B....j.j...d....~.....I....F..2.(Si...d....~........Y..c\|.E)<.-..F.Kj........If3Z..Y.....Z..}........A..l....}U.Rpw...O>.R-..%.............G.-.Ah[.."s2.v....{Y..R._/........Td.WM....(..l.\|.w.]G....%\...s...'t[..Wu..d#+.C(X.6..7.R'y...m..Y.4;F>w6..@..].....2<..LXo...d....23`.LB....\....21P.LM}..m....)4.VfQ...n....9...oqjV...M.Z......'S(.B.E........Tk..:...]h..^/.@.\f..z.C..e.:...u...xL.....k\|....sI..)...K..g./.F....2.9...u.A.:L...I.`e...~.u.n.w...S....}...kR.b?p(<...

C:\Users\user\AppData\Local\Temp\aut96FE.tmp

Process:	C:\Users\user\AppData\Local\miaou\derogates.exe
File Type:	data
Category:	dropped
Size (bytes):	435204
Entropy (8bit):	7.988380266490117
Encrypted:	false
SSDEEP:	12288:MKU48175JWYme9crIadbkrdYUAilE8nKrR2JXi:ZUN17zWx1tkrdYUAilx824
MD5:	7A6DFA9FB95E532AD4BDB953FD850322
SHA1:	AACC7E3F1D407D4DC98EBAC26C9CEEA1D3A8DADD
SHA-256:	20545ED762F57FD5FA696DF46CB11D46407D0E20050A179BA4517E07F5C7F538
SHA-512:	ABB9194CE150615D9DE608BD4455F2C93263EAD25DCD8D56DE7D57DAEECD47690C1F0B928C476432AF4C95A0873266924D307957C59B16B71E3418461175B248
Malicious:	false
Reputation:	low
Preview:	EA06.....DzT...9.Rs..&mA..iT9.2.6.Rit.\.d....Y..5...H.g....m8.c......p.T.k.Z.+.FhS..~oW..j..$..8..&....Yw..c7h<.1(.........K.:Y..\e..m..Be.y..ok..i.....r.j$~I..}a.X+~9\|.Cc.F%.I.w.S..+..f./.Y%.z^....O.~.f.....k..=.U..E%..........zF......I...a..@.....5.J.R.$.U#.V03....%....).....T..u...(u..&s2.U..Y.......Sj.d.......ENqU.K&..U.cM.K.....#.........Uz.\.e.Qf.`..W.W...Ug..........p......Z.+...Tl..}...S.m\|.JML...e'.....83:.&.....$ry.4.d..&sj...d..j3j.......f6I.V[%..9y...B..&T.H.i@.....z.....L..@.B....j.j...d....~.....I....F..2.(Si...d....~........Y..c\|.E)<.-..F.Kj........If3Z..Y.....Z..}........A..l....}U.Rpw...O>.R-..%.............G.-.Ah[.."s2.v....{Y..R._/........Td.WM....(..l.\|.w.]G....%\...s...'t[..Wu..d#+.C(X.6..7.R'y...m..Y.4;F>w6..@..].....2<..LXo...d....23`.LB....\....21P.LM}..m....)4.VfQ...n....9...oqjV...M.Z......'S(.B.E........Tk..:...]h..^/.@.\f..z.C..e.:...u...xL.....k\|....sI..)...K..g./.F....2.9...u.A.:L...I.`e...~.u.n.w...S....}...kR.b?p(<...

C:\Users\user\AppData\Local\Temp\autC66A.tmp

Process:	C:\Users\user\AppData\Local\miaou\derogates.exe
File Type:	data
Category:	dropped
Size (bytes):	435204
Entropy (8bit):	7.988380266490117
Encrypted:	false
SSDEEP:	12288:MKU48175JWYme9crIadbkrdYUAilE8nKrR2JXi:ZUN17zWx1tkrdYUAilx824
MD5:	7A6DFA9FB95E532AD4BDB953FD850322
SHA1:	AACC7E3F1D407D4DC98EBAC26C9CEEA1D3A8DADD
SHA-256:	20545ED762F57FD5FA696DF46CB11D46407D0E20050A179BA4517E07F5C7F538
SHA-512:	ABB9194CE150615D9DE608BD4455F2C93263EAD25DCD8D56DE7D57DAEECD47690C1F0B928C476432AF4C95A0873266924D307957C59B16B71E3418461175B248
Malicious:	false
Reputation:	low
Preview:	EA06.....DzT...9.Rs..&mA..iT9.2.6.Rit.\.d....Y..5...H.g....m8.c......p.T.k.Z.+.FhS..~oW..j..$..8..&....Yw..c7h<.1(.........K.:Y..\e..m..Be.y..ok..i.....r.j$~I..}a.X+~9\|.Cc.F%.I.w.S..+..f./.Y%.z^....O.~.f.....k..=.U..E%..........zF......I...a..@.....5.J.R.$.U#.V03....%....).....T..u...(u..&s2.U..Y.......Sj.d.......ENqU.K&..U.cM.K.....#.........Uz.\.e.Qf.`..W.W...Ug..........p......Z.+...Tl..}...S.m\|.JML...e'.....83:.&.....$ry.4.d..&sj...d..j3j.......f6I.V[%..9y...B..&T.H.i@.....z.....L..@.B....j.j...d....~.....I....F..2.(Si...d....~........Y..c\|.E)<.-..F.Kj........If3Z..Y.....Z..}........A..l....}U.Rpw...O>.R-..%.............G.-.Ah[.."s2.v....{Y..R._/........Td.WM....(..l.\|.w.]G....%\...s...'t[..Wu..d#+.C(X.6..7.R'y...m..Y.4;F>w6..@..].....2<..LXo...d....23`.LB....\....21P.LM}..m....)4.VfQ...n....9...oqjV...M.Z......'S(.B.E........Tk..:...]h..^/.@.\f..z.C..e.:...u...xL.....k\|....sI..)...K..g./.F....2.9...u.A.:L...I.`e...~.u.n.w...S....}...kR.b?p(<...

C:\Users\user\AppData\Local\Temp\cerecloths

Process:	C:\Users\user\Desktop\MLxloAVuCZ.exe
File Type:	data
Category:	dropped
Size (bytes):	494592
Entropy (8bit):	7.662774544934913
Encrypted:	false
SSDEEP:	12288:QzB90EAKlfwQihu+KhTtYKMUUaBSAeOI0i+wnQoiscwfyiiZ4kGP0MW:fKlfQhuRtYpUUaoAehZD1fJiiLfW
MD5:	1FEEC4959309F93B31ED96BB1C991A90
SHA1:	65BED2AB9EBCE344E29322980C4782AC2921C1D9
SHA-256:	B9E8C2EE4BEC14965B15F8E28FCE1BA98C3BBD412BCDE16DCE424D1698DF3132
SHA-512:	722513D8CF35CE524576E870A4D6AD9AE59C14BB5AABCBFE17417A3543423B089A63FE867025BCAE8427BA4D47BD4C0EFE682A9317F1AC35AB768BE9FCD80051
Malicious:	false
Reputation:	low
Preview:	...BTBG96HS8..6A.QJC1LQ6.IKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HK9E68^._J.8.p.S..c.?+4.B:<_7W[aV0$-^8qT7i97,w+).v...(YR$.\GI.LQ6RIKBN,.jq(.-p_.H./.4..k/mH.5..r<.#.6..aH`[./.!c2.,.7..S).].L...:d,.K...N>K.,...==X.Gs.F.,.?}K.=GW.H...=nM.9.va-q_.H.q.5.+./d;#.X.<G92HS8E66A5QJC1LQ6RIKBBW..92.R?E...SQJC1LQ6R.K@C\CI92:V8E 4A5QJC..R6RYKBB.GG92.S8U66A7QJF1MQ6RIKGBVBG92HS.M66E5QJC1LS6R.KBRWBW92HS(E6&A5QJC1\Q6RIKBBWBG9..U8A76A5.MC..Q6RIKBBWBG92HS8E66A.VJ..LQf.OKzBWBG92HS8E66A5QJC1L..TISBBW.?2.S8E66A5QJC1L.3RINBBWBG92HS8E66A5QJC1LQ6RIKBl#'?M2HS.436A%QJCCIQ6VIKBBWBG92HS8E6.A51d1U-%WRI.;CWB.<2H)9E6@D5QJC1LQ6RIKBB.BGy.,2L$66Aq.JC1\V6RGKBB.DG92HS8E66A5QJ.1L..&%8BBWBN92HSHB66C5QJ.7LQ6RIKBBWBG92.S8..Q'\59C1\|S6RI.EBWFG92HT8E66A5QJC1LQ6.IK.l%15Z2HS..66A.VJC}LQ6VNKBBWBG92HS8E6vA5.d1T >URI.yBWB.>2Ho8E6fF5QJC1LQ6RIKBB.BG{2HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6RIKBBWBG92HS8E66A5QJC1LQ6R

C:\Users\user\AppData\Local\miaou\derogates.exe

Process:	C:\Users\user\Desktop\MLxloAVuCZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1351680
Entropy (8bit):	7.320078437960566
Encrypted:	false
SSDEEP:	24576:Cu6J33O0c+JY5UZ+XC0kGso6FapubMGC8db/ZOid2MNTosdIIDnWY:ku0c++OCvkGs9FapCX0yTnyY
MD5:	5F38EDF8C588EFD365F6C82C92D5F0F6
SHA1:	6F8EC411858B7410A22401F6C9D6A2A5C45AAA9B
SHA-256:	D51B3625115680DC3D6E0F5881F914F0373A277E2EF2EC56C88C3F45DE997877
SHA-512:	7BC7886D3C81421D6D9CDC1CF4EE3AF5FEA572DE578FBC8C42509129B37716DE7552E3147A3AC84261C463FE79FB60511EFF18D45C3BC3D411905C22389028EF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L...\|{_g.........."..................}............@.................................h'....@...@.......@.....................L...\|....p..t........................q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...t....p......................@..@.reloc...q.......r..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs

Process:	C:\Users\user\AppData\Local\miaou\derogates.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	3.4094994025079943
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclwL1UEZ+lX1IlM69fAnv6nriIM8lfQVn:DsO+vNlwBQ1IlM6VAnv4mA2n
MD5:	1CCB9B6DA8C70EA737C6E01F48FD0FE4
SHA1:	0ED73B9F1887C2570210ABCFD4BA5723CF5E79DA
SHA-256:	E799EBD776B959AE559C2D8277971CAF281E60DF33492A7D75E88B6E2B4404F0
SHA-512:	AB45166C005C4DAD7F7027DC0F870D61FEBA3890D3A6517A24827F572B72A5E6504AE3BF15F9F3F7F0BF9A91A972933D382101FB7AE04DF46766DE861BF0D88B
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.m.i.a.o.u.\.d.e.r.o.g.a.t.e.s...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.320078437960566
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MLxloAVuCZ.exe
File size:	1'351'680 bytes
MD5:	5f38edf8c588efd365f6c82c92d5f0f6
SHA1:	6f8ec411858b7410a22401f6c9d6a2a5c45aaa9b
SHA256:	d51b3625115680dc3d6e0f5881f914f0373a277e2ef2ec56c88c3f45de997877
SHA512:	7bc7886d3c81421d6d9cdc1cf4ee3af5fea572de578fbc8c42509129b37716de7552e3147a3ac84261c463fe79fb60511eff18d45c3bc3d411905c22389028ef
SSDEEP:	24576:Cu6J33O0c+JY5UZ+XC0kGso6FapubMGC8db/ZOid2MNTosdIIDnWY:ku0c++OCvkGs9FapCX0yTnyY
TLSH:	0855DF2273DDC360CB669173BF29B7056EBF7C610630B85B2F980D7DA950162262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F7B7C [Mon Dec 16 00:59:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FEE58D05D5Ah
jmp 00007FEE58CF8B24h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FEE58CF8CAAh
cmp edi, eax
jc 00007FEE58CF900Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FEE58CF8CA9h
rep movsb
jmp 00007FEE58CF8FBCh
cmp ecx, 00000080h
jc 00007FEE58CF8E74h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FEE58CF8CB0h
bt dword ptr [004BE324h], 01h
jc 00007FEE58CF9180h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FEE58CF8E4Dh
test edi, 00000003h
jne 00007FEE58CF8E5Eh
test esi, 00000003h
jne 00007FEE58CF8E3Dh
bt edi, 02h
jnc 00007FEE58CF8CAFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FEE58CF8CB3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FEE58CF8D05h
bt esi, 03h
jnc 00007FEE58CF8D58h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x81674	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x149000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x81674	0x81800	8343513307bd20018aaa1b20757424a2	False	0.9490735853040541	data	7.93817481915676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x149000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x7893b	data			1.0003259881388913
RT_GROUP_ICON	0x1480f4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x14816c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x148180	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x148194	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1481a8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x148284	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:48:38.983696+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49807	192.3.64.152	2559	TCP
2025-01-10T19:49:21.341638+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49705	192.3.64.152	2559	TCP
2025-01-10T19:49:43.705614+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	63891	192.3.64.152	2559	TCP
2025-01-10T19:50:06.111549+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	63892	192.3.64.152	2559	TCP
2025-01-10T19:50:28.514508+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49799	192.3.64.152	2559	TCP
2025-01-10T19:50:50.952959+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49800	192.3.64.152	2559	TCP
2025-01-10T19:51:13.329619+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49801	192.3.64.152	2559	TCP
2025-01-10T19:51:35.704487+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49802	192.3.64.152	2559	TCP
2025-01-10T19:51:58.160413+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49803	192.3.64.152	2559	TCP
2025-01-10T19:52:20.564760+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49804	192.3.64.152	2559	TCP
2025-01-10T19:52:43.110246+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49805	192.3.64.152	2559	TCP
2025-01-10T19:53:05.519342+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.8	49806	192.3.64.152	2559	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:48:59.977179050 CET	49705	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:48:59.982074022 CET	2559	49705	192.3.64.152	192.168.2.8
Jan 10, 2025 19:48:59.982172012 CET	49705	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:48:59.987915039 CET	49705	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:48:59.992671013 CET	2559	49705	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:16.569957972 CET	63886	53	192.168.2.8	162.159.36.2
Jan 10, 2025 19:49:16.574836016 CET	53	63886	162.159.36.2	192.168.2.8
Jan 10, 2025 19:49:16.575097084 CET	63886	53	192.168.2.8	162.159.36.2
Jan 10, 2025 19:49:16.580032110 CET	53	63886	162.159.36.2	192.168.2.8
Jan 10, 2025 19:49:17.038465023 CET	63886	53	192.168.2.8	162.159.36.2
Jan 10, 2025 19:49:17.043476105 CET	53	63886	162.159.36.2	192.168.2.8
Jan 10, 2025 19:49:17.043576956 CET	63886	53	192.168.2.8	162.159.36.2
Jan 10, 2025 19:49:21.341495037 CET	2559	49705	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:21.341638088 CET	49705	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:21.341727972 CET	49705	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:21.346450090 CET	2559	49705	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:22.343858957 CET	63891	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:22.348819017 CET	2559	63891	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:22.348906994 CET	63891	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:22.355359077 CET	63891	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:22.360196114 CET	2559	63891	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:43.702186108 CET	2559	63891	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:43.705614090 CET	63891	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:43.705698013 CET	63891	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:43.710424900 CET	2559	63891	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:44.718749046 CET	63892	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:44.723700047 CET	2559	63892	192.3.64.152	192.168.2.8
Jan 10, 2025 19:49:44.723793983 CET	63892	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:44.732937098 CET	63892	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:49:44.737762928 CET	2559	63892	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:02.279398918 CET	49796	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:50:02.284301043 CET	53	49796	1.1.1.1	192.168.2.8
Jan 10, 2025 19:50:02.284420967 CET	49796	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:50:02.289258957 CET	53	49796	1.1.1.1	192.168.2.8
Jan 10, 2025 19:50:02.729527950 CET	49796	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:50:02.734566927 CET	53	49796	1.1.1.1	192.168.2.8
Jan 10, 2025 19:50:02.734628916 CET	49796	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:50:06.108983040 CET	2559	63892	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:06.111548901 CET	63892	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:06.111582994 CET	63892	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:06.116497993 CET	2559	63892	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:07.125211000 CET	49799	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:07.130048037 CET	2559	49799	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:07.130132914 CET	49799	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:07.134957075 CET	49799	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:07.139812946 CET	2559	49799	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:28.514319897 CET	2559	49799	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:28.514508009 CET	49799	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:28.514563084 CET	49799	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:28.519522905 CET	2559	49799	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:29.594286919 CET	49800	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:29.599325895 CET	2559	49800	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:29.599467993 CET	49800	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:29.605369091 CET	49800	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:29.610251904 CET	2559	49800	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:50.952205896 CET	2559	49800	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:50.952959061 CET	49800	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:50.953042984 CET	49800	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:50.957814932 CET	2559	49800	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:51.969253063 CET	49801	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:51.974049091 CET	2559	49801	192.3.64.152	192.168.2.8
Jan 10, 2025 19:50:51.974124908 CET	49801	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:51.988832951 CET	49801	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:50:51.993710041 CET	2559	49801	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:13.326837063 CET	2559	49801	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:13.329618931 CET	49801	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:13.329668045 CET	49801	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:13.334517002 CET	2559	49801	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:14.344677925 CET	49802	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:14.349781990 CET	2559	49802	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:14.349884987 CET	49802	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:14.354799032 CET	49802	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:14.359663010 CET	2559	49802	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:35.704432011 CET	2559	49802	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:35.704487085 CET	49802	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:35.704528093 CET	49802	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:35.709316015 CET	2559	49802	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:36.722263098 CET	49803	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:36.727157116 CET	2559	49803	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:36.727243900 CET	49803	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:36.731158018 CET	49803	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:36.735914946 CET	2559	49803	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:58.160259008 CET	2559	49803	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:58.160413027 CET	49803	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:58.160460949 CET	49803	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:58.165363073 CET	2559	49803	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:59.172575951 CET	49804	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:59.177413940 CET	2559	49804	192.3.64.152	192.168.2.8
Jan 10, 2025 19:51:59.177521944 CET	49804	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:59.181765079 CET	49804	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:51:59.186594009 CET	2559	49804	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:20.564656019 CET	2559	49804	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:20.564759970 CET	49804	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:20.564829111 CET	49804	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:20.569607019 CET	2559	49804	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:21.578888893 CET	49805	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:21.583827019 CET	2559	49805	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:21.583906889 CET	49805	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:21.587966919 CET	49805	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:21.592762947 CET	2559	49805	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:43.110166073 CET	2559	49805	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:43.110245943 CET	49805	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:43.110372066 CET	49805	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:43.115151882 CET	2559	49805	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:44.125778913 CET	49806	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:44.130577087 CET	2559	49806	192.3.64.152	192.168.2.8
Jan 10, 2025 19:52:44.130798101 CET	49806	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:44.145544052 CET	49806	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:52:44.150335073 CET	2559	49806	192.3.64.152	192.168.2.8
Jan 10, 2025 19:53:05.519002914 CET	2559	49806	192.3.64.152	192.168.2.8
Jan 10, 2025 19:53:05.519341946 CET	49806	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:53:05.519341946 CET	49806	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:53:05.524310112 CET	2559	49806	192.3.64.152	192.168.2.8
Jan 10, 2025 19:53:06.531785965 CET	49807	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:53:06.538877010 CET	2559	49807	192.3.64.152	192.168.2.8
Jan 10, 2025 19:53:06.538958073 CET	49807	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:53:06.542771101 CET	49807	2559	192.168.2.8	192.3.64.152
Jan 10, 2025 19:53:06.549729109 CET	2559	49807	192.3.64.152	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:49:16.568767071 CET	53	52384	162.159.36.2	192.168.2.8
Jan 10, 2025 19:49:17.045623064 CET	59812	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:49:17.052933931 CET	53	59812	1.1.1.1	192.168.2.8
Jan 10, 2025 19:50:02.278987885 CET	53	55561	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:49:17.045623064 CET	192.168.2.8	1.1.1.1	0xb247	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:49:17.052933931 CET	1.1.1.1	192.168.2.8	0xb247	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	13:48:44
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\MLxloAVuCZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MLxloAVuCZ.exe"
Imagebase:	0xa0000
File size:	1'351'680 bytes
MD5 hash:	5F38EDF8C588EFD365F6C82C92D5F0F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	13:48:45
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\miaou\derogates.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MLxloAVuCZ.exe"
Imagebase:	0x8b0000
File size:	1'351'680 bytes
MD5 hash:	5F38EDF8C588EFD365F6C82C92D5F0F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.1453719778.0000000000B40000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	13:48:47
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MLxloAVuCZ.exe"
Imagebase:	0xef0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.1456080422.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	13:48:47
Start date:	10/01/2025
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"c:\program files (x86)\internet explorer\iexplore.exe"
Imagebase:	0x650000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	13:48:56
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\derogates.vbs"
Imagebase:	0x7ff606aa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	13:48:57
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\miaou\derogates.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\miaou\derogates.exe"
Imagebase:	0x8b0000
File size:	1'351'680 bytes
MD5 hash:	5F38EDF8C588EFD365F6C82C92D5F0F6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000006.00000002.1569823464.0000000000C70000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	13:48:58
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\miaou\derogates.exe"
Imagebase:	0xef0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3876562999.0000000003200000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3876896183.0000000004E1E000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3876601412.0000000003212000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000007.00000002.3875944290.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false