Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

ASEGNEGROMARZ.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.590628616561336
Filename:	ASEGNEGROMARZ.exe
Filesize:	498176
MD5:	6f464f8abb486d07b1369213c207fb54
SHA1:	a65b17590a68d0aa13530bb6c1107bf222b252c3
SHA256:	62ebee27e520761cee2aac9de8074e73364a2e5a7677157b358300b132129d39
SHA512:	8ec90412d4b8acf5d627907d78f2959c7c391699a682a75a9523282579aa49d1ab5f5ac7e69e34d1bc31f1493c46c714290eb3aedb03d27631e844291ef14b88
SSDEEP:	6144:BIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6KJ:B200OFp+G0imvHn3Cp6qyBP+YdsvZG8
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Lj.e...6...6...6..W6...6..U6...6..T6...6.s"6...6..a6...6Zc.76..6Zc.7)..6Zc.7...6.s56...6...6O..6.b.7l..6.bY6...6.b.7...6Rich...

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Found malware configuration	AV Detection	Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Disable UAC(promptonsecuredesktop)	Lowering of HIPS / PFW / Operating System Security Settings
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Abnormal high CPU Usage	System Summary	Access Token Manipulation
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found evasive API chain checking for process token information	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Might use command line arguments	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\remcos\logs.dat

data

modified

Details

File:	C:\ProgramData\remcos\logs.dat
Category:	modified
Dump:	logs.dat.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Type:	data
Entropy:	3.6178658681114446
Encrypted:	false
Ssdeep:	6:Ml56K8K65YcIeeDAlz5ZsFWRWx9m6IWA7DxbN2fxljlJMm0v:NRJecKFBx9UWItN2Ljol
Size:	326
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json
Category:	dropped
Dump:	json[1].json.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Type:	JSON data
Entropy:	5.011709813974989
Encrypted:	false
Ssdeep:	12:tkpSCnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkw7X:qldbauKyGX85jvXhNlT3/7XcV7WrZ
Size:	964
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

\Device\ConDrv

ISO-8859 text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.516049378235623
Encrypted:	false
Ssdeep:	12:caFqFkLmxyRbmkclkL6htRR3zIbua/XqdP4LRW3A4RW3igGn:7QFtUbmjlrRpwuTqW35W3M
Size:	638
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\ASEGNEGROMARZ.exe

"C:\Users\user\Desktop\ASEGNEGROMARZ.exe"

Details

Is windows:	false
Is dropped:	false
PID:	8936
Target ID:	0
Parent PID:	3084
Name:	ASEGNEGROMARZ.exe
Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Commandline:	"C:\Users\user\Desktop\ASEGNEGROMARZ.exe"
Size:	498176
MD5:	6F464F8ABB486D07B1369213C207FB54
Time:	15:15:15
Date:	27/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	528384
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	8956
Target ID:	1
Parent PID:	8936
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	15:15:15
Date:	27/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7e2000000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

esteesnuevo2025.duckdns.org

Details

Name:	esteesnuevo2025.duckdns.org
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Suricata IDS alerts with low severity for network traffic	Networking
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpD

unknown

Details

Name:	http://geoplugin.net/json.gpD
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	ASEGNEGROMARZ.exe, 00000000.00000003.3734246344.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000003.1362316352.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000002.3738490042.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000003.3733735918.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000003.3733562013.0000000000832000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpA

unknown

Details

Name:	http://geoplugin.net/json.gpA
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	ASEGNEGROMARZ.exe, 00000000.00000003.3734246344.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000003.1362316352.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000002.3738490042.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000003.3733735918.0000000000832000.00000004.00000020.00020000.00000000.sdmp, ASEGNEGROMARZ.exe, 00000000.00000003.3733562013.0000000000832000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpg

unknown

Details

Name:	http://geoplugin.net/json.gpg
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	ASEGNEGROMARZ.exe, 00000000.00000003.1362316352.0000000000832000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/

unknown

Details

Name:	http://geoplugin.net/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	ASEGNEGROMARZ.exe, 00000000.00000003.1362316352.0000000000832000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

http://geoplugin.net/json.gpSystem32

unknown

Details

Name:	http://geoplugin.net/json.gpSystem32
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Source:	ASEGNEGROMARZ.exe, 00000000.00000003.1362316352.0000000000832000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

esteesnuevo2025.duckdns.org

192.159.99.113

Details

Name:	esteesnuevo2025.duckdns.org
IP:	192.159.99.113
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

192.159.99.113

esteesnuevo2025.duckdns.org

United Kingdom

Details

IP:	192.159.99.113
TargetID:	0
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Country:	United Kingdom
Countrycode:	GBR
ASN number:	21554
ASN name:	CYBERLYNKUS
Private:	false
Domain:	esteesnuevo2025.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	0
Current Path:	C:\Users\user\Desktop\ASEGNEGROMARZ.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-365FYR

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-365FYR

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-365FYR

time

HKEY_CURRENT_USER\SOFTWARE\Rmc-365FYR

UID

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

PromptOnSecureDesktop

Memdumps

Base Address

Regiontype

Protect

Malicious

Download

459000

unkown

page readonly

7EE000

heap

page read and write

841000

heap

page read and write

842000

heap

page read and write

24BF000

stack

page read and write

459000

unkown

page readonly

832000

heap

page read and write

9DF000

stack

page read and write

869000

heap

page read and write

655000

heap

page read and write

87B000

heap

page read and write

3B91000

heap

page read and write

2AAF000

stack

page read and write

600000

heap

page read and write

790000

heap

page read and write

9C000

stack

page read and write

873000

heap

page read and write

2AEE000

stack

page read and write

660000

heap

page read and write

670000

heap

page read and write

472000

unkown

page write copy

650000

heap

page read and write

478000

unkown

page readonly

5FE000

stack

page read and write

2C2E000

stack

page read and write

823000

heap

page read and write

2D2F000

stack

page read and write

79A000

heap

page read and write

832000

heap

page read and write

329E000

stack

page read and write

2D6C000

stack

page read and write

2FFE000

stack

page read and write

23BE000

stack

page read and write

33B1000

heap

page read and write

855000

heap

page read and write

33B0000

heap

page read and write

7EA000

heap

page read and write

2520000

heap

page read and write

29AC000

stack

page read and write

873000

heap

page read and write

2E6E000

stack

page read and write

7DC000

stack

page read and write

832000

heap

page read and write

ADF000

stack

page read and write

45BA000

heap

page read and write

1F0000

heap

page read and write

870000

heap

page read and write

19C000

stack

page read and write

24FC000

stack

page read and write

472000

unkown

page read and write

339F000

stack

page read and write

3B95000

heap

page read and write

870000

heap

page read and write

315F000

stack

page read and write

400000

unkown

page readonly

401000

unkown

page execute read

87B000

heap

page read and write

862000

heap

page read and write

262F000

stack

page read and write

869000

heap

page read and write

870000

heap

page read and write

869000

heap

page read and write

2EBE000

stack

page read and write

2500000

heap

page read and write

832000

heap

page read and write

40A5000

heap

page read and write

2BEF000

stack

page read and write

855000

heap

page read and write

475000

unkown

page read and write

2FBF000

stack

page read and write

855000

heap

page read and write

823000

heap

page read and write

401000

unkown

page execute read

832000

heap

page read and write

478000

unkown

page readonly

33C0000

heap

page read and write

33C0000

heap

page read and write

560000

heap

page read and write

860000

heap

page read and write

305B000

heap

page read and write

400000

unkown

page readonly

237B000

stack

page read and write

873000

heap

page read and write

7E0000

heap

page read and write

5AC000

stack

page read and write

855000

heap

page read and write

826000

heap

page read and write

3050000

heap

page read and write

There are 78 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
ASEGNEGROMARZ.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportASEGNEGROMARZ.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
ASEGNEGROMARZ.exe