Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.675651841599251
Filename:	file.exe
Filesize:	476672
MD5:	4c128449b1492fc2ff49c431044d4b10
SHA1:	b7b77ae75cd5adfa5aa1c49d48396f5b66a79441
SHA256:	7c171a51686b7da6c4d9178093164888ff30f9be7b4e38412db3c8b98b595cd0
SHA512:	116999bf606a5fc696c0f9c7cf55361c6bba5f26881cd6bce525ca3c95e2676af75be7eea0155cd37b8891fe7d391e4a69887b5fe95de3788b18f7dc2c6924cc
SSDEEP:	6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crmT4:bTlrYw1RUh3NFn+N5WfIQIjbs/ZmdT4
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.-H..~H..~H..~..'~[..~..%~...~..$~V..~AbR~I..~...~J..~.D..R..~.D..r..~.D..j..~AbE~Q..~H..~v..~.D..,..~.D)~I..~.D..I..~RichH..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder Access Token Manipulation System Time Discovery
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Ingress Tool Transfer
Machine Learning detection for sample	AV Detection
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Ingress Tool Transfer
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation Security Software Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found evaded block containing many API calls	Malware Analysis System Evasion	Native API Access Token Manipulation
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation Security Software Discovery System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Security Software Discovery
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates an autostart registry key	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Enumerates the file system	Spreading, Malware Analysis System Evasion
Might use command line arguments	System Summary	Command and Scripting Interpreter Masquerading
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Public key (encryption) found	Cryptography	Account Discovery Security Software Discovery System Owner/User Discovery
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation Security Software Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Category:	dropped
Dump:	Windows Driver Server.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.675651841599251
Encrypted:	false
Ssdeep:	6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crmT4:bTlrYw1RUh3NFn+N5WfIQIjbs/ZmdT4
Size:	476672
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	Credentials In Files OS Credential Dumping
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Credentials In Files
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion
Deletes itself after installation	Hooking and other Techniques for Hiding and Protection	File Deletion
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for dropped file	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspect Svchost Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Abnormal high CPU Usage	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe:Zone.Identifier
Category:	modified
Dump:	Windows Driver Server.exe_Zone.Identifier.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	Credentials In Files OS Credential Dumping
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Credentials In Files
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion
Deletes itself after installation	Hooking and other Techniques for Hiding and Protection	File Deletion
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for dropped file	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Abnormal high CPU Usage	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json
Category:	dropped
Dump:	json[1].json.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Type:	JSON data
Entropy:	5.012309356796613
Encrypted:	false
Ssdeep:	12:tklu+mnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdbauKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	moderate

C:\Users\user\AppData\Roaming\Microsoft\_temp.dat

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\_temp.dat
Category:	dropped
Dump:	_temp.dat.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Type:	data
Entropy:	7.656018651468125
Encrypted:	false
Ssdeep:	12:L3eYZAQM+V5SE8YCQxVaoyWmPx2Oh0Ki8e3cB1Fb5wX2d0ykFCMcMDXVO:L3eenV5oYCQHzzmPx2Sccrw4Abm
Size:	640
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2712
Target ID:	0
Parent PID:	4056
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	476672
MD5:	4C128449B1492FC2FF49C431044D4B10
Time:	11:21:02
Date:	25/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Deletes itself after installation	Hooking and other Techniques for Hiding and Protection	File Deletion
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Details

Is windows:	false
Is dropped:	true
PID:	4600
Target ID:	2
Parent PID:	2712
Name:	Windows Driver Server.exe
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Size:	476672
MD5:	4C128449B1492FC2FF49C431044D4B10
Time:	11:21:03
Date:	25/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Creates files inside the user directory	System Summary	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Details

Is windows:	true
Is dropped:	false
PID:	6748
Target ID:	3
Parent PID:	4600
Name:	svchost.exe
Path:	C:\Windows\SysWOW64\svchost.exe
Commandline:	svchost.exe
Size:	46504
MD5:	1ED18311E3DA35942DB37D15FA40CC5B
Time:	11:21:03
Date:	25/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7b0000
Modulesize:	53248
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspect Svchost Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Uncommon Svchost Parent Process	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7360
Target ID:	12
Parent PID:	4056
Name:	Windows Driver Server.exe
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Size:	476672
MD5:	4C128449B1492FC2FF49C431044D4B10
Time:	11:21:15
Date:	25/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Creates files inside the user directory	System Summary	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7508
Target ID:	14
Parent PID:	4056
Name:	Windows Driver Server.exe
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Size:	476672
MD5:	4C128449B1492FC2FF49C431044D4B10
Time:	11:21:23
Date:	25/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Creates files inside the user directory	System Summary	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe

"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7576
Target ID:	15
Parent PID:	4056
Name:	Windows Driver Server.exe
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"
Size:	476672
MD5:	4C128449B1492FC2FF49C431044D4B10
Time:	13:00:00
Date:	25/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Creates files inside the user directory	System Summary	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

URLs

Name

Malicious

5.20.120.177

Details

Name:	5.20.120.177
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\file.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	2
From Memory:	false
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Suricata IDS alerts with low severity for network traffic	Networking
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpv

unknown

Details

Name:	http://geoplugin.net/json.gpv
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Source:	Windows Driver Server.exe, 00000002.00000003.1284234025.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp5

unknown

Details

Name:	http://geoplugin.net/json.gp5
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Source:	Windows Driver Server.exe, 00000002.00000003.1284234025.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.00000000005F7000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

http://geoplugin.net/json.gpl

unknown

Details

Name:	http://geoplugin.net/json.gpl
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Source:	Windows Driver Server.exe, 00000002.00000003.1284234025.0000000000615000.00000004.00000020.00020000.00000000.sdmp, Windows Driver Server.exe, 00000002.00000002.3710903443.000000000053E000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpSystem32

unknown

Domains

Name

Malicious

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

5.20.120.177

unknown

Lithuania

Details

IP:	5.20.120.177
TargetID:	2
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Country:	Lithuania
Countrycode:	LTU
ASN number:	21412
ASN name:	CGATES-ASLT
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	2
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Rmc-HWAIZA

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	Rmc-HWAIZA
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\Rmc-HWAIZA

del

HKEY_CURRENT_USER\SOFTWARE\Rmc-HWAIZA

exepath

Details

TargetID:	2
Path:	HKEY_CURRENT_USER\SOFTWARE\Rmc-HWAIZA
Value name:	exepath
Value data:	BA 85 2F 38 05 92 EF F2 08 39 2A F4 3B 32 3D 60 22 09 EE 04 AB 19 53 44 1E D0 CB 58 40 62 0E D3 F4 35 A9 77 BC C9 06 1B D2 97 2C FD E1 55 68 8B A3 92 AD 2F 07 E0 40 D2 CE 44 E1 0C F2 0F 1A 65 58 29 3C B6 03 C7 74 A8 65 4E CA FF C3 BA 79 7A 84 8E 26 61 5C F1 64 0D 97 9A 5B 7E ED 71 84 4E 5C 4B 0F 36 69 0F FD BA 7C 0B 1F 93 48 D2 4F 15 F8 46 19 EA 3A B6 0C 87 FC 48 C7 FD 58 CF A0 4F 90 5E 7F DB A0 6F 45 3E 63 E4 4F D8 09 3C

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information

HKEY_CURRENT_USER\SOFTWARE\Rmc-HWAIZA

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-HWAIZA

time

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

Rmc-HWAIZA

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Value name:	Rmc-HWAIZA
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\Windows Driver Server.exe"

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

Memdumps

Base Address

Regiontype

Protect

Malicious

29A0000

unclassified section

page execute and read and write

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

650000

system

page execute and read and write

459000

unkown

page readonly

2A29000

heap

page read and write

459000

unkown

page readonly

6A1000

heap

page read and write

53E000

heap

page read and write

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

50E000

stack

page read and write

400000

unkown

page readonly

5F7000

heap

page read and write

401000

unkown

page execute read

480000

heap

page read and write

4BE000

stack

page read and write

19A000

stack

page read and write

540000

heap

page read and write

58E000

stack

page read and write

5E7000

heap

page read and write

401000

unkown

page execute read

2ACF000

stack

page read and write

670000

heap

page read and write

2A5E000

stack

page read and write

4C0000

heap

page read and write

5DE000

stack

page read and write

6F0000

heap

page read and write

630000

heap

page read and write

53A000

heap

page read and write

712000

heap

page read and write

471000

unkown

page write copy

25DF000

stack

page read and write

1F0000

heap

page read and write

474000

unkown

page read and write

58E000

stack

page read and write

22B0000

heap

page read and write

2C4E000

stack

page read and write

5CE000

stack

page read and write

235F000

stack

page read and write

747000

heap

page read and write

478000

unkown

page readonly

471000

unkown

page write copy

7E8000

heap

page read and write

9DE000

stack

page read and write

471000

unkown

page write copy

478000

unkown

page readonly

471000

unkown

page read and write

4C0000

heap

page read and write

401000

unkown

page execute read

6AB000

heap

page read and write

9B000

stack

page read and write

9C000

stack

page read and write

474000

unkown

page read and write

401000

unkown

page execute read

400000

unkown

page readonly

474000

unkown

page read and write

478000

unkown

page readonly

63C000

stack

page read and write

615000

heap

page read and write

22C0000

heap

page read and write

6FF000

heap

page read and write

270E000

stack

page read and write

400000

unkown

page readonly

7FF000

stack

page read and write

4B0000

heap

page read and write

478000

unkown

page readonly

7E0000

heap

page read and write

3910000

heap

page read and write

271F000

stack

page read and write

2A18000

unclassified section

page execute and read and write

2D4F000

stack

page read and write

2FF0000

heap

page read and write

5D0000

heap

page read and write

93F000

stack

page read and write

478000

unkown

page readonly

86E000

stack

page read and write

748000

heap

page read and write

471000

unkown

page write copy

400000

unkown

page readonly

6C8000

system

page execute and read and write

96F000

stack

page read and write

1F0000

heap

page read and write

6D0000

heap

page read and write

471000

unkown

page read and write

2B5F000

stack

page read and write

9C000

stack

page read and write

401000

unkown

page execute read

400000

unkown

page readonly

50F000

stack

page read and write

62E000

heap

page read and write

289E000

stack

page read and write

285E000

stack

page read and write

474000

unkown

page read and write

2B0E000

stack

page read and write

261E000

stack

page read and write

249F000

stack

page read and write

19D000

stack

page read and write

228E000

stack

page read and write

4C7000

heap

page read and write

600000

heap

page read and write

478000

unkown

page readonly

790000

heap

page read and write

71E000

stack

page read and write

2802000

heap

page read and write

720000

heap

page read and write

2FE0000

heap

page read and write

67E000

heap

page read and write

740000

heap

page read and write

27C0000

heap

page read and write

530000

heap

page read and write

478000

unkown

page readonly

5D0000

heap

page read and write

620000

heap

page read and write

61E000

stack

page read and write

278E000

stack

page read and write

9C000

stack

page read and write

471000

unkown

page write copy

6D5000

heap

page read and write

1F0000

heap

page read and write

3DC000

stack

page read and write

478000

unkown

page readonly

9C000

stack

page read and write

6FE000

heap

page read and write

401000

unkown

page execute read

625000

heap

page read and write

474000

unkown

page read and write

400000

unkown

page readonly

2D8C000

stack

page read and write

2A24000

heap

page read and write

2A12000

heap

page read and write

225E000

stack

page read and write

615000

heap

page read and write

19D000

stack

page read and write

401000

unkown

page execute read

239C000

stack

page read and write

62E000

heap

page read and write

400000

unkown

page readonly

3A20000

heap

page read and write

471000

unkown

page read and write

4C5000

heap

page read and write

2A14000

unclassified section

page execute and read and write

2E8C000

stack

page read and write

400000

unkown

page readonly

2290000

heap

page read and write

400000

unkown

page readonly

471000

unkown

page read and write

478000

unkown

page readonly

730000

heap

page readonly

70E000

stack

page read and write

2150000

heap

page read and write

19D000

stack

page read and write

2A00000

heap

page read and write

712000

heap

page read and write

19D000

stack

page read and write

61E000

stack

page read and write

1F0000

heap

page read and write

401000

unkown

page execute read

22C7000

heap

page read and write

471000

unkown

page read and write

351F000

stack

page read and write

2370000

heap

page read and write

4C0000

heap

page read and write

401000

unkown

page execute read

67A000

heap

page read and write

2B01000

heap

page read and write

400000

unkown

page readonly

401000

unkown

page execute read

6C4000

system

page execute and read and write

480000

heap

page read and write

740000

heap

page read and write

ADF000

stack

page read and write

275D000

stack

page read and write

299F000

stack

page read and write

5F7000

heap

page read and write

24DC000

stack

page read and write

2FDE000

stack

page read and write

93F000

stack

page read and write

2C0F000

stack

page read and write

1F0000

heap

page read and write

478000

unkown

page readonly

73E000

stack

page read and write

5CE000

stack

page read and write

28E0000

heap

page read and write

626000

heap

page read and write

274E000

stack

page read and write

28CF000

stack

page read and write

62E000

heap

page read and write

28D0000

heap

page read and write

There are 183 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
file.exe