Windows Analysis Report
file.exe

AI detected suspicious sample

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_004338C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006838C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	3_2_006838C8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	12_2_004338C8

Source: file.exe, 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_eaf0e78b-4

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407538 _wcslen,CoGetObject,	0_2_00407538
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00657538 _wcslen,CoGetObject,	3_2_00657538
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00407538 _wcslen,CoGetObject,	12_2_00407538

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044E8F9 FindFirstFileExA,	0_2_0044E8F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_0065928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0066C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0065C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006596A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_006596A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00657877 FindFirstFileW,FindNextFileW,	3_2_00657877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00658847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_00658847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0069E8F9 FindFirstFileExA,	3_2_0069E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0065BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00669B86 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00669B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0065BD72
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_0040928E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041C322
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040C388
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_004096A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_00408847
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00407877 FindFirstFileW,FindNextFileW,	12_2_00407877
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0044E8F9 FindFirstFileExA,	12_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00419B86
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040BD72

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.7:49700 -> 5.20.120.177:2404

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.20.120.177

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 5.20.120.177:2404

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: CGATES-ASLT CGATES-ASLT

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49701 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.20.120.177
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0041B411

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geoplugin.net

Source: Windows Driver Server.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: file.exe, Windows Driver Server.exe.0.dr	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Windows Driver Server.exe, 00000002.00000003.1284234025.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp5
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: Windows Driver Server.exe, 00000002.00000003.1284234025.0000000000615000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: Windows Driver Server.exe, 00000002.00000003.1284234025.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpv

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

0_2_0040A2F3

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	0_2_004168FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006668FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	3_2_006668FC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	12_2_004168FC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_0040A41B

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041CA73 SystemParametersInfoW,	0_2_0041CA73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066CA73 SystemParametersInfoW,	3_2_0066CA73
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041CA73 SystemParametersInfoW,	12_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: file.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: file.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED	Matched rule: REMCOS_RAT_variants Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_0041330D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	0_2_0041BBC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0041BB9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	3_2_0066330D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066BBC6 OpenProcess,NtResumeProcess,CloseHandle,	3_2_0066BBC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066BB9A OpenProcess,NtSuspendProcess,CloseHandle,	3_2_0066BB9A
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	12_2_0041330D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	12_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	12_2_0041BB9A

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_004167EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006667EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	3_2_006667EF
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	12_2_004167EF

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043706A	0_2_0043706A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414005	0_2_00414005
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043E11C	0_2_0043E11C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004541D9	0_2_004541D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004381E8	0_2_004381E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041F18B	0_2_0041F18B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00446270	0_2_00446270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043E34B	0_2_0043E34B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004533AB	0_2_004533AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042742E	0_2_0042742E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00437566	0_2_00437566
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043E5A8	0_2_0043E5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004387F0	0_2_004387F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043797E	0_2_0043797E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004339D7	0_2_004339D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044DA49	0_2_0044DA49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00427AD7	0_2_00427AD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041DBF3	0_2_0041DBF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00427C40	0_2_00427C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00437DB3	0_2_00437DB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00435EEB	0_2_00435EEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043DEED	0_2_0043DEED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00426E9F	0_2_00426E9F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068706A	3_2_0068706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00664005	3_2_00664005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068E11C	3_2_0068E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006881E8	3_2_006881E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006A41D9	3_2_006A41D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066F18B	3_2_0066F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00696270	3_2_00696270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068E34B	3_2_0068E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006A33AB	3_2_006A33AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0067742E	3_2_0067742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00687566	3_2_00687566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068E5A8	3_2_0068E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006887F0	3_2_006887F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068797E	3_2_0068797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006839D7	3_2_006839D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0069DA49	3_2_0069DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00677AD7	3_2_00677AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066DBF3	3_2_0066DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00677C40	3_2_00677C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00687DB3	3_2_00687DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00685EEB	3_2_00685EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068DEED	3_2_0068DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00676E9F	3_2_00676E9F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043706A	12_2_0043706A
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00414005	12_2_00414005
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043E11C	12_2_0043E11C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004541D9	12_2_004541D9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004381E8	12_2_004381E8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041F18B	12_2_0041F18B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00446270	12_2_00446270
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043E34B	12_2_0043E34B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004533AB	12_2_004533AB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0042742E	12_2_0042742E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00437566	12_2_00437566
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043E5A8	12_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004387F0	12_2_004387F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043797E	12_2_0043797E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004339D7	12_2_004339D7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0044DA49	12_2_0044DA49
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00427AD7	12_2_00427AD7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041DBF3	12_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00427C40	12_2_00427C40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00437DB3	12_2_00437DB3
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00435EEB	12_2_00435EEB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043DEED	12_2_0043DEED
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00426E9F	12_2_00426E9F

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00684E70 appears 54 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00652093 appears 50 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00651E65 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00684801 appears 41 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: String function: 00434801 appears 42 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00401E65 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00434801 appears 42 times

Source: file.exe, 00000000.00000002.1254552076.0000000000712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe, 00000000.00000003.1254121536.0000000000712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: file.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: file.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@8/4@1/2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_0041798D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	3_2_0066798D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	12_2_0041798D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040F4AF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041B539

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA-W
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA

Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Software\	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rmc-HWAIZA	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rmc-HWAIZA	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Rmc-HWAIZA-W	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: ,aF	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: 8SG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: ,aF	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: 8SG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: licence	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: dMG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: PSG	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: Administrator	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: User	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\file.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: Software\	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: Exe	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: ,aF	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: Inj	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: Inj	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: 8SG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: exepath	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: ,aF	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: 8SG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: exepath	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: licence	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: dMG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: PSG	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: Administrator	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: User	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: del	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: del	12_2_0040EA00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Command line argument: del	12_2_0040EA00

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: file.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Creates autostart registry keys with suspicious names

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041CBE1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00457186 push ecx; ret	0_2_00457199
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00457AA8 push eax; ret	0_2_00457AC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434EB6 push ecx; ret	0_2_00434EC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065E0D8 push 00000000h; ret	3_2_0065E0DC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006A7186 push ecx; ret	3_2_006A7199
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AB462 push 00000000h; retf	3_2_006AB474
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AB45A push 00000000h; ret	3_2_006AB45C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AB49A push 00000000h; retn 0000h	3_2_006AB49C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AE55D push esi; ret	3_2_006AE566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AC9FE push 00000000h; retf	3_2_006ACA00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AC9AA pushfd ; retf	3_2_006AC9AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AC98A push esp; retf	3_2_006AC98D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AC98E pushad ; retf	3_2_006AC991
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AC992 push 70006ACBh; retf	3_2_006AC999
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006A7AA8 push eax; ret	3_2_006A7AC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006AAEF2 push 00000000h; iretd	3_2_006AAF04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00684EB6 push ecx; ret	3_2_00684EC9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00457186 push ecx; ret	12_2_00457199
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00457AA8 push eax; ret	12_2_00457AC6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00434EB6 push ecx; ret	12_2_00434EC9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406EEB ShellExecuteW,URLDownloadToFileW,

0_2_00406EEB

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\file.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA

Deletes itself after installation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

File deleted: c:\users\user\desktop\file.exe

Delayed program exit found

Source: C:\Users\user\Desktop\file.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F7E2 Sleep,ExitProcess,	0_2_0040F7E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065F7E2 Sleep,ExitProcess,	3_2_0065F7E2
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040F7E2 Sleep,ExitProcess,	12_2_0040F7E2

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_3-47567

Source: C:\Users\user\Desktop\file.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0041A7D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	3_2_0066A7D9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	12_2_0041A7D9

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Window / User API: threadDelayed 3635	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Window / User API: threadDelayed 3534	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Window / User API: threadDelayed 720	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Window / User API: foregroundWindowGot 1690	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Evaded block: after key decision			graph_0-47617
Source: C:\Users\user\Desktop\file.exe	Evaded block: after key decision			graph_0-47593

Source: C:\Users\user\Desktop\file.exe	API coverage: 6.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 6.2 %
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	API coverage: 6.2 %

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 6640	Thread sleep count: 219 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 6640	Thread sleep time: -109500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 7112	Thread sleep count: 3635 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 7112	Thread sleep time: -10905000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 6760	Thread sleep count: 3534 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 6760	Thread sleep time: -10602000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 7112	Thread sleep count: 720 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 7112	Thread sleep time: -2160000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 6760	Thread sleep count: 314 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe TID: 6760	Thread sleep time: -942000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044E8F9 FindFirstFileExA,	0_2_0044E8F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_0065928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0066C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0066C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0065C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_006596A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_006596A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00657877 FindFirstFileW,FindNextFileW,	3_2_00657877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00658847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_00658847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0069E8F9 FindFirstFileExA,	3_2_0069E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0065BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00669B86 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00669B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0065BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0065BD72
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_0040928E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041C322
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040C388
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_004096A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_00408847
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00407877 FindFirstFileW,FindNextFileW,	12_2_00407877
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0044E8F9 FindFirstFileExA,	12_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00419B86
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040BD72

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Windows Driver Server.exe, 00000002.00000002.3717760471.0000000003910000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\svchost.exe

API call chain: ExitProcess graph end node

graph_3-47568

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00434A8A

Source: C:\Users\user\Desktop\file.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00443355 mov eax, dword ptr fs:[00000030h]	0_2_00443355
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00693355 mov eax, dword ptr fs:[00000030h]	3_2_00693355
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00443355 mov eax, dword ptr fs:[00000030h]	12_2_00443355

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004120B2 GetProcessHeap,HeapFree,

0_2_004120B2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043503C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00434A8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043BB71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434BD8 SetUnhandledExceptionFilter,	0_2_00434BD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0068503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00684A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00684A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0068BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0068BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00684BD8 SetUnhandledExceptionFilter,	3_2_00684BD8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0043503C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00434A8A
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0043BB71
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: 12_2_00434BD8 SetUnhandledExceptionFilter,	12_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 485008

Source: C:\Users\user\Desktop\file.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	0_2_00412132
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	3_2_00662132
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	12_2_00412132

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419662 mouse_event,

0_2_00419662

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior

Source: Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager'
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3717760471.0000000003910000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZA\
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerl
Source: Windows Driver Server.exe, 00000002.00000002.3717760471.0000000003910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZA\%
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZA\yR
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 11:21:16 Program Manager]
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [2024/09/25 11:21:28 Program Manager]
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZA\>
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager[
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerE
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerC
Source: Windows Driver Server.exe, 00000002.00000002.3717760471.0000000003910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZA\s\I+
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [2024/09/25 11:21:16 Program Manager]
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerrR
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 21:10 Program Manager]
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [2024/09/25 11:21:10 Program Manager]
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managers
Source: Windows Driver Server.exe, 00000002.00000002.3717760471.0000000003910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [%04i/%02i/%02i %02i:%02i:%02i Program Manager]
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager-Rm
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager4Rd
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager&Rr
Source: Windows Driver Server.exe, 00000002.00000002.3710903443.0000000000615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZA\f1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00434CB6 cpuid

0_2_00434CB6

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0045201B
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004520B6
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452143
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00452393
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00448484
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004524BC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004525C3
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452690
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0044896D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_0040F90C
Source: C:\Users\user\Desktop\file.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00451D58
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00451FD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_006A201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_006A20B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_006A2143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	3_2_006A2393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_006A24BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_00698484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	3_2_006A25C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_006A2690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	3_2_0069896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	3_2_0065F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_006A1D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	3_2_006A1FD0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: EnumSystemLocalesW,	12_2_0045201B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: EnumSystemLocalesW,	12_2_004520B6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_00452143
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetLocaleInfoW,	12_2_00452393
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: EnumSystemLocalesW,	12_2_00448484
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_004524BC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetLocaleInfoW,	12_2_004525C3
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00452690
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetLocaleInfoW,	12_2_0044896D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: GetLocaleInfoA,	12_2_0040F90C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	12_2_00451D58
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: EnumSystemLocalesW,	12_2_00451FD0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041A045 __EH_prolog,GdiplusStartup,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,

0_2_0041A045

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041B69E GetComputerNameExW,GetUserNameW,

0_2_0041B69E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00449210

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	0_2_0040BA4D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	3_2_0065BA4D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	12_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\file.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	0_2_0040BB6B
Source: C:\Users\user\Desktop\file.exe	Code function: \key3.db	0_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	3_2_0065BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	3_2_0065BB6B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	12_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: \key3.db	12_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\file.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA-W	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-HWAIZA	Jump to behavior

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.29a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.2a32020.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.Windows Driver Server.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Windows Driver Server.exe.5650c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 4600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Windows Driver Server.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Code function: cmd.exe	0_2_0040569A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe	3_2_0065569A
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	Code function: cmd.exe	12_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	222 Process Injection	1 File Deletion	LSA Secrets	23 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	222 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	82%	ReversingLabs	Win32.Backdoor.Remcos
file.exe	100%	Avira	BDS/Backdoor.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	100%	Avira	BDS/Backdoor.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe	82%	ReversingLabs	Win32.Backdoor.Remcos

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
5.20.120.177	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpv	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp5	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpSystem32	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
5.20.120.177	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gpv	Windows Driver Server.exe, 00000002.00000003.1284234025.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp5	Windows Driver Server.exe, 00000002.00000003.1284234025.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	file.exe, Windows Driver Server.exe.0.dr	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	Windows Driver Server.exe, 00000002.00000003.1284234025.0000000000615000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpSystem32	Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.20.120.177	unknown	Lithuania		21412	CGATES-ASLT	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518426
Start date and time:	2024-09-25 17:20:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@8/4@1/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 18 Number of non-executed functions: 394
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Windows Driver Server.exe, PID 4600 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:00:04	API Interceptor	4480459x Sleep call for process: Windows Driver Server.exe modified
17:21:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
17:21:15	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
17:21:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-HWAIZA "C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	z65orderrequest.bat.exe	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	1DUCJGrpyb.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	XjPA2pnUhC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	C8G355qROx.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	geoplugin.net/json.gp
	RFQ-948563836483638563735435376354.xls	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	z65orderrequest.bat.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	1DUCJGrpyb.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	XjPA2pnUhC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	C8G355qROx.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	178.237.33.50
	RFQ-948563836483638563735435376354.xls	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATOM86-ASATOM86NL	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	z65orderrequest.bat.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	1DUCJGrpyb.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1zbL83sqmd.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	XjPA2pnUhC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	AWS 1301241710.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	C8G355qROx.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	178.237.33.50
	RFQ-948563836483638563735435376354.xls	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
CGATES-ASLT	Stub_p49.exe	Get hash	malicious	Blackshades, Poisonivy	Browse	212.117.48.248
	qD7cj0t7Ag.elf	Get hash	malicious	Mirai, Moobot	Browse	79.133.234.9
	MWwbGhEqS4.elf	Get hash	malicious	Mirai	Browse	87.247.119.10
	TxXQ106ErI.elf	Get hash	malicious	Mirai	Browse	87.247.119.11
	NA9GDRMmA3.elf	Get hash	malicious	Unknown	Browse	87.247.119.41
	GfRwN8t3BN.elf	Get hash	malicious	Mirai	Browse	91.187.165.164
	skid.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	46.251.61.207
	crvEujmluK.elf	Get hash	malicious	Mirai, Moobot	Browse	87.247.120.9
	r1kArkKGjW.exe	Get hash	malicious	Sality	Browse	84.32.157.83
	qRRr5gR434.exe	Get hash	malicious	Sality	Browse	84.32.157.83

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.012309356796613
Encrypted:	false
SSDEEP:	12:tklu+mnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdbauKyGX85jvXhNlT3/7AcV9Wro
MD5:	14B479958E659C5A4480548A393022AC
SHA1:	CD0766C1DAB80656D469ABDB22917BE668622015
SHA-256:	0F92BDD807D2F5C9947E1775A20231233043C171F62E1AFA705A7E7938909BFE
SHA-512:	4E87CA47392DD9710F9E3D4A2124A34B41938986A4F43D50A48623DB1838C0D6CFF05FD2A23792DCD5A974A94416C97DC04ECEF85025FC785F3393B69A0B1DC5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"0ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	476672
Entropy (8bit):	6.675651841599251
Encrypted:	false
SSDEEP:	6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crmT4:bTlrYw1RUh3NFn+N5WfIQIjbs/ZmdT4
MD5:	4C128449B1492FC2FF49C431044D4B10
SHA1:	B7B77AE75CD5ADFA5AA1C49D48396F5B66A79441
SHA-256:	7C171A51686B7DA6C4D9178093164888FF30F9BE7B4E38412DB3C8B98B595CD0
SHA-512:	116999BF606A5FC696C0F9C7CF55361C6BBA5F26881CD6BCE525CA3C95E2676AF75BE7EEA0155CD37B8891FE7D391E4A69887B5FE95DE3788B18F7DC2C6924CC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.-H..~H..~H..~..'~[..~..%~...~..$~V..~AbR~I..~..~J..~.D..R..~.D..r..~.D..j..~AbE~Q..~H..~v..~.D..,..~.D)~I..~.D..I..~RichH..~........................PE..L......f.................r...........J............@.................................s\...........................................................................;..P...8...............................@............................................text....q.......r.................. ..`.rdata...y.......z...v..............@..@.data...D]..........................@....tls.........p......................@....gfids..0...........................@..@.rsrc...............................@..@.reloc...;.......<..................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\_temp.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
File Type:	data
Category:	dropped
Size (bytes):	640
Entropy (8bit):	7.656018651468125
Encrypted:	false
SSDEEP:	12:L3eYZAQM+V5SE8YCQxVaoyWmPx2Oh0Ki8e3cB1Fb5wX2d0ykFCMcMDXVO:L3eenV5oYCQHzzmPx2Sccrw4Abm
MD5:	68FDF62E2C6A66C1AD986C52E66961DE
SHA1:	09714DA290FA89AFD084E0BDC9940502D9CDA15B
SHA-256:	5039F6C6145F3F118710777BDE8F7D0FB2FD58C95CA2C7CF8E323C1816594355
SHA-512:	A1DE6AB84B485F13A2A7D8D246F3BE1A1561114466EE72DAD570BBAC6E32571A35CA9ED75AC997EC6C86549F723435B8CB8AB2911C30B867334EEF12A966DD21
Malicious:	false
Reputation:	low
Preview:	..8....K9}.}2a`N......DE.X.bZ.5.w..}...o..UF..../7.{..D....8eS)".3.V.kN...dz..aN.q...x~.q.NeKm6....V........FH.g....H.....O.^<.o.>)...3<g.b~...@p#3+4....U..{&7.'....+....uD..e..M..4..6oe7$8....F.w..Gr..v"...#.".&..3..\.n...@f.......T.L0...mH........B`.5...#.Af.9.s=^&}.<...,...Z]..t..........*...Z{W.30a....^..?6%!vS..../>..x...t.}.6@.t...X.)..v),.a........N...4.ep.+.7.V..G..d.oa8.H.}..A......).oS^K.q.oet...!.u.:..`.+....h..m..x.v..o....nx......V%4ni.+a.-..e.."_...s....x[.....7B........f.}..F....'.5.p0.~7......f....T+H....+%5.a ....._........ .F..z..!.5..!..k.."....K........0.'....4..E.p...v.{.I....z

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.675651841599251
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	476'672 bytes
MD5:	4c128449b1492fc2ff49c431044d4b10
SHA1:	b7b77ae75cd5adfa5aa1c49d48396f5b66a79441
SHA256:	7c171a51686b7da6c4d9178093164888ff30f9be7b4e38412db3c8b98b595cd0
SHA512:	116999bf606a5fc696c0f9c7cf55361c6bba5f26881cd6bce525ca3c95e2676af75be7eea0155cd37b8891fe7d391e4a69887b5fe95de3788b18f7dc2c6924cc
SSDEEP:	6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crmT4:bTlrYw1RUh3NFn+N5WfIQIjbs/ZmdT4
TLSH:	C8A4AF01FAD1C072D97614300D3AB766DAB8F9201935497F73EA0D5AEE31190A73ABB7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.-H..~H..~H..~..'~[..~..%~...~..$~V..~AbR~I..~...~J..~.D..R..~.D..r..~.D..j..~AbE~Q..~H..~v..~.D..,..~.D)~I..~.D..I..~RichH..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x434a80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x66D71DE3 [Tue Sep 3 14:32:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	1389569a3a39186f3eb453b501cfe688

Entrypoint Preview

Instruction
call 00007F623886696Bh
jmp 00007F62388663B3h
push ebp
mov ebp, esp
sub esp, 00000324h
push ebx
push esi
push 00000017h
call 00007F6238888C03h
test eax, eax
je 00007F6238866527h
mov ecx, dword ptr [ebp+08h]
int 29h
xor esi, esi
lea eax, dword ptr [ebp-00000324h]
push 000002CCh
push esi
push eax
mov dword ptr [00471D14h], esi
call 00007F6238868976h
add esp, 0Ch
mov dword ptr [ebp-00000274h], eax
mov dword ptr [ebp-00000278h], ecx
mov dword ptr [ebp-0000027Ch], edx
mov dword ptr [ebp-00000280h], ebx
mov dword ptr [ebp-00000284h], esi
mov dword ptr [ebp-00000288h], edi
mov word ptr [ebp-0000025Ch], ss
mov word ptr [ebp-00000268h], cs
mov word ptr [ebp-0000028Ch], ds
mov word ptr [ebp-00000290h], es
mov word ptr [ebp-00000294h], fs
mov word ptr [ebp-00000298h], gs
pushfd
pop dword ptr [ebp-00000264h]
mov eax, dword ptr [ebp+04h]
mov dword ptr [ebp-0000026Ch], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [ebp-00000260h], eax
mov dword ptr [ebp-00000324h], 00010001h
mov eax, dword ptr [eax-04h]
push 00000050h
mov dword ptr [ebp-00000270h], eax
lea eax, dword ptr [ebp-58h]
push esi
push eax
call 00007F62388688EDh

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6eeb8	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x79000	0x5c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x3bc8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6d350	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6d3e4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6d388	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x59000	0x500	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x571f5	0x57200	e504ab64b98631753dc227346d757c52	False	0.5716379348995696	data	6.6273936921798455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x59000	0x179dc	0x17a00	2a24a2cbf738bf5f992a0162fad3d464	False	0.5008577215608465	data	5.862074061245876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x71000	0x5d44	0xe00	0eaccffe1cb836994ce5d3ccfb22d4f9	False	0.22126116071428573	data	3.0035180736120775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x77000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x78000	0x230	0x400	9ca325bce9f8c0342c0381814603584a	False	0.330078125	data	2.3999762503719224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x79000	0x5c4	0x600	b9d551a2154dbebcafe8e6a89ff3b02d	False	0.9759114583333334	data	7.543013375090305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7a000	0x3bc8	0x3c00	047d13d1dd0f82094cdf10f08253441e	False	0.7640625	data	6.723768218094163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x7906c	0x558	data			1.0080409356725146

Imports

DLL	Import
KERNEL32.dll	FindNextFileA, ExpandEnvironmentStringsA, GetLongPathNameW, CopyFileW, GetLocaleInfoA, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, GetNativeSystemInfo, HeapAlloc, GetProcessHeap, FreeLibrary, IsBadReadPtr, GetTempPathW, OpenProcess, OpenMutexA, lstrcatW, GetCurrentProcessId, GetTempFileNameW, UnmapViewOfFile, DuplicateHandle, CreateFileMappingW, MapViewOfFile, GetSystemDirectoryA, GlobalAlloc, GlobalLock, GetTickCount, GlobalUnlock, WriteProcessMemory, ResumeThread, GetThreadContext, ReadProcessMemory, CreateProcessW, SetThreadContext, LocalAlloc, GlobalFree, MulDiv, SizeofResource, QueryDosDeviceW, FindFirstVolumeW, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, lstrlenW, GetStdHandle, SetFilePointer, FindResourceA, LockResource, LoadResource, LocalFree, FindVolumeClose, GetVolumePathNamesForVolumeNameW, lstrcpyW, FindFirstFileA, FormatMessageA, FindNextVolumeW, AllocConsole, lstrcmpW, GetModuleFileNameA, lstrcpynA, QueryPerformanceFrequency, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, HeapSize, WriteConsoleW, SetStdHandle, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindFirstFileExA, ReadConsoleW, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, HeapReAlloc, GetACP, GetModuleHandleExW, MoveFileExW, RtlUnwind, RaiseException, LoadLibraryExW, GetCPInfo, GetStringTypeW, GetLocaleInfoW, LCMapStringW, CompareStringW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, GetFileSize, TerminateThread, GetLastError, CreateDirectoryW, GetModuleHandleA, RemoveDirectoryW, MoveFileW, SetFilePointerEx, GetLogicalDriveStringsA, DeleteFileW, DeleteFileA, SetFileAttributesW, GetFileAttributesW, FindClose, lstrlenA, GetDriveTypeA, FindNextFileW, GetFileSizeEx, FindFirstFileW, GetModuleHandleW, ExitProcess, CreateMutexA, GetCurrentProcess, GetProcAddress, LoadLibraryA, CreateProcessA, PeekNamedPipe, CreatePipe, TerminateProcess, ReadFile, HeapFree, HeapCreate, CreateEventA, GetLocalTime, CreateThread, SetEvent, CreateEventW, WaitForSingleObject, Sleep, GetModuleFileNameW, CloseHandle, ExitThread, CreateFileW, WriteFile, SetConsoleOutputCP, InitializeCriticalSectionAndSpinCount, MultiByteToWideChar, DecodePointer, EncodePointer, WideCharToMultiByte, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, WaitForSingleObjectEx, ResetEvent, SetEndOfFile
USER32.dll	GetMessageA, GetWindowTextW, wsprintfW, GetClipboardData, UnhookWindowsHookEx, GetForegroundWindow, ToUnicodeEx, GetKeyboardLayout, SetWindowsHookExA, CloseClipboard, OpenClipboard, GetKeyboardState, CallNextHookEx, GetKeyboardLayoutNameA, GetKeyState, GetWindowTextLengthW, DispatchMessageA, SetForegroundWindow, SetClipboardData, EnumWindows, ExitWindowsEx, EmptyClipboard, ShowWindow, SetWindowTextW, MessageBoxW, IsWindowVisible, CloseWindow, SendInput, EnumDisplaySettingsW, mouse_event, CreatePopupMenu, TranslateMessage, TrackPopupMenu, DefWindowProcA, CreateWindowExA, AppendMenuA, GetSystemMetrics, RegisterClassExA, GetCursorPos, SystemParametersInfoW, GetWindowThreadProcessId, MapVirtualKeyA, DrawIcon, GetIconInfo
GDI32.dll	BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, StretchBlt, GetDIBits, DeleteObject, CreateDCA, GetObjectA, DeleteDC
ADVAPI32.dll	CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, GetUserNameW, RegEnumKeyExA, QueryServiceStatus, CloseServiceHandle, OpenSCManagerW, OpenSCManagerA, ControlService, StartServiceW, QueryServiceConfigW, ChangeServiceConfigW, OpenServiceW, EnumServicesStatusW, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegCreateKeyA, RegCloseKey, RegQueryInfoKeyW, RegQueryValueExA, RegCreateKeyExW, RegEnumKeyExW, RegSetValueExW, RegSetValueExA, RegOpenKeyExA, RegOpenKeyExW, RegCreateKeyW, RegDeleteValueW, RegEnumValueW, RegQueryValueExW, RegDeleteKeyA
SHELL32.dll	ShellExecuteExA, Shell_NotifyIconA, ExtractIconA, ShellExecuteW
ole32.dll	CoInitializeEx, CoUninitialize, CoGetObject
SHLWAPI.dll	PathFileExistsW, PathFileExistsA, StrToIntA
WINMM.dll	waveInOpen, waveInStart, waveInAddBuffer, PlaySoundW, mciSendStringA, mciSendStringW, waveInClose, waveInStop, waveInPrepareHeader, waveInUnprepareHeader
WS2_32.dll	gethostbyname, send, WSAStartup, closesocket, inet_ntoa, htons, htonl, getservbyname, ntohs, getservbyport, gethostbyaddr, inet_addr, WSASetLastError, WSAGetLastError, recv, connect, socket
urlmon.dll	URLOpenBlockingStreamW, URLDownloadToFileW
gdiplus.dll	GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdipAlloc, GdipCloneImage, GdipGetImageEncoders, GdiplusStartup, GdipLoadImageFromStream
WININET.dll	InternetOpenUrlW, InternetOpenW, InternetCloseHandle, InternetReadFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T17:21:05.427080+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.7	49700	5.20.120.177	2404	TCP
2024-09-25T17:21:07.565125+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49701	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 17:21:04.671436071 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:04.676491022 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:04.676582098 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:04.681737900 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:04.686575890 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:05.377666950 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:05.427079916 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:05.505316019 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:05.552078962 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:05.569439888 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:05.581588030 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:05.581692934 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:05.592931986 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:05.931217909 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:05.989562988 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:06.017330885 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:06.065013885 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:06.073159933 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:06.082350969 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:06.925559998 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:21:06.930435896 CEST	80	49701	178.237.33.50	192.168.2.7
Sep 25, 2024 17:21:06.930506945 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:21:06.930668116 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:21:06.936696053 CEST	80	49701	178.237.33.50	192.168.2.7
Sep 25, 2024 17:21:07.563596964 CEST	80	49701	178.237.33.50	192.168.2.7
Sep 25, 2024 17:21:07.565124989 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:21:07.615474939 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:07.620628119 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:08.643798113 CEST	80	49701	178.237.33.50	192.168.2.7
Sep 25, 2024 17:21:08.643951893 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:21:18.837997913 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:18.839898109 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:18.846314907 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:47.661731005 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:21:47.663815975 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:21:47.668988943 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:22:16.277842999 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:22:16.288911104 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:22:16.293862104 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:22:44.977761030 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:22:44.984220982 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:22:44.990082979 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:22:56.834139109 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:22:57.254774094 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:22:57.911931038 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:22:59.115140915 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:23:01.521322966 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:23:06.505762100 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:23:13.883946896 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:23:13.885531902 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:23:13.892206907 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:23:16.115163088 CEST	49701	80	192.168.2.7	178.237.33.50
Sep 25, 2024 17:23:42.399360895 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:23:42.401490927 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:23:42.406325102 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:24:11.110577106 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:24:11.112019062 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:24:11.118967056 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:24:39.815773964 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:24:39.816988945 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:24:39.821851015 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:25:08.527709007 CEST	2404	49700	5.20.120.177	192.168.2.7
Sep 25, 2024 17:25:08.529000998 CEST	49700	2404	192.168.2.7	5.20.120.177
Sep 25, 2024 17:25:08.533768892 CEST	2404	49700	5.20.120.177	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 17:21:06.908353090 CEST	50457	53	192.168.2.7	1.1.1.1
Sep 25, 2024 17:21:06.916908979 CEST	53	50457	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 17:21:06.908353090 CEST	192.168.2.7	1.1.1.1	0x2510	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 17:21:06.916908979 CEST	1.1.1.1	192.168.2.7	0x2510	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	178.237.33.50	80	4600	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 17:21:06.930668116 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Sep 25, 2024 17:21:07.563596964 CEST	1170	IN	HTTP/1.1 200 OK date: Wed, 25 Sep 2024 15:21:07 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 30 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"0ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	11:21:02
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	476'672 bytes
MD5 hash:	4C128449B1492FC2FF49C431044D4B10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000000.1247355487.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1254312533.0000000000459000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.1247804602.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:21:03
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Imagebase:	0x400000
File size:	476'672 bytes
MD5 hash:	4C128449B1492FC2FF49C431044D4B10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000000.1253966896.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.3717171506.00000000029A0000.00000040.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.3705973509.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	11:21:03
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x7b0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.3710869118.0000000002A29000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.3704068669.0000000000650000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	11:21:15
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Imagebase:	0x400000
File size:	476'672 bytes
MD5 hash:	4C128449B1492FC2FF49C431044D4B10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000000.1378084777.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.1378823959.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	11:21:23
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Imagebase:	0x400000
File size:	476'672 bytes
MD5 hash:	4C128449B1492FC2FF49C431044D4B10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000000.1458791256.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.1459776587.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	13:00:00
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Imagebase:	0x400000
File size:	476'672 bytes
MD5 hash:	4C128449B1492FC2FF49C431044D4B10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000000.1539705372.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.1540202104.0000000000459000.00000002.00000001.01000000.00000006.sdmp, Author: unknown
Reputation:	low
Has exited:	true