Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

rYhL.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.971036074202022
Filename:	rYhL.exe
Filesize:	961536
MD5:	ca4ccb77c304e8074abd359dd086ede4
SHA1:	4a17bc625d34ccde78a62db109877f8e9d808d70
SHA256:	f127eced7a835fecf3453bcb307040fb4e91bfc0c63983d2a8d6c0dd72a4e5c1
SHA512:	f2ee3df238385bcadb32dd658330e825252de969d8a1e24a0457e8f7268c362d8c73420f2e062e920d6a3e975f2b74a091475a63e0150837af9e013a674a71f2
SSDEEP:	24576:kEbp9p29m6p2SxSrExb5Ag+PmiCix5InZg0SO:Xl90X8Axb5Ag+Pm7O5Ie0SO
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..0...z.......N... ...`....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Access Token Manipulation Security Software Discovery
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools Security Software Discovery
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation Process Injection
Machine Learning detection for sample	AV Detection	Security Software Discovery
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to steal Instant Messenger accounts or passwords	Stealing of Sensitive Information	Credentials in Registry Security Software Discovery
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to steal Mail credentials (via file registry)	Stealing of Sensitive Information
Abnormal high CPU Usage	System Summary	Access Token Manipulation Process Injection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Security Software Discovery Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)	Malware Analysis System Evasion, Anti Debugging	Security Software Discovery
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery Ingress Tool Transfer
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Security Software Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Security Software Discovery
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Security Software Discovery
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading Security Software Discovery
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Archive Collected Data Encrypted Channel
Enables debug privileges	Anti Debugging
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found decision node followed by non-executed suspicious APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading Security Software Discovery
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Security Software Discovery
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools Security Software Discovery
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools Security Software Discovery
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary	System Information Discovery
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to modify the execution of threads in other processes		Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading Security Software Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools Security Software Discovery
Creates mutexes	System Summary	Access Token Manipulation Security Software Discovery
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Found strings which match to known social media urls	Networking
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Program exit points	Malware Analysis System Evasion	Security Software Discovery
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery
Queries a list of all open handles	System Summary
Queries a list of all running processes	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation Security Software Discovery
SQL strings found in memory and binary data	System Summary
Sample is known by Antivirus	System Summary	Access Token Manipulation Security Software Discovery
Sample requires command line parameters (based on API chain)	System Summary	Native API Command and Scripting Interpreter
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary	Access Token Manipulation
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary	Access Token Manipulation
Tries to open an application configuration file (.cfg)	System Summary	Access Token Manipulation

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rYhL.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rYhL.exe.log
Category:	dropped
Dump:	rYhL.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\rYhL.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
Category:	dropped
Dump:	json[1].json.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Users\user\Desktop\rYhL.exe
Type:	JSON data
Entropy:	5.013811273052389
Encrypted:	false
Ssdeep:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	moderate

C:\Users\user\AppData\Local\Temp\bhv6B90.tmp

Extensible storage engine DataBase, version 0x620, checksum 0xb2117364, page size 32768, DirtyShutdown, Windows version 10.0

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\bhv6B90.tmp
Category:	dropped
Dump:	bhv6B90.tmp.5.dr
ID:	dr_2
Target ID:	5
Process:	C:\Users\user\Desktop\rYhL.exe
Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb2117364, page size 32768, DirtyShutdown, Windows version 10.0
Entropy:	0.801200608050408
Encrypted:	false
Ssdeep:	6144:idfjZb5aXEY2waXEY24URlMe4APXAP5APzAPwbndOO8pHAP6JnTJnTbnSotnBQ+z:wVS4e81ySaKKjLrONseWe
Size:	17301504
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\ohqatscrleqoh

Unicode text, UTF-16, little-endian text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\ohqatscrleqoh
Category:	dropped
Dump:	ohqatscrleqoh.5.dr
ID:	dr_3
Target ID:	5
Process:	C:\Users\user\Desktop\rYhL.exe
Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Entropy:	1.0
Encrypted:	false
Ssdeep:	3:Qn:Qn
Size:	2
Whitelisted:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\rYhL.exe

"C:\Users\user\Desktop\rYhL.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6196
Target ID:	0
Parent PID:	1028
Name:	rYhL.exe
Path:	C:\Users\user\Desktop\rYhL.exe
Commandline:	"C:\Users\user\Desktop\rYhL.exe"
Size:	961536
MD5:	CA4CCB77C304E8074ABD359DD086EDE4
Time:	01:23:55
Date:	30/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf70000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\rYhL.exe

"C:\Users\user\Desktop\rYhL.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5884
Target ID:	3
Parent PID:	6196
Name:	rYhL.exe
Path:	C:\Users\user\Desktop\rYhL.exe
Commandline:	"C:\Users\user\Desktop\rYhL.exe"
Size:	961536
MD5:	CA4CCB77C304E8074ABD359DD086EDE4
Time:	01:23:56
Date:	30/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xd40000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\rYhL.exe

C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\ohqatscrleqoh"

Details

Is windows:	false
Is dropped:	false
PID:	4284
Target ID:	4
Parent PID:	5884
Name:	rYhL.exe
Path:	C:\Users\user\Desktop\rYhL.exe
Commandline:	C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\ohqatscrleqoh"
Size:	961536
MD5:	CA4CCB77C304E8074ABD359DD086EDE4
Time:	01:24:01
Date:	30/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x80000
Modulesize:	983040
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\rYhL.exe

C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\ohqatscrleqoh"

Details

Is windows:	false
Is dropped:	false
PID:	4308
Target ID:	5
Parent PID:	5884
Name:	rYhL.exe
Path:	C:\Users\user\Desktop\rYhL.exe
Commandline:	C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\ohqatscrleqoh"
Size:	961536
MD5:	CA4CCB77C304E8074ABD359DD086EDE4
Time:	01:24:01
Date:	30/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xff0000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\rYhL.exe

C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\ybvkuknlzmitkiyc"

Details

Is windows:	false
Is dropped:	false
PID:	1716
Target ID:	6
Parent PID:	5884
Name:	rYhL.exe
Path:	C:\Users\user\Desktop\rYhL.exe
Commandline:	C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\ybvkuknlzmitkiyc"
Size:	961536
MD5:	CA4CCB77C304E8074ABD359DD086EDE4
Time:	01:24:01
Date:	30/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x4b0000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\rYhL.exe

C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\idaducgmvuafupugdysz"

Details

Is windows:	false
Is dropped:	false
PID:	3852
Target ID:	7
Parent PID:	5884
Name:	rYhL.exe
Path:	C:\Users\user\Desktop\rYhL.exe
Commandline:	C:\Users\user\Desktop\rYhL.exe /stext "C:\Users\user\AppData\Local\Temp\idaducgmvuafupugdysz"
Size:	961536
MD5:	CA4CCB77C304E8074ABD359DD086EDE4
Time:	01:24:01
Date:	30/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xd90000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

127.0.0.1

http://geoplugin.net/json.gp

178.237.33.50

https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P

unknown

https://www.google.com

unknown

https://www.office.com/

unknown

http://www.imvu.comr

unknown

https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073

unknown

https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF

unknown

https://aefd.nelreports.net/api/report?cat=bingaot

unknown

http://geoplugin.net/json.gp/C

unknown

https://maps.windows.com/windows-app-web-link

unknown

https://login.li

unknown

https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e

unknown

http://www.imvu.com

unknown

https://aefd.nelreports.net/api/report?cat=bingrms

unknown

https://www.google.com/accounts/servicelogin

unknown

https://login.yahoo.com/config/login

unknown

http://www.nirsoft.net

unknown

https://aefd.nelreports.net/api/report?cat=bingaotak

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

http://www.nirsoft.net/

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

http://www.ebuddy.com

unknown

There are 13 hidden URLs, click here to show them.

Domains

Name

Malicious

15.164.165.52.in-addr.arpa

unknown

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

67.207.161.204

unknown

United States

Details

IP:	67.207.161.204
TargetID:	3
Current Path:	C:\Users\user\Desktop\rYhL.exe
Country:	United States
Countrycode:	USA
ASN number:	21769
ASN name:	AS-COLOAMUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

127.0.0.1

unknown

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	3
Current Path:	C:\Users\user\Desktop\rYhL.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-ZA03K9

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-ZA03K9

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-ZA03K9

time

Memdumps

Base Address

Regiontype

Protect

Malicious

43E9000

trusted library allocation

page read and write

400000

remote allocation

page execute and read and write

1547000

heap

page read and write

422A000

heap

page read and write

75D6000

trusted library allocation

page read and write

14EF000

stack

page read and write

58F0000

heap

page read and write

150D000

stack

page read and write

14F4000

stack

page read and write

3340000

heap

page read and write

1962000

trusted library allocation

page read and write

776F000

stack

page read and write

93B000

stack

page read and write

1943000

trusted library allocation

page execute and read and write

14DB000

stack

page read and write

F72000

unkown

page readonly

584D000

trusted library allocation

page read and write

78AE000

stack

page read and write

173F000

stack

page read and write

594B000

stack

page read and write

BB5E000

stack

page read and write

5960000

trusted library allocation

page read and write

32C5000

trusted library allocation

page read and write

400000

system

page execute and read and write

1540000

heap

page read and write

91E2000

heap

page read and write

335C000

heap

page read and write

12FA000

stack

page read and write

75D0000

trusted library allocation

page read and write

3452000

trusted library allocation

page read and write

1930000

trusted library allocation

page read and write

1540000

heap

page read and write

5B2E000

stack

page read and write

1340000

heap

page read and write

159F000

heap

page read and write

116C000

stack

page read and write

459000

system

page execute and read and write

272F000

stack

page read and write

456000

system

page execute and read and write

474000

remote allocation

page execute and read and write

1966000

trusted library allocation

page execute and read and write

F70000

unkown

page readonly

1990000

trusted library allocation

page read and write

133E000

stack

page read and write

1A3F000

stack

page read and write

194D000

trusted library allocation

page execute and read and write

1568000

heap

page read and write

160E000

stack

page read and write

58D5000

heap

page read and write

1220000

heap

page read and write

196A000

trusted library allocation

page execute and read and write

3820000

heap

page read and write

18F0000

heap

page read and write

10000000

direct allocation

page read and write

400000

system

page execute and read and write

5CF0000

heap

page read and write

2FF0000

heap

page read and write

7620000

trusted library allocation

page read and write

F0C000

stack

page read and write

1953000

trusted library allocation

page read and write

15A3000

heap

page read and write

1675000

heap

page read and write

15A8000

heap

page read and write

5950000

trusted library allocation

page read and write

32F0000

heap

page read and write

1450000

heap

page read and write

1638000

heap

page read and write

5BF0000

heap

page read and write

45D000

system

page execute and read and write

A7E000

stack

page read and write

1960000

trusted library allocation

page read and write

11D0000

heap

page read and write

1594000

heap

page read and write

195D000

trusted library allocation

page execute and read and write

BB1E000

stack

page read and write

1468000

heap

page read and write

45C000

system

page execute and read and write

5983000

heap

page read and write

1950000

trusted library allocation

page read and write

3462000

trusted library allocation

page read and write

75B0000

trusted library allocation

page execute and read and write

7F70000

trusted library allocation

page execute and read and write

1748000

heap

page read and write

43E1000

trusted library allocation

page read and write

7F60000

trusted library allocation

page read and write

5820000

trusted library allocation

page read and write

197B000

trusted library allocation

page execute and read and write

58C0000

trusted library allocation

page execute and read and write

332F000

heap

page read and write

3346000

heap

page read and write

5846000

trusted library allocation

page read and write

33DF000

stack

page read and write

13C0000

heap

page read and write

1972000

trusted library allocation

page read and write

583E000

trusted library allocation

page read and write

1390000

heap

page read and write

BC5E000

stack

page read and write

1612000

heap

page read and write

19DE000

stack

page read and write

EBC000

stack

page read and write

1460000

heap

page read and write

17EE000

stack

page read and write

327F000

stack

page read and write

91E0000

heap

page read and write

10016000

direct allocation

page execute and read and write

1A20000

heap

page read and write

5860000

trusted library allocation

page read and write

32D0000

heap

page read and write

172F000

stack

page read and write

5890000

trusted library allocation

page read and write

33E1000

trusted library allocation

page read and write

5D00000

heap

page read and write

9215000

heap

page read and write

1660000

heap

page read and write

F70000

heap

page read and write

332C000

heap

page read and write

15C9000

heap

page read and write

A30000

heap

page read and write

1360000

heap

page read and write

3270000

heap

page execute and read and write

74F0000

trusted library section

page read and write

5D21000

heap

page read and write

1970000

trusted library allocation

page read and write

5DF0000

heap

page read and write

AF0000

heap

page read and write

A00000

heap

page read and write

58D0000

heap

page read and write

9E0000

heap

page read and write

1581000

heap

page read and write

10EA000

stack

page read and write

41B000

system

page execute and read and write

473000

system

page execute and read and write

B10000

heap

page read and write

134E000

stack

page read and write

79F0000

trusted library allocation

page execute and read and write

32C0000

trusted library allocation

page read and write

164E000

stack

page read and write

54DC000

stack

page read and write

400000

system

page execute and read and write

32A0000

trusted library allocation

page read and write

AF8000

heap

page read and write

4228000

heap

page read and write

920F000

heap

page read and write

15A1000

heap

page read and write

14D6000

stack

page read and write

1C0E000

heap

page read and write

160E000

heap

page read and write

423D000

heap

page read and write

4040000

heap

page read and write

7790000

trusted library allocation

page read and write

11E0000

heap

page read and write

3920000

heap

page read and write

5E10000

heap

page read and write

5E00000

heap

page read and write

1385000

heap

page read and write

5B50000

trusted library allocation

page execute and read and write

1944000

trusted library allocation

page read and write

1460000

heap

page read and write

1056000

unkown

page readonly

5841000

trusted library allocation

page read and write

BA1E000

stack

page read and write

1A27000

heap

page read and write

1740000

heap

page read and write

11E7000

stack

page read and write

DBF000

stack

page read and write

3C0F000

stack

page read and write

7770000

trusted library section

page read and write

31D8000

trusted library allocation

page read and write

41DB000

heap

page read and write

1465000

heap

page read and write

5980000

heap

page read and write

10001000

direct allocation

page execute and read and write

13A0000

heap

page read and write

478000

remote allocation

page execute and read and write

15B9000

heap

page read and write

761E000

stack

page read and write

77A0000

trusted library allocation

page read and write

5F30000

trusted library allocation

page read and write

365F000

stack

page read and write

1870000

heap

page read and write

5900000

heap

page execute and read and write

B0C000

heap

page read and write

1380000

heap

page read and write

193F000

stack

page read and write

3300000

heap

page read and write

7A70000

trusted library allocation

page read and write

FBE000

stack

page read and write

78ED000

stack

page read and write

1C00000

heap

page read and write

3000000

heap

page read and write

1977000

trusted library allocation

page execute and read and write

5970000

trusted library allocation

page read and write

18EE000

stack

page read and write

83C000

stack

page read and write

1670000

heap

page read and write

32B0000

trusted library allocation

page read and write

582B000

trusted library allocation

page read and write

3B0E000

stack

page read and write

1587000

heap

page read and write

7B82000

trusted library allocation

page read and write

16E0000

heap

page read and write

30F2000

heap

page read and write

14F2000

stack

page read and write

163D000

heap

page read and write

15BF000

heap

page read and write

331C000

heap

page read and write

FC0000

heap

page read and write

792E000

stack

page read and write

3280000

trusted library allocation

page execute and read and write

5B40000

trusted library allocation

page read and write

1940000

trusted library allocation

page read and write

3290000

trusted library allocation

page read and write

9DE000

stack

page read and write

E80000

heap

page read and write

317E000

stack

page read and write

3363000

heap

page read and write

16DE000

stack

page read and write

3210000

heap

page read and write

990000

heap

page read and write

1A1C000

stack

page read and write

5B60000

trusted library section

page readonly

169E000

stack

page read and write

3020000

heap

page read and write

92E0000

trusted library allocation

page execute and read and write

FBC000

stack

page read and write

156E000

heap

page read and write

2FDF000

stack

page read and write

766E000

stack

page read and write

1560000

heap

page read and write

There are 219 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
rYhL.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportrYhL.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
rYhL.exe