Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_0040928E |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
0_2_0041C322 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
0_2_0040C388 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_004096A0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
0_2_00408847 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00407877 FindFirstFileW,FindNextFileW, |
0_2_00407877 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044E8F9 FindFirstFileExA, |
0_2_0044E8F9 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
0_2_0040BB6B |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
0_2_00419B86 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
0_2_0040BD72 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
3_2_0065928E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0066C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
3_2_0066C322 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
3_2_0065C388 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006596A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
3_2_006596A0 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00657877 FindFirstFileW,FindNextFileW, |
3_2_00657877 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00658847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
3_2_00658847 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0069E8F9 FindFirstFileExA, |
3_2_0069E8F9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
3_2_0065BB6B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00669B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
3_2_00669B86 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
3_2_0065BD72 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_0040928E |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
12_2_0041C322 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
12_2_0040C388 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_004096A0 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
12_2_00408847 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00407877 FindFirstFileW,FindNextFileW, |
12_2_00407877 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0044E8F9 FindFirstFileExA, |
12_2_0044E8F9 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
12_2_0040BB6B |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
12_2_00419B86 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
12_2_0040BD72 |
Source: file.exe, type: SAMPLE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: file.exe, type: SAMPLE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: file.exe, type: SAMPLE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043706A |
0_2_0043706A |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00414005 |
0_2_00414005 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043E11C |
0_2_0043E11C |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004541D9 |
0_2_004541D9 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004381E8 |
0_2_004381E8 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0041F18B |
0_2_0041F18B |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00446270 |
0_2_00446270 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043E34B |
0_2_0043E34B |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004533AB |
0_2_004533AB |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0042742E |
0_2_0042742E |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00437566 |
0_2_00437566 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043E5A8 |
0_2_0043E5A8 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004387F0 |
0_2_004387F0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043797E |
0_2_0043797E |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004339D7 |
0_2_004339D7 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044DA49 |
0_2_0044DA49 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00427AD7 |
0_2_00427AD7 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0041DBF3 |
0_2_0041DBF3 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00427C40 |
0_2_00427C40 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00437DB3 |
0_2_00437DB3 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00435EEB |
0_2_00435EEB |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0043DEED |
0_2_0043DEED |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00426E9F |
0_2_00426E9F |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0068706A |
3_2_0068706A |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00664005 |
3_2_00664005 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0068E11C |
3_2_0068E11C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006881E8 |
3_2_006881E8 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006A41D9 |
3_2_006A41D9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0066F18B |
3_2_0066F18B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00696270 |
3_2_00696270 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0068E34B |
3_2_0068E34B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006A33AB |
3_2_006A33AB |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0067742E |
3_2_0067742E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00687566 |
3_2_00687566 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0068E5A8 |
3_2_0068E5A8 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006887F0 |
3_2_006887F0 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0068797E |
3_2_0068797E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006839D7 |
3_2_006839D7 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0069DA49 |
3_2_0069DA49 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00677AD7 |
3_2_00677AD7 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0066DBF3 |
3_2_0066DBF3 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00677C40 |
3_2_00677C40 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00687DB3 |
3_2_00687DB3 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00685EEB |
3_2_00685EEB |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0068DEED |
3_2_0068DEED |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00676E9F |
3_2_00676E9F |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0043706A |
12_2_0043706A |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00414005 |
12_2_00414005 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0043E11C |
12_2_0043E11C |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004541D9 |
12_2_004541D9 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004381E8 |
12_2_004381E8 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0041F18B |
12_2_0041F18B |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00446270 |
12_2_00446270 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0043E34B |
12_2_0043E34B |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004533AB |
12_2_004533AB |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0042742E |
12_2_0042742E |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00437566 |
12_2_00437566 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0043E5A8 |
12_2_0043E5A8 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004387F0 |
12_2_004387F0 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0043797E |
12_2_0043797E |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004339D7 |
12_2_004339D7 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0044DA49 |
12_2_0044DA49 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00427AD7 |
12_2_00427AD7 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0041DBF3 |
12_2_0041DBF3 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00427C40 |
12_2_00427C40 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00437DB3 |
12_2_00437DB3 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00435EEB |
12_2_00435EEB |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0043DEED |
12_2_0043DEED |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00426E9F |
12_2_00426E9F |
Source: file.exe, type: SAMPLE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: file.exe, type: SAMPLE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: file.exe, type: SAMPLE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Software\ |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Rmc-HWAIZA |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Exe |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Exe |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Rmc-HWAIZA |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Rmc-HWAIZA-W |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: ,aF |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Inj |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Inj |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: 8SG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: exepath |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: ,aF |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: 8SG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: exepath |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: licence |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: dMG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: PSG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: Administrator |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: User |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: del |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: del |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Command line argument: del |
0_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: Software\ |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: Exe |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: ,aF |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: Inj |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: Inj |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: 8SG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: exepath |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: ,aF |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: 8SG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: exepath |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: licence |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: dMG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: PSG |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: Administrator |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: User |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: del |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: del |
12_2_0040EA00 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Command line argument: del |
12_2_0040EA00 |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: twext.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: policymanager.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: ntshrui.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: windows.fileexplorer.common.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cscapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: shacct.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: idstore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: samlib.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: textshaping.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: starttiledata.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: acppage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: sfc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: msi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: aepic.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wlidprov.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: samcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: provsvc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_0040928E |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
0_2_0041C322 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
0_2_0040C388 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_004096A0 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
0_2_00408847 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00407877 FindFirstFileW,FindNextFileW, |
0_2_00407877 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0044E8F9 FindFirstFileExA, |
0_2_0044E8F9 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
0_2_0040BB6B |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
0_2_00419B86 |
Source: C:\Users\user\Desktop\file.exe |
Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
0_2_0040BD72 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
3_2_0065928E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0066C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
3_2_0066C322 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
3_2_0065C388 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_006596A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
3_2_006596A0 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00657877 FindFirstFileW,FindNextFileW, |
3_2_00657877 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00658847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
3_2_00658847 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0069E8F9 FindFirstFileExA, |
3_2_0069E8F9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
3_2_0065BB6B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_00669B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
3_2_00669B86 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 3_2_0065BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
3_2_0065BD72 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_0040928E |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
12_2_0041C322 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
12_2_0040C388 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_004096A0 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
12_2_00408847 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00407877 FindFirstFileW,FindNextFileW, |
12_2_00407877 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0044E8F9 FindFirstFileExA, |
12_2_0044E8F9 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
12_2_0040BB6B |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
12_2_00419B86 |
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe |
Code function: 12_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
12_2_0040BD72 |