Source: 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Malware Configuration Extractor: Remcos {"Host:Port:Password": "23spt.duckdns.org:3000:0", "Assigned name": "Tost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-RZH5WZ", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"} |
Source: Yara match |
File source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Source: Yara match |
File source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.4139200887.00000000022FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4138803518.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000000.1678896409.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe PID: 7256, type: MEMORYSTR |
Source: Yara match |
File source: C:\ProgramData\remcos\logs.dat, type: DROPPED |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_0040928E |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
0_2_0041C322 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
0_2_0040C388 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_004096A0 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
0_2_00408847 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00407877 FindFirstFileW,FindNextFileW, |
0_2_00407877 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
0_2_0040BB6B |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
0_2_00419B86 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
0_2_0040BD72 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49730 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49735 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49731 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49740 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49733 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49732 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49745 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49748 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49742 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49753 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49758 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49750 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49744 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49746 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49768 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49759 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49743 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49760 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49763 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49754 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49762 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49777 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49773 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49770 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49800 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49772 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49776 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49761 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49797 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49765 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49809 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49806 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49774 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49780 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49810 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49801 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49778 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49769 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49832 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49789 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49829 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49813 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49818 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49838 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49812 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49834 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49791 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49798 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49775 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49784 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49790 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49786 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49788 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49805 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49785 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49823 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49815 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49831 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49771 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49819 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49830 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49821 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49794 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49783 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49826 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49839 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49843 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49803 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49836 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49779 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49767 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49820 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49766 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49828 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49792 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49835 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49840 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49822 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49749 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49827 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49787 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49782 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49793 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49795 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49814 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49756 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49804 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49816 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49825 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49796 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49802 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49841 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49817 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49824 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49757 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49764 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49842 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49833 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49799 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49808 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49781 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49837 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49807 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49811 -> 191.93.114.27:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49747 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49751 -> 181.236.206.3:3000 |
Source: Network traffic |
Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49752 -> 181.236.206.3:3000 |
Source: Yara match |
File source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Source: Yara match |
File source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.4139200887.00000000022FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4138803518.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000000.1678896409.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe PID: 7256, type: MEMORYSTR |
Source: Yara match |
File source: C:\ProgramData\remcos\logs.dat, type: DROPPED |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000000.00000002.4138803518.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000000.00000000.1678896409.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe PID: 7256, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle, |
0_2_0041330D |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle, |
0_2_0041BBC6 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle, |
0_2_0041BB9A |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043706A |
0_2_0043706A |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00414005 |
0_2_00414005 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043E11C |
0_2_0043E11C |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004541D9 |
0_2_004541D9 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004381E8 |
0_2_004381E8 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041F18B |
0_2_0041F18B |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00446270 |
0_2_00446270 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043E34B |
0_2_0043E34B |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004533AB |
0_2_004533AB |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0042742E |
0_2_0042742E |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00437566 |
0_2_00437566 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043E5A8 |
0_2_0043E5A8 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004387F0 |
0_2_004387F0 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043797E |
0_2_0043797E |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004339D7 |
0_2_004339D7 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0044DA49 |
0_2_0044DA49 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00427AD7 |
0_2_00427AD7 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041DBF3 |
0_2_0041DBF3 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00427C40 |
0_2_00427C40 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00437DB3 |
0_2_00437DB3 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00435EEB |
0_2_00435EEB |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043DEED |
0_2_0043DEED |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00426E9F |
0_2_00426E9F |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000000.00000002.4138803518.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000000.00000000.1678896409.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe PID: 7256, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Software\ |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Rmc-RZH5WZ |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Exe |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Exe |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Rmc-RZH5WZ |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: ,aF |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Inj |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Inj |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: h&y |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: h&y |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: h&y |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: xKy |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: h&y |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: exepath |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: ,aF |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: xKy |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: exepath |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: h&y |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: licence |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: dMG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: PSG |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: Administrator |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: User |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: del |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: del |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Command line argument: del |
0_2_0040EA00 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, |
0_2_0041CBE1 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, |
0_2_0041CBE1 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_0040928E |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
0_2_0041C322 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
0_2_0040C388 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
0_2_004096A0 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
0_2_00408847 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00407877 FindFirstFileW,FindNextFileW, |
0_2_00407877 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
0_2_0040BB6B |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW, |
0_2_00419B86 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
0_2_0040BD72 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, |
0_2_0041CBE1 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
0_2_0043503C |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_00434A8A |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_0043BB71 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: 0_2_00434BD8 SetUnhandledExceptionFilter, |
0_2_00434BD8 |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program Manager |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program ManagerWZ\3000 |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program ManagerWZ\ |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program Manager$1 |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program Managerckets\ |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program Managerdns.org:3000J |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: |Program Manager| |
Source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp, logs.dat.0.dr |
Binary or memory string: [Program Manager] |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetLocaleInfoA, |
0_2_0040F90C |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: EnumSystemLocalesW, |
0_2_0045201B |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: EnumSystemLocalesW, |
0_2_004520B6 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
0_2_00452143 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetLocaleInfoW, |
0_2_00452393 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: EnumSystemLocalesW, |
0_2_00448484 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
0_2_004524BC |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetLocaleInfoW, |
0_2_004525C3 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
0_2_00452690 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: GetLocaleInfoW, |
0_2_0044896D |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, |
0_2_00451D58 |
Source: C:\Users\user\Desktop\17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe |
Code function: EnumSystemLocalesW, |
0_2_00451FD0 |
Source: Yara match |
File source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Source: Yara match |
File source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.4139200887.00000000022FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4138803518.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000000.1678896409.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe PID: 7256, type: MEMORYSTR |
Source: Yara match |
File source: C:\ProgramData\remcos\logs.dat, type: DROPPED |
Source: Yara match |
File source: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe, type: SAMPLE |
Source: Yara match |
File source: 0.2.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.0.17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.4139200887.00000000022FF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4138803518.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000000.1678896409.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4139021655.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: 17273431863ab7a79d0c4618c39383a44188eff7849fa1201010774aef83d8c896a4db4eb8287.dat-decoded.exe PID: 7256, type: MEMORYSTR |
Source: Yara match |
File source: C:\ProgramData\remcos\logs.dat, type: DROPPED |