Windows Analysis Report
FdSJYyDayo.exe

AI detected suspicious sample

Source: Yara match	File source: FdSJYyDayo.exe, type: SAMPLE
Source: Yara match	File source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4140240474.00000000021FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803831388.0000000000528000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965049891.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674480983.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884579837.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED
Source: Yara match	File source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\27 de Junio\27 de Junio.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FdSJYyDayo.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		0_2_00433837
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		2_2_00433837

Source: FdSJYyDayo.exe, 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_3c11387d-b

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: FdSJYyDayo.exe, type: SAMPLE
Source: Yara match	File source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004074FD _wcslen,CoGetObject,		0_2_004074FD
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004074FD _wcslen,CoGetObject,		2_2_004074FD

Source: FdSJYyDayo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409253
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C291
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C34D
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409665
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_0040880C
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040783C FindFirstFileW,FindNextFileW,	0_2_0040783C
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419AF5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB30
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD37
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409253
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C291
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C34D
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409665
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_0040880C
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040783C FindFirstFileW,FindNextFileW,	2_2_0040783C
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419AF5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB30
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD37

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407C97

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49730 -> 190.70.119.188:8997
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 190.70.119.188:8997 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: eslibre9889.dynuddns.com

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 190.70.119.188:8997

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: EPMTelecomunicacionesSAESPCO EPMTelecomunicacionesSAESPCO

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49731 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0041B380

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: colombiaeslibre9889.dynuddns.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: 27 de Junio.exe, 00000001.00000003.1692245031.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: 27 de Junio.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp#z
Source: FdSJYyDayo.exe, 27 de Junio.exe.0.dr	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpQz
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpn.net/Eq

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

0_2_0040A2B8

Installs a global keyboard hook

Source: C:\ProgramData\27 de Junio\27 de Junio.exe

Windows user hook set: 0 keyboard low level C:\ProgramData\27 de Junio\27 de Junio.exe

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B70E

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,		0_2_004168C1
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,		2_2_004168C1

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B70E

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: FdSJYyDayo.exe, type: SAMPLE
Source: Yara match	File source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4140240474.00000000021FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803831388.0000000000528000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965049891.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674480983.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884579837.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED
Source: Yara match	File source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041C9E2 SystemParametersInfoW,		0_2_0041C9E2
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041C9E2 SystemParametersInfoW,		2_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: FdSJYyDayo.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: FdSJYyDayo.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: FdSJYyDayo.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED	Matched rule: REMCOS_RAT_variants Author: unknown
Source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\ProgramData\27 de Junio\27 de Junio.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_004132D2
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0041BB09
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	0_2_0041BB35
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	2_2_004132D2
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	2_2_0041BB09
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	2_2_0041BB35

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,		0_2_004167B4
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,		2_2_004167B4

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0043E0CC	0_2_0043E0CC
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041F0FA	0_2_0041F0FA
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00454159	0_2_00454159
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00438168	0_2_00438168
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004461F0	0_2_004461F0
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0043E2FB	0_2_0043E2FB
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0045332B	0_2_0045332B
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0042739D	0_2_0042739D
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004374E6	0_2_004374E6
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0043E558	0_2_0043E558
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00438770	0_2_00438770
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004378FE	0_2_004378FE
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00433946	0_2_00433946
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0044D9C9	0_2_0044D9C9
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00427A46	0_2_00427A46
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041DB62	0_2_0041DB62
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00427BAF	0_2_00427BAF
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00437D33	0_2_00437D33
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00435E5E	0_2_00435E5E
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00426E0E	0_2_00426E0E
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0043DE9D	0_2_0043DE9D
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00413FCA	0_2_00413FCA
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00436FEA	0_2_00436FEA
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0043E0CC	2_2_0043E0CC
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041F0FA	2_2_0041F0FA
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00454159	2_2_00454159
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00438168	2_2_00438168
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004461F0	2_2_004461F0
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0043E2FB	2_2_0043E2FB
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0045332B	2_2_0045332B
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0042739D	2_2_0042739D
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004374E6	2_2_004374E6
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0043E558	2_2_0043E558
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00438770	2_2_00438770
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004378FE	2_2_004378FE
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00433946	2_2_00433946
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0044D9C9	2_2_0044D9C9
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00427A46	2_2_00427A46
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041DB62	2_2_0041DB62
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00427BAF	2_2_00427BAF
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00437D33	2_2_00437D33
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00435E5E	2_2_00435E5E
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00426E0E	2_2_00426E0E
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0043DE9D	2_2_0043DE9D
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00413FCA	2_2_00413FCA
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00436FEA	2_2_00436FEA

Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: String function: 00402093 appears 50 times
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: String function: 00434770 appears 42 times
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: String function: 00434770 appears 42 times
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: String function: 00401E65 appears 35 times

Source: FdSJYyDayo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FdSJYyDayo.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: FdSJYyDayo.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: FdSJYyDayo.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@6/4@2/2

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		0_2_00417952
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		2_2_00417952

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040F474

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041B4A8

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AA4A

Source: C:\ProgramData\27 de Junio\27 de Junio.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Source: C:\ProgramData\27 de Junio\27 de Junio.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-IN9IWC

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Software\	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Rmc-IN9IWC	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Exe	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Exe	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Rmc-IN9IWC	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Inj	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Inj	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: xIs	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: xIs	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: xIs	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: 8SG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: xIs	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: exepath	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: 8SG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: exepath	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: xIs	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: licence	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: dMG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: PSG	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: Administrator	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: User	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: del	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: del	0_2_0040E9C5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Command line argument: del	0_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: Software\	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: Exe	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: Inj	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: Inj	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: 8SG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: exepath	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: 8SG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: exepath	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: licence	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: dMG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: PSG	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: Administrator	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: User	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: del	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: del	2_2_0040E9C5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Command line argument: del	2_2_0040E9C5

Source: FdSJYyDayo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: FdSJYyDayo.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

File read: C:\Users\user\Desktop\FdSJYyDayo.exe

Source: unknown	Process created: C:\Users\user\Desktop\FdSJYyDayo.exe "C:\Users\user\Desktop\FdSJYyDayo.exe"
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Process created: C:\ProgramData\27 de Junio\27 de Junio.exe "C:\ProgramData\27 de Junio\27 de Junio.exe"
Source: unknown	Process created: C:\ProgramData\27 de Junio\27 de Junio.exe "C:\ProgramData\27 de Junio\27 de Junio.exe"
Source: unknown	Process created: C:\ProgramData\27 de Junio\27 de Junio.exe "C:\ProgramData\27 de Junio\27 de Junio.exe"
Source: unknown	Process created: C:\ProgramData\27 de Junio\27 de Junio.exe "C:\ProgramData\27 de Junio\27 de Junio.exe"
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Process created: C:\ProgramData\27 de Junio\27 de Junio.exe "C:\ProgramData\27 de Junio\27 de Junio.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Creates autostart registry keys with suspicious names

Source: FdSJYyDayo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FdSJYyDayo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FdSJYyDayo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FdSJYyDayo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FdSJYyDayo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FdSJYyDayo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FdSJYyDayo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: FdSJYyDayo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FdSJYyDayo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FdSJYyDayo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FdSJYyDayo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FdSJYyDayo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041CB50

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00457106 push ecx; ret	0_2_00457119
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00457A28 push eax; ret	0_2_00457A46
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00434E56 push ecx; ret	0_2_00434E69
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00457106 push ecx; ret	2_2_00457119
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00457A28 push eax; ret	2_2_00457A46
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00434E56 push ecx; ret	2_2_00434E69

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

0_2_00406EB0

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

File created: C:\ProgramData\27 de Junio\27 de Junio.exe

Jump to dropped file

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

File created: C:\ProgramData\27 de Junio\27 de Junio.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC

Delayed program exit found

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AA4A

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC	Jump to behavior

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

0_2_0041CB50

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040F7A7 Sleep,ExitProcess,		0_2_0040F7A7
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040F7A7 Sleep,ExitProcess,		2_2_0040F7A7

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		0_2_0041A748
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		2_2_0041A748

Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Window / User API: threadDelayed 9481			Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Window / User API: foregroundWindowGot 1750			Jump to behavior

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Evaded block: after key decision			graph_0-46993
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Evaded block: after key decision			graph_0-46969

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	API coverage: 6.1 %
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	API coverage: 6.0 %

Source: C:\ProgramData\27 de Junio\27 de Junio.exe TID: 5568	Thread sleep count: 247 > 30	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe TID: 5568	Thread sleep time: -123500s >= -30000s	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe TID: 4520	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe TID: 4520	Thread sleep count: 9481 > 30	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe TID: 4520	Thread sleep time: -28443000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409253
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C291
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C34D
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409665
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_0040880C
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040783C FindFirstFileW,FindNextFileW,	0_2_0040783C
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419AF5
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB30
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD37
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409253
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C291
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C34D
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00409665
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_0040880C
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040783C FindFirstFileW,FindNextFileW,	2_2_0040783C
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419AF5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB30
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD37

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407C97

Source: 27 de Junio.exe, 00000001.00000003.1692743832.00000000005E8000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000002.4139888253.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP_%SystemRoot%\system32\mswsock.dll
Source: 27 de Junio.exe, 00000001.00000003.1692743832.00000000005E8000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000002.4139888253.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004349F9

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

0_2_0041CB50

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004432B5 mov eax, dword ptr fs:[00000030h]		0_2_004432B5
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004432B5 mov eax, dword ptr fs:[00000030h]		2_2_004432B5

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_00412077 GetProcessHeap,HeapFree,

0_2_00412077

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004349F9
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00434B47 SetUnhandledExceptionFilter,	0_2_00434B47
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043BB22
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: 0_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00434FDC
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004349F9
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00434B47 SetUnhandledExceptionFilter,	2_2_00434B47
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0043BB22
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: 2_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00434FDC

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		0_2_00412117
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		2_2_004120F7

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_00419627 mouse_event,

0_2_00419627

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Process created: C:\ProgramData\27 de Junio\27 de Junio.exe "C:\ProgramData\27 de Junio\27 de Junio.exe"

Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager'
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerWC\-
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerA
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerO
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerWC\$
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerWC\#
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerWC\
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager8
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerWC\10
Source: 27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000002.4139888253.00000000005C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: 27 de Junio.exe, 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, logs.dat.1.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_00434C52 cpuid

0_2_00434C52

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: EnumSystemLocalesW,	0_2_00452036
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004520C3
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetLocaleInfoW,	0_2_00452313
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: EnumSystemLocalesW,	0_2_00448404
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0045243C
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetLocaleInfoW,	0_2_00452543
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452610
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetLocaleInfoA,	0_2_0040F8D1
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: GetLocaleInfoW,	0_2_004488ED
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00451CD8
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: EnumSystemLocalesW,	0_2_00451F50
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: EnumSystemLocalesW,	0_2_00451F9B
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: EnumSystemLocalesW,	2_2_00452036
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_004520C3
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetLocaleInfoW,	2_2_00452313
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: EnumSystemLocalesW,	2_2_00448404
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0045243C
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetLocaleInfoW,	2_2_00452543
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452610
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetLocaleInfoA,	2_2_0040F8D1
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: GetLocaleInfoW,	2_2_004488ED
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00451CD8
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: EnumSystemLocalesW,	2_2_00451F50
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: EnumSystemLocalesW,	2_2_00451F9B

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0040B164 GetLocalTime,wsprintfW,

0_2_0040B164

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_0041B60D GetComputerNameExW,GetUserNameW,

0_2_0041B60D

Source: C:\Users\user\Desktop\FdSJYyDayo.exe

Code function: 0_2_004493AD _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_004493AD

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: FdSJYyDayo.exe, type: SAMPLE
Source: Yara match	File source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4140240474.00000000021FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803831388.0000000000528000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965049891.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674480983.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884579837.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED
Source: Yara match	File source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		0_2_0040BA12
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		2_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	0_2_0040BB30
Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: \key3.db	0_2_0040BB30
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	2_2_0040BB30
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: \key3.db	2_2_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-IN9IWC	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-IN9IWC	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-IN9IWC	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-IN9IWC	Jump to behavior
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-IN9IWC	Jump to behavior

Source: Yara match	File source: FdSJYyDayo.exe, type: SAMPLE
Source: Yara match	File source: 7.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FdSJYyDayo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.27 de Junio.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4140240474.00000000021FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803831388.0000000000528000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965049891.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674480983.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1884579837.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FdSJYyDayo.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27 de Junio.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED
Source: Yara match	File source: C:\ProgramData\27 de Junio\27 de Junio.exe, type: DROPPED

Source: C:\Users\user\Desktop\FdSJYyDayo.exe	Code function: cmd.exe		0_2_0040569A
Source: C:\ProgramData\27 de Junio\27 de Junio.exe	Code function: cmd.exe		2_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	22 Process Injection	1 Masquerading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
FdSJYyDayo.exe	87%	ReversingLabs	Win32.Backdoor.Remcos
FdSJYyDayo.exe	100%	Avira	BDS/Backdoor.Gen
FdSJYyDayo.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\27 de Junio\27 de Junio.exe	100%	Avira	BDS/Backdoor.Gen
C:\ProgramData\27 de Junio\27 de Junio.exe	100%	Joe Sandbox ML
C:\ProgramData\27 de Junio\27 de Junio.exe	87%	ReversingLabs	Win32.Backdoor.Remcos

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
eslibre9889.dynuddns.com	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp#z	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpn.net/Eq	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpQz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown
colombiaeslibre9889.dynuddns.com	190.70.119.188	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
eslibre9889.dynuddns.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp#z	27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpn.net/Eq	27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/	27 de Junio.exe, 00000001.00000003.1692245031.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpQz	27 de Junio.exe, 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, 27 de Junio.exe, 00000001.00000003.1692245031.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	FdSJYyDayo.exe, 27 de Junio.exe.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false
190.70.119.188	colombiaeslibre9889.dynuddns.com	Colombia		13489	EPMTelecomunicacionesSAESPCO	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501236
Start date and time:	2024-08-29 16:06:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FdSJYyDayo.exe renamed because original name is a hash value
Original Sample Name:	C00E45FE6B36F599558F546CD45D7C52.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@6/4@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 18 Number of non-executed functions: 397
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 27 de Junio.exe, PID 5968 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: FdSJYyDayo.exe

Simulations

Behavior and APIs

Time	Type	Description
10:07:27	API Interceptor	7823011x Sleep call for process: 27 de Junio.exe modified
15:07:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC "C:\ProgramData\27 de Junio\27 de Junio.exe"
15:07:08	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC "C:\ProgramData\27 de Junio\27 de Junio.exe"
15:07:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-IN9IWC "C:\ProgramData\27 de Junio\27 de Junio.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	Ravakhu24105.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.9070.28632.rtf	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	BP-30M31_20240829_093844.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	P.O_Qouts_t87E90Y-E4R7G-PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.24787.2174.rtf	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	PMT-INV0230824AUG.xla.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	French Group.js	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	ORDER 5172024.xla.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	pop.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.16063.8851.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	Ravakhu24105.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.9070.28632.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	BP-30M31_20240829_093844.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	P.O_Qouts_t87E90Y-E4R7G-PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.24787.2174.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	PMT-INV0230824AUG.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	French Group.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	ORDER 5172024.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	pop.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.16063.8851.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPMTelecomunicacionesSAESPCO	88b5ed74d4fc6f2cf6394bd1766f44df61e7dc9b810cfacbecba5b34af3bf57d_dump.exe	Get hash	malicious	SmokeLoader	Browse	181.128.22.240
	sora.mips.elf	Get hash	malicious	Unknown	Browse	181.129.241.199
	sora.spc.elf	Get hash	malicious	Unknown	Browse	181.128.127.239
	ExeFile (233).exe	Get hash	malicious	Emotet	Browse	200.116.145.225
	KKveTTgaAAsecNNaaaa.mips.elf	Get hash	malicious	Unknown	Browse	191.95.19.250
	ExeFile (278).exe	Get hash	malicious	Emotet	Browse	181.129.96.162
	ExeFile (305).exe	Get hash	malicious	Emotet	Browse	181.129.96.162
	ExeFile (323).exe	Get hash	malicious	Emotet	Browse	181.129.96.162
	ExeFile (333).exe	Get hash	malicious	Emotet	Browse	200.116.93.61
	ExeFile (347).exe	Get hash	malicious	Emotet	Browse	181.129.96.162
ATOM86-ASATOM86NL	Ravakhu24105.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.9070.28632.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	BP-30M31_20240829_093844.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	P.O_Qouts_t87E90Y-E4R7G-PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.24787.2174.rtf	Get hash	malicious	Remcos	Browse	178.237.33.50
	PMT-INV0230824AUG.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	French Group.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	ORDER 5172024.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	pop.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.16063.8851.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\FdSJYyDayo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	494080
Entropy (8bit):	6.597009987303353
Encrypted:	false
SSDEEP:	6144:dXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZ5AXIcN+5Gv:dX7tPMK8ctGe4Dzl4h2QnuPs/Z5vcv
MD5:	C00E45FE6B36F599558F546CD45D7C52
SHA1:	094C1C6D8814B4D73E1AAFAABF9F8506F8551FB2
SHA-256:	7D2784F37A68E93B654BB2EB0C7EF1220194F82B80E1B394C3F1D2866861286F
SHA-512:	4EFAE9768498F16E94802FE90E35EE1B5A7188FFF4051B4CC5F0FB140CE74BAFF72108B2BB82908D64ECFC842AAA53CB05151E28CDCDD78DE244616681524893
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-H..~H..~H..~.f$~[..~.f&~...~.f'~V..~A.Q~I..~.Z.~J..~...R..~...r..~...j..~A.F~Q..~H..~u..~....,..~..*~I..~....I..~RichH..~................PE..L...X.rf.................r...........I............@.......................... ...........................................................H.......................;..@...8...........................x...@............................................text...uq.......r.................. ..`.rdata...y.......z...v..............@..@.data...D]..........................@....tls.........p......................@....gfids..0...........................@..@.rsrc....H.......J..................@..@.reloc...;.......<...N..............@..B........................................................................................................................................................................................................

C:\ProgramData\27 de Junio\27 de Junio.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FdSJYyDayo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\remcos\logs.dat

Download File

Process:	C:\ProgramData\27 de Junio\27 de Junio.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	3.2914757162646
Encrypted:	false
SSDEEP:	6:6lmndNeb5YcIeeDAlOWAAe5q1gWAAe5q1gWAAe5q1gWAv:6ltec0WFe5BWFe5BWFe5BW+
MD5:	8B4C68C7FCAC1A287F4388B2589F5CC6
SHA1:	1622714E6C91129CB2407346C43C419C594431E5
SHA-256:	DB32C8BBD74FCCED5C6431FA36D842D29BF99F34E34462A286FB216678FFCA8B
SHA-512:	EFC8D693D74964C7DB3C8E0DDE22FDE8529AF02533FDD219C92F2E16050964A785DE0E0F720A554E1271450FDB4E2C60760528D161649620397DA087B1D02AC7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.0.8./.2.9. .1.0.:.0.6.:.5.5. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\ProgramData\27 de Junio\27 de Junio.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.597009987303353
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FdSJYyDayo.exe
File size:	494'080 bytes
MD5:	c00e45fe6b36f599558f546cd45d7c52
SHA1:	094c1c6d8814b4d73e1aafaabf9f8506f8551fb2
SHA256:	7d2784f37a68e93b654bb2eb0c7ef1220194f82b80e1b394c3f1d2866861286f
SHA512:	4efae9768498f16e94802fe90e35ee1b5a7188fff4051b4cc5f0fb140ce74baff72108b2bb82908d64ecfc842aaa53cb05151e28cdcdd78de244616681524893
SSDEEP:	6144:dXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZ5AXIcN+5Gv:dX7tPMK8ctGe4Dzl4h2QnuPs/Z5vcv
TLSH:	16B49E01BAD1C072D57524300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-H..~H..~H..~.f$~[..~.f&~...~.f'~V..~A.Q~I..~.Z.~J..~....R..~....r..~....j..~A.F~Q..~H..~u..~....,..~..*~I..~....I..~RichH..

File Icon


Icon Hash:	95694d05214c1b33

Static PE Info

General

Entrypoint:	0x4349ef
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x66728C58 [Wed Jun 19 07:44:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	8d5087ff5de35c3fbb9f212b47d63cad

Entrypoint Preview

Instruction
call 00007FFBC0F04B8Ch
jmp 00007FFBC0F045A3h
push ebp
mov ebp, esp
sub esp, 00000324h
push ebx
push esi
push 00000017h
call 00007FFBC0F26E04h
test eax, eax
je 00007FFBC0F04717h
mov ecx, dword ptr [ebp+08h]
int 29h
xor esi, esi
lea eax, dword ptr [ebp-00000324h]
push 000002CCh
push esi
push eax
mov dword ptr [00471D14h], esi
call 00007FFBC0F06B77h
add esp, 0Ch
mov dword ptr [ebp-00000274h], eax
mov dword ptr [ebp-00000278h], ecx
mov dword ptr [ebp-0000027Ch], edx
mov dword ptr [ebp-00000280h], ebx
mov dword ptr [ebp-00000284h], esi
mov dword ptr [ebp-00000288h], edi
mov word ptr [ebp-0000025Ch], ss
mov word ptr [ebp-00000268h], cs
mov word ptr [ebp-0000028Ch], ds
mov word ptr [ebp-00000290h], es
mov word ptr [ebp-00000294h], fs
mov word ptr [ebp-00000298h], gs
pushfd
pop dword ptr [ebp-00000264h]
mov eax, dword ptr [ebp+04h]
mov dword ptr [ebp-0000026Ch], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [ebp-00000260h], eax
mov dword ptr [ebp-00000324h], 00010001h
mov eax, dword ptr [eax-04h]
push 00000050h
mov dword ptr [ebp-00000270h], eax
lea eax, dword ptr [ebp-58h]
push esi
push eax
call 00007FFBC0F06AEEh

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6eea8	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x79000	0x48ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x3bcc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6d340	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6d3d4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6d378	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x59000	0x4fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x57175	0x57200	f959ed65f49a903603bc150bbb7292aa	False	0.571329694225251	data	6.62552167894442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x59000	0x179b6	0x17a00	cb0626634f7bf1c5779954b9e8e456d0	False	0.5005787037037037	Zebra Metafile graphic (comment = \210\002\007)	5.859466241544869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x71000	0x5d44	0xe00	fa1a169b9414830def88848af87110b5	False	0.22154017857142858	data	3.00580031855032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x77000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x78000	0x230	0x400	09e4699aa75951ab53e804fe4f9a3b6b	False	0.3271484375	data	2.349075166240886	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x79000	0x48ac	0x4a00	c35fd4df4fff2e8495236400ffbeeec9	False	0.25380067567567566	data	3.815921536460377	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x3bcc	0x3c00	0a6e61b09628beca43d4bf9604f65238	False	0.7639973958333334	data	6.718533933603825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7918c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3421985815602837
RT_ICON	0x795f4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.27704918032786885
RT_ICON	0x79f7c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.23686679174484052
RT_ICON	0x7b024	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.22977178423236513
RT_RCDATA	0x7d5cc	0x29f	data			1.0163934426229508
RT_GROUP_ICON	0x7d86c	0x3e	data	English	United States	0.8064516129032258

Imports

DLL	Import
KERNEL32.dll	FindNextFileA, ExpandEnvironmentStringsA, GetLongPathNameW, CopyFileW, GetLocaleInfoA, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, GetNativeSystemInfo, HeapAlloc, GetProcessHeap, FreeLibrary, IsBadReadPtr, GetTempPathW, OpenProcess, OpenMutexA, lstrcatW, GetCurrentProcessId, GetTempFileNameW, UnmapViewOfFile, DuplicateHandle, CreateFileMappingW, MapViewOfFile, GetSystemDirectoryA, GlobalAlloc, GlobalLock, GetTickCount, GlobalUnlock, WriteProcessMemory, ResumeThread, GetThreadContext, ReadProcessMemory, CreateProcessW, SetThreadContext, LocalAlloc, GlobalFree, MulDiv, SizeofResource, QueryDosDeviceW, FindFirstVolumeW, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, lstrlenW, GetStdHandle, SetFilePointer, FindResourceA, LockResource, LoadResource, LocalFree, FindVolumeClose, GetVolumePathNamesForVolumeNameW, lstrcpyW, FindFirstFileA, FormatMessageA, FindNextVolumeW, AllocConsole, lstrcmpW, GetModuleFileNameA, lstrcpynA, QueryPerformanceFrequency, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, HeapSize, WriteConsoleW, SetStdHandle, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindFirstFileExA, ReadConsoleW, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, HeapReAlloc, GetACP, GetModuleHandleExW, MoveFileExW, RtlUnwind, RaiseException, LoadLibraryExW, GetCPInfo, GetStringTypeW, GetLocaleInfoW, LCMapStringW, CompareStringW, TlsFree, TlsSetValue, TlsGetValue, GetFileSize, TerminateThread, GetLastError, CreateDirectoryW, GetModuleHandleA, RemoveDirectoryW, MoveFileW, SetFilePointerEx, GetLogicalDriveStringsA, DeleteFileW, DeleteFileA, SetFileAttributesW, GetFileAttributesW, FindClose, lstrlenA, GetDriveTypeA, FindNextFileW, GetFileSizeEx, FindFirstFileW, GetModuleHandleW, ExitProcess, CreateMutexA, GetCurrentProcess, GetProcAddress, LoadLibraryA, CreateProcessA, PeekNamedPipe, CreatePipe, TerminateProcess, ReadFile, HeapFree, HeapCreate, CreateEventA, GetLocalTime, CreateThread, SetEvent, CreateEventW, WaitForSingleObject, Sleep, GetModuleFileNameW, CloseHandle, ExitThread, CreateFileW, WriteFile, SetConsoleOutputCP, TlsAlloc, InitializeCriticalSectionAndSpinCount, MultiByteToWideChar, DecodePointer, EncodePointer, WideCharToMultiByte, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, WaitForSingleObjectEx, ResetEvent, SetEndOfFile
USER32.dll	GetWindowTextW, wsprintfW, GetClipboardData, UnhookWindowsHookEx, GetForegroundWindow, ToUnicodeEx, GetKeyboardLayout, SetWindowsHookExA, CloseClipboard, OpenClipboard, GetKeyboardState, CallNextHookEx, GetKeyboardLayoutNameA, GetKeyState, GetWindowTextLengthW, GetWindowThreadProcessId, GetMessageA, SetClipboardData, EnumWindows, ExitWindowsEx, EmptyClipboard, ShowWindow, SetWindowTextW, MessageBoxW, IsWindowVisible, CloseWindow, SendInput, EnumDisplaySettingsW, mouse_event, CreatePopupMenu, DispatchMessageA, TranslateMessage, TrackPopupMenu, DefWindowProcA, CreateWindowExA, GetIconInfo, GetSystemMetrics, AppendMenuA, RegisterClassExA, GetCursorPos, SetForegroundWindow, DrawIcon, SystemParametersInfoW
GDI32.dll	BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, StretchBlt, GetDIBits, DeleteObject, CreateDCA, GetObjectA, DeleteDC
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, GetUserNameW, RegEnumKeyExA, QueryServiceStatus, CloseServiceHandle, OpenSCManagerW, OpenSCManagerA, ControlService, StartServiceW, QueryServiceConfigW, ChangeServiceConfigW, OpenServiceW, EnumServicesStatusW, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegCreateKeyA, RegCloseKey, RegQueryInfoKeyW, RegQueryValueExA, RegCreateKeyExW, RegEnumKeyExW, RegSetValueExW, RegSetValueExA, RegOpenKeyExA, RegOpenKeyExW, RegCreateKeyW, RegDeleteValueW, RegEnumValueW, RegQueryValueExW, RegDeleteKeyA
SHELL32.dll	ShellExecuteExA, Shell_NotifyIconA, ExtractIconA, ShellExecuteW
ole32.dll	CoInitializeEx, CoUninitialize, CoGetObject
SHLWAPI.dll	PathFileExistsW, PathFileExistsA, StrToIntA
WINMM.dll	waveInUnprepareHeader, waveInOpen, waveInStart, waveInAddBuffer, PlaySoundW, mciSendStringA, mciSendStringW, waveInClose, waveInStop, waveInPrepareHeader
WS2_32.dll	gethostbyname, send, WSAStartup, closesocket, inet_ntoa, htons, htonl, getservbyname, ntohs, getservbyport, gethostbyaddr, inet_addr, WSASetLastError, WSAGetLastError, recv, connect, socket
urlmon.dll	URLOpenBlockingStreamW, URLDownloadToFileW
gdiplus.dll	GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdipAlloc, GdipCloneImage, GdipGetImageEncoders, GdiplusStartup, GdipLoadImageFromStream
WININET.dll	InternetOpenUrlW, InternetOpenW, InternetCloseHandle, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-29T16:06:56.322890+0200	TCP	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	49730	8997	192.168.2.4	190.70.119.188
2024-08-29T16:09:00.868774+0200	TCP	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	8997	49730	190.70.119.188	192.168.2.4
2024-08-29T16:06:57.000533+0200	TCP	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	8997	49730	190.70.119.188	192.168.2.4
2024-08-29T16:06:57.858069+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49731	80	192.168.2.4	178.237.33.50
2024-08-29T16:11:00.964719+0200	TCP	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	8997	49730	190.70.119.188	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 16:06:56.316940069 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:06:56.321790934 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:06:56.321871996 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:06:56.322890043 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:06:56.327771902 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:06:57.000533104 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:06:57.001924992 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:06:57.015131950 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:06:57.148525000 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:06:57.195316076 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:06:57.220074892 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:06:57.226629972 CEST	80	49731	178.237.33.50	192.168.2.4
Aug 29, 2024 16:06:57.226689100 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:06:57.226824999 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:06:57.231746912 CEST	80	49731	178.237.33.50	192.168.2.4
Aug 29, 2024 16:06:57.857980967 CEST	80	49731	178.237.33.50	192.168.2.4
Aug 29, 2024 16:06:57.858068943 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:06:58.003222942 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:06:58.011060953 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:06:58.864144087 CEST	80	49731	178.237.33.50	192.168.2.4
Aug 29, 2024 16:06:58.864237070 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:07:00.850959063 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:07:00.857755899 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:07:00.862634897 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:07:30.856880903 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:07:30.858069897 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:07:30.862859011 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:08:00.883070946 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:08:00.909198046 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:08:00.914004087 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:08:30.877777100 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:08:30.879010916 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:08:30.884149075 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:08:47.196085930 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:08:47.679888964 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:08:48.289273024 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:08:49.494884968 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:08:51.992403030 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:08:56.974507093 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:09:00.868773937 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:09:00.871083975 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:09:00.875927925 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:09:06.586189985 CEST	49731	80	192.168.2.4	178.237.33.50
Aug 29, 2024 16:09:30.930414915 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:09:30.935935020 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:09:30.940915108 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:10:00.925805092 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:10:00.928024054 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:10:00.932864904 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:10:30.946767092 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:10:30.987915039 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:10:30.992755890 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:11:00.964719057 CEST	8997	49730	190.70.119.188	192.168.2.4
Aug 29, 2024 16:11:00.966078043 CEST	49730	8997	192.168.2.4	190.70.119.188
Aug 29, 2024 16:11:00.971199036 CEST	8997	49730	190.70.119.188	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 16:06:56.185956955 CEST	63717	53	192.168.2.4	1.1.1.1
Aug 29, 2024 16:06:56.314169884 CEST	53	63717	1.1.1.1	192.168.2.4
Aug 29, 2024 16:06:57.207109928 CEST	52601	53	192.168.2.4	1.1.1.1
Aug 29, 2024 16:06:57.216506958 CEST	53	52601	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 16:06:56.185956955 CEST	192.168.2.4	1.1.1.1	0x3f79	Standard query (0)	colombiaeslibre9889.dynuddns.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 16:06:57.207109928 CEST	192.168.2.4	1.1.1.1	0x3f9c	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 16:06:56.314169884 CEST	1.1.1.1	192.168.2.4	0x3f79	No error (0)	colombiaeslibre9889.dynuddns.com		190.70.119.188	A (IP address)	IN (0x0001)	false
Aug 29, 2024 16:06:57.216506958 CEST	1.1.1.1	192.168.2.4	0x3f9c	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	178.237.33.50	80	5968	C:\ProgramData\27 de Junio\27 de Junio.exe

Timestamp	Bytes transferred	Direction	Data
Aug 29, 2024 16:06:57.226824999 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Aug 29, 2024 16:06:57.857980967 CEST	1170	IN	HTTP/1.1 200 OK date: Thu, 29 Aug 2024 14:06:57 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	10:06:55
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\FdSJYyDayo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FdSJYyDayo.exe"
Imagebase:	0x400000
File size:	494'080 bytes
MD5 hash:	C00E45FE6B36F599558F546CD45D7C52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000000.1672378091.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1674352141.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.1672747458.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1674480983.000000000072E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	10:06:55
Start date:	29/08/2024
Path:	C:\ProgramData\27 de Junio\27 de Junio.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\27 de Junio\27 de Junio.exe"
Imagebase:	0x400000
File size:	494'080 bytes
MD5 hash:	C00E45FE6B36F599558F546CD45D7C52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4140240474.00000000021FF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4139888253.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.4139824044.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000000.1674126891.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4139888253.000000000056E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\ProgramData\27 de Junio\27 de Junio.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	10:07:08
Start date:	29/08/2024
Path:	C:\ProgramData\27 de Junio\27 de Junio.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\27 de Junio\27 de Junio.exe"
Imagebase:	0x400000
File size:	494'080 bytes
MD5 hash:	C00E45FE6B36F599558F546CD45D7C52
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1803831388.0000000000528000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1803741309.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000000.1802942700.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	10:07:16
Start date:	29/08/2024
Path:	C:\ProgramData\27 de Junio\27 de Junio.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\27 de Junio\27 de Junio.exe"
Imagebase:	0x400000
File size:	494'080 bytes
MD5 hash:	C00E45FE6B36F599558F546CD45D7C52
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000000.1883697788.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.1884459506.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1884579837.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	10:07:24
Start date:	29/08/2024
Path:	C:\ProgramData\27 de Junio\27 de Junio.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\27 de Junio\27 de Junio.exe"
Imagebase:	0x400000
File size:	494'080 bytes
MD5 hash:	C00E45FE6B36F599558F546CD45D7C52
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.1965049891.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000007.00000000.1964515889.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000007.00000002.1964940474.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown
Reputation:	low
Has exited:	true