Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.5997028894119785
Filename:	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Filesize:	494592
MD5:	e9057285aafb6978445c07029fdc5898
SHA1:	f928987a99bfde3cf80730d04e5c1436271d71d0
SHA256:	a21c68c24894a9bd385b58971c4a35d8c4b896a5d4da56ad47832114af033ad6
SHA512:	8603477d72a91833fb3d7c63086b5409ce4d39b3387008fcde96c9f94639726ff219bb6ce9fa9f2173da6b71e123b6549d1876b7145f3a0ff431ced7e779d90f
SSDEEP:	6144:bXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZ5AXIcNn5Gv:bX7tPMK8ctGe4Dzl4h2QnuPs/Z56cv
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-H..~H..~H..~.f$~[..~.f&~...~.f'~V..~A.Q~I..~.Z.~J..~....R..~....r..~....j..~A.F~Q..~H..~u..~....,..~..*~I..~....I..~RichH..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to steal Instant Messenger accounts or passwords	Stealing of Sensitive Information	Credentials in Registry Credentials In Files
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to steal Mail credentials (via file registry)	Stealing of Sensitive Information
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)	Malware Analysis System Evasion, Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery Ingress Tool Transfer
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Process Discovery
Enables debug privileges	Anti Debugging
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found decision node followed by non-executed suspicious APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to modify the execution of threads in other processes		Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary	Access Token Manipulation
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Found strings which match to known social media urls	Networking
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Might use command line arguments	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Queries a list of all open handles	System Summary
Queries a list of all running processes	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
SQL strings found in memory and binary data	System Summary
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample requires command line parameters (based on API chain)	System Summary	Native API Command and Scripting Interpreter
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Checks if Microsoft Office is installed	System Summary	Access Token Manipulation
Tries to open an application configuration file (.cfg)	System Summary	Access Token Manipulation

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json
Category:	dropped
Dump:	json[1].json.6.dr
ID:	dr_0
Target ID:	6
Process:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Type:	JSON data
Entropy:	5.013811273052389
Encrypted:	false
Ssdeep:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Temp\bhvD06.tmp

Extensible storage engine DataBase, version 0x620, checksum 0xe41c9139, page size 32768, DirtyShutdown, Windows version 10.0

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\bhvD06.tmp
Category:	dropped
Dump:	bhvD06.tmp.9.dr
ID:	dr_1
Target ID:	9
Process:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe41c9139, page size 32768, DirtyShutdown, Windows version 10.0
Entropy:	0.9773332236397271
Encrypted:	false
Ssdeep:	6144:QgMnQEUUMBPPpBPJmNjfiEWC7WswQpWK/qZCCkxpu514dCVZ3L9yqXx4SU8GxJHL:hn/cj5tND5ApBK4K
Size:	14680064
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\xttxrevmuropxyhmme

Unicode text, UTF-16, little-endian text, with no line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Temp\xttxrevmuropxyhmme
Category:	modified
Dump:	xttxrevmuropxyhmme.9.dr
ID:	dr_2
Target ID:	9
Process:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Entropy:	1.0
Encrypted:	false
Ssdeep:	3:Qn:Qn
Size:	2
Whitelisted:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

"C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7172
Target ID:	6
Parent PID:	4056
Name:	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Path:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Commandline:	"C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe"
Size:	494592
MD5:	E9057285AAFB6978445C07029FDC5898
Time:	16:00:15
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\xttxrevmuropxyhmme"

Details

Is windows:	false
Is dropped:	false
PID:	7432
Target ID:	9
Parent PID:	7172
Name:	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Path:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Commandline:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\xttxrevmuropxyhmme"
Size:	494592
MD5:	E9057285AAFB6978445C07029FDC5898
Time:	16:00:18
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	491520
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\hnyqswgoizgciedqvprkl"

Details

Is windows:	false
Is dropped:	false
PID:	7440
Target ID:	10
Parent PID:	7172
Name:	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Path:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Commandline:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\hnyqswgoizgciedqvprkl"
Size:	494592
MD5:	E9057285AAFB6978445C07029FDC5898
Time:	16:00:18
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	401408
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\jpebsprhwhyhkkrunalmokuw"

Details

Is windows:	false
Is dropped:	false
PID:	7456
Target ID:	11
Parent PID:	7172
Name:	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Path:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Commandline:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\jpebsprhwhyhkkrunalmokuw"
Size:	494592
MD5:	E9057285AAFB6978445C07029FDC5898
Time:	16:00:18
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	147456
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

URLs

Name

Malicious

cavps7.duckdns.org

https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P

unknown

https://www.office.com/

unknown

http://geoplugin.net/json.gp:U

unknown

https://fp-afd.azurefd.us/apc/trans.gif?a2555e10569a45fe03b885d268c50da9

unknown

http://www.imvu.comr

unknown

http://geoplugin.net/json.gpl

unknown

https://aefd.nelreports.net/api/report?cat=bingth

unknown

http://www.imvu.com

unknown

https://aefd.nelreports.net/api/report?cat=wsb

unknown

http://www.imvu.comppData

unknown

http://www.nirsoft.net

unknown

https://aefd.nelreports.net/api/report?cat=bingaotak

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?c2fcd52267835a3e34f9ac05

unknown

https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?bd78002c55888096ce060c58

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

http://geoplugin.net/json.gp3U

unknown

http://geoplugin.net/json.gp

178.237.33.50

https://www.google.com

unknown

https://aefd.nelreports.net/api/report?cat=bingaot

unknown

https://fp-afd.azurefd.us/apc/trans.gif?69c749c200c753dfb00f5bc8299ab8eb

unknown

http://geoplugin.net/json.gp/C

unknown

https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat

unknown

https://aefd.nelreports.net/api/report?cat=bingrms

unknown

https://www.google.com/accounts/servicelogin

unknown

https://login.yahoo.com/config/login

unknown

http://www.nirsoft.net/

unknown

https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&

unknown

http://www.ebuddy.com

unknown

There are 21 hidden URLs, click here to show them.

Domains

Name

Malicious

cavps7.duckdns.org

84.32.44.139

Details

Name:	cavps7.duckdns.org
IP:	84.32.44.139
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

84.32.44.139

cavps7.duckdns.org

Lithuania

Details

IP:	84.32.44.139
TargetID:	6
Current Path:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Country:	Lithuania
Countrycode:	LTU
ASN number:	33922
ASN name:	NTT-LT-ASLT
Private:	false
Domain:	cavps7.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	6
Current Path:	C:\Users\user\Desktop\1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-43JG4A

exepath

Details

TargetID:	6
Path:	HKEY_CURRENT_USER\SOFTWARE\Rmc-43JG4A
Value name:	exepath
Value data:	CF E4 1F DA B9 6D B2 83 E2 32 5E B5 FC B0 5D 83 D6 9A 81 BF AC 77 01 AE 86 BC 4F EF 96 D5 A7 A4 6E BB 99 3B 21 27 9A 8C A9 CF 69 0A 8B 36 DC 15 46 C2 6A 34 F5 34 95 44 67 8A 33 31 0B 36 66 5E 96 2D 83 0A 58 92 42 51 C6 D5 F1 27 5C 81 14 3D 1D DE A8 1F 85 7F F0 C4 70 D3 05 01 29 56 80 33 6C 8F 72 5D C2 AF 35 D7 B3 AB A4 B7 D7 D6 3E 7B 77 E6 2A 87 E4 13 94 BB 38 F4 8D 50 64 7B 1B E1 D8 D9 2C 09 4E 7E 3E 20 03 ED 7B 2A BE 13 1A 72 7C 8B 06 51 7B F6 32 4A 25 8B 5B 4A 21 45 02 D0 CA F6 0C B1 B4 A9 FF 02 F1 36 5D 76 90 A6 C2 BD F9 44 2A AA EC EE C8 0F 0F DB 42 DA E2 1E 4C 38 AF F0 6E 30 96 64 FF F6 E6 1F 16 CD 64 E9 F8 93 69 51 68 9B FE E6 88 96 14 D9 BC 04 B5 5D 5A 5E AB E0 59 3C 35 98 FE 9F 31 A1 37 1A 3E EB B6 22 92 36

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information

HKEY_CURRENT_USER\SOFTWARE\Rmc-43JG4A

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-43JG4A

time

Memdumps

Base Address

Regiontype

Protect

Malicious

459000

unkown

page readonly

459000

unkown

page readonly

4BE000

heap

page read and write

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

400000

system

page execute and read and write

2169000

heap

page read and write

555000

heap

page read and write

536000

heap

page read and write

218A000

heap

page read and write

2178000

heap

page read and write

4FE000

heap

page read and write

990000

heap

page read and write

2175000

heap

page read and write

554000

heap

page read and write

2876000

heap

page read and write

216E000

heap

page read and write

216D000

heap

page read and write

529000

heap

page read and write

555000

heap

page read and write

529000

heap

page read and write

2861000

heap

page read and write

2861000

heap

page read and write

2A40000

trusted library allocation

page read and write

284C000

heap

page read and write

59F000

heap

page read and write

236F000

stack

page read and write

2178000

heap

page read and write

598000

heap

page read and write

540000

heap

page read and write

595000

heap

page read and write

285F000

heap

page read and write

28A6000

heap

page read and write

940000

trusted library allocation

page read and write

478000

unkown

page readonly

2DDC000

heap

page read and write

459000

system

page execute and read and write

2160000

heap

page read and write

59F000

heap

page read and write

216E000

heap

page read and write

2841000

heap

page read and write

54F000

heap

page read and write

546000

heap

page read and write

549000

heap

page read and write

284C000

heap

page read and write

490000

heap

page read and write

595000

heap

page read and write

4A0000

heap

page read and write

2210000

heap

page read and write

478000

unkown

page readonly

547000

heap

page read and write

2DA0000

heap

page read and write

2A40000

trusted library allocation

page read and write

28A6000

heap

page read and write

1F0000

heap

page read and write

2847000

heap

page read and write

216D000

heap

page read and write

3483000

heap

page read and write

2849000

heap

page read and write

540000

heap

page read and write

284A000

heap

page read and write

2840000

heap

page read and write

401000

unkown

page execute read

54C000

heap

page read and write

4A4000

heap

page read and write

52B000

heap

page read and write

546000

heap

page read and write

54F000

heap

page read and write

3A40000

unclassified section

page execute and read and write

471000

unkown

page write copy

400000

unkown

page readonly

56F000

heap

page read and write

284A000

heap

page read and write

2A40000

trusted library allocation

page read and write

284C000

heap

page read and write

2175000

heap

page read and write

2198000

heap

page read and write

566000

heap

page read and write

2169000

heap

page read and write

546000

heap

page read and write

2170000

heap

page read and write

53B000

heap

page read and write

59F000

heap

page read and write

555000

heap

page read and write

690000

heap

page read and write

2DD6000

heap

page read and write

3A99000

unclassified section

page execute and read and write

2848000

heap

page read and write

400000

unkown

page readonly

28A6000

heap

page read and write

2D98000

heap

page read and write

531000

heap

page read and write

28A6000

heap

page read and write

2848000

heap

page read and write

4A4000

heap

page read and write

2848000

heap

page read and write

2848000

heap

page read and write

594000

heap

page read and write

595000

heap

page read and write

28A6000

heap

page read and write

691000

heap

page read and write

3A9D000

unclassified section

page execute and read and write

511000

heap

page read and write

540000

heap

page read and write

226E000

stack

page read and write

2178000

heap

page read and write

4BA000

heap

page read and write

284A000

heap

page read and write

2D98000

heap

page read and write

34FC000

heap

page read and write

2175000

heap

page read and write

93F000

stack

page read and write

28A6000

heap

page read and write

52A000

heap

page read and write

53B000

heap

page read and write

51D000

heap

page read and write

594000

heap

page read and write

59F000

heap

page read and write

2581000

heap

page read and write

2161000

heap

page read and write

19C000

stack

page read and write

53A000

heap

page read and write

99D000

heap

page read and write

1F0000

heap

page read and write

2847000

heap

page read and write

550000

heap

page read and write

2160000

heap

page read and write

9C000

stack

page read and write

2A40000

trusted library allocation

page read and write

554000

heap

page read and write

4A4000

heap

page read and write

566000

heap

page read and write

2FFE000

stack

page read and write

2176000

heap

page read and write

2178000

heap

page read and write

193000

stack

page read and write

21B9000

heap

page read and write

4A4000

heap

page read and write

3B26000

unclassified section

page execute and read and write

474000

unkown

page read and write

45C000

system

page execute and read and write

99B000

heap

page read and write

595000

heap

page read and write

2887000

heap

page read and write

1C0000

heap

page read and write

20EE000

stack

page read and write

5A4000

heap

page read and write

2161000

heap

page read and write

34FB000

heap

page read and write

59E000

stack

page read and write

69F000

stack

page read and write

3391000

heap

page read and write

2851000

heap

page read and write

2171000

heap

page read and write

28A6000

heap

page read and write

2175000

heap

page read and write

89C000

heap

page read and write

2171000

heap

page read and write

2866000

heap

page read and write

2866000

heap

page read and write

9C000

stack

page read and write

2747000

heap

page read and write

30FF000

stack

page read and write

9C000

stack

page read and write

4A4000

heap

page read and write

28A6000

heap

page read and write

2849000

heap

page read and write

2D9A000

heap

page read and write

471000

unkown

page write copy

473000

system

page execute and read and write

3409000

heap

page read and write

257F000

stack

page read and write

2861000

heap

page read and write

52A000

heap

page read and write

2866000

heap

page read and write

52B000

heap

page read and write

556000

heap

page read and write

471000

unkown

page read and write

555000

heap

page read and write

2181000

heap

page read and write

2DD6000

heap

page read and write

28A6000

heap

page read and write

28A6000

heap

page read and write

566000

heap

page read and write

3B50000

unclassified section

page execute and read and write

565000

heap

page read and write

21A3000

heap

page read and write

284A000

heap

page read and write

218E000

heap

page read and write

554000

heap

page read and write

59F000

heap

page read and write

510000

heap

page read and write

2851000

heap

page read and write

554000

heap

page read and write

2862000

heap

page read and write

478000

unkown

page readonly

554000

heap

page read and write

10016000

direct allocation

page execute and read and write

2160000

heap

page read and write

4A4000

heap

page read and write

2841000

heap

page read and write

555000

heap

page read and write

6EE000

stack

page read and write

546000

heap

page read and write

4A4000

heap

page read and write

546000

heap

page read and write

2841000

heap

page read and write

2120000

heap

page read and write

2A40000

trusted library allocation

page read and write

2176000

heap

page read and write

549000

heap

page read and write

28A6000

heap

page read and write

529000

heap

page read and write

554000

heap

page read and write

2175000

heap

page read and write

216E000

heap

page read and write

3AB3000

unclassified section

page execute and read and write

400000

unkown

page readonly

3390000

heap

page read and write

1F0000

heap

page read and write

216E000

heap

page read and write

99E000

heap

page read and write

2DB4000

heap

page read and write

2D9A000

heap

page read and write

554000

heap

page read and write

2861000

heap

page read and write

52D000

heap

page read and write

566000

heap

page read and write

566000

heap

page read and write

5A1000

heap

page read and write

587000

heap

page read and write

4A4000

heap

page read and write

52D000

heap

page read and write

28A6000

heap

page read and write

555000

heap

page read and write

548000

heap

page read and write

359D000

heap

page read and write

556000

heap

page read and write

59F000

heap

page read and write

28A6000

heap

page read and write

2DD3000

heap

page read and write

53B000

heap

page read and write

2D9A000

heap

page read and write

216E000

heap

page read and write

400000

system

page execute and read and write

216E000

heap

page read and write

59B000

heap

page read and write

2178000

heap

page read and write

554000

heap

page read and write

19C000

stack

page read and write

2843000

heap

page read and write

284C000

heap

page read and write

28A6000

heap

page read and write

533000

heap

page read and write

470000

heap

page read and write

7BE000

stack

page read and write

5DE000

stack

page read and write

2161000

heap

page read and write

2160000

heap

page read and write

2169000

heap

page read and write

549000

heap

page read and write

4A4000

heap

page read and write

690000

heap

page read and write

470000

heap

page read and write

28A6000

heap

page read and write

598000

heap

page read and write

536000

heap

page read and write

2860000

heap

page read and write

536000

heap

page read and write

59F000

heap

page read and write

52A000

heap

page read and write

2197000

heap

page read and write

4EF000

heap

page read and write

2169000

heap

page read and write

59F000

heap

page read and write

59F000

heap

page read and write

2741000

heap

page read and write

2A40000

trusted library allocation

page read and write

554000

heap

page read and write

660000

heap

page read and write

28A6000

heap

page read and write

680000

heap

page read and write

2310000

heap

page read and write

2165000

heap

page read and write

478000

unkown

page readonly

2847000

heap

page read and write

2161000

heap

page read and write

554000

heap

page read and write

222F000

stack

page read and write

748000

heap

page read and write

2847000

heap

page read and write

2861000

heap

page read and write

2848000

heap

page read and write

99D000

heap

page read and write

587000

heap

page read and write

216D000

heap

page read and write

554000

heap

page read and write

2176000

heap

page read and write

401000

unkown

page execute read

2DD6000

heap

page read and write

2161000

heap

page read and write

1C6000

heap

page read and write

2741000

heap

page read and write

2887000

heap

page read and write

2581000

heap

page read and write

2849000

heap

page read and write

595000

heap

page read and write

2D20000

heap

page read and write

355C000

heap

page read and write

51D000

heap

page read and write

566000

heap

page read and write

471000

unkown

page write copy

2860000

heap

page read and write

46E000

stack

page read and write

3391000

heap

page read and write

28A6000

heap

page read and write

5A1000

heap

page read and write

2841000

heap

page read and write

284C000

heap

page read and write

5A1000

heap

page read and write

7BF000

stack

page read and write

4FE000

heap

page read and write

569000

heap

page read and write

890000

heap

page read and write

540000

heap

page read and write

2178000

heap

page read and write

28A6000

heap

page read and write

542000

heap

page read and write

4A0000

heap

page read and write

2DB1000

heap

page read and write

740000

heap

page read and write

2891000

heap

page read and write

990000

heap

page read and write

59F000

heap

page read and write

28A6000

heap

page read and write

554000

heap

page read and write

401000

unkown

page execute read

2DD6000

heap

page read and write

85F000

stack

page read and write

6A0000

heap

page read and write

2140000

heap

page read and write

41B000

system

page execute and read and write

582000

heap

page read and write

284C000

heap

page read and write

3B2C000

unclassified section

page execute and read and write

668000

heap

page read and write

401000

unkown

page execute read

284A000

heap

page read and write

284C000

heap

page read and write

89C000

heap

page read and write

400000

unkown

page readonly

99B000

heap

page read and write

52D000

heap

page read and write

566000

heap

page read and write

536000

heap

page read and write

56F000

heap

page read and write

3391000

heap

page read and write

2178000

heap

page read and write

554000

heap

page read and write

216E000

heap

page read and write

2160000

heap

page read and write

4A4000

heap

page read and write

2178000

heap

page read and write

710000

heap

page read and write

555000

heap

page read and write

456000

system

page execute and read and write

52A000

heap

page read and write

478000

unkown

page readonly

569000

heap

page read and write

471000

unkown

page write copy

51D000

heap

page read and write

2D21000

heap

page read and write

177000

stack

page read and write

51D000

heap

page read and write

587000

heap

page read and write

2D98000

heap

page read and write

10000000

direct allocation

page read and write

45D000

system

page execute and read and write

217A000

heap

page read and write

533000

heap

page read and write

4B0000

heap

page read and write

2580000

heap

page read and write

217A000

heap

page read and write

566000

heap

page read and write

2165000

heap

page read and write

690000

heap

page read and write

555000

heap

page read and write

3B6B000

unclassified section

page execute and read and write

2161000

heap

page read and write

28A6000

heap

page read and write

10001000

direct allocation

page execute and read and write

2847000

heap

page read and write

28A6000

heap

page read and write

2169000

heap

page read and write

52E000

heap

page read and write

2861000

heap

page read and write

2841000

heap

page read and write

2169000

heap

page read and write

287A000

heap

page read and write

284A000

heap

page read and write

2100000

heap

page read and write

4A4000

heap

page read and write

996000

heap

page read and write

4A4000

heap

page read and write

9C000

stack

page read and write

4A4000

heap

page read and write

2178000

heap

page read and write

28A6000

heap

page read and write

52D000

heap

page read and write

400000

system

page execute and read and write

540000

heap

page read and write

559000

heap

page read and write

550000

heap

page read and write

54C000

heap

page read and write

2DBA000

heap

page read and write

999000

heap

page read and write

555000

heap

page read and write

28A6000

heap

page read and write

3631000

heap

page read and write

284A000

heap

page read and write

549000

heap

page read and write

588000

heap

page read and write

993000

heap

page read and write

99A000

heap

page read and write

2178000

heap

page read and write

28A6000

heap

page read and write

2171000

heap

page read and write

2178000

heap

page read and write

2176000

heap

page read and write

2849000

heap

page read and write

401000

unkown

page execute read

284A000

heap

page read and write

28A6000

heap

page read and write

59B000

heap

page read and write

2178000

heap

page read and write

28A6000

heap

page read and write

56D000

heap

page read and write

3630000

heap

page read and write

21B8000

heap

page read and write

2740000

heap

page read and write

2859000

heap

page read and write

4A4000

heap

page read and write

893000

heap

page read and write

2741000

heap

page read and write

352B000

heap

page read and write

99A000

heap

page read and write

595000

heap

page read and write

7FE000

stack

page read and write

220F000

stack

page read and write

2859000

heap

page read and write

6BE000

stack

page read and write

52D000

heap

page read and write

2178000

heap

page read and write

28A6000

heap

page read and write

216D000

heap

page read and write

19A000

stack

page read and write

960000

heap

page read and write

2178000

heap

page read and write

59B000

heap

page read and write

53B000

heap

page read and write

2866000

heap

page read and write

2D21000

heap

page read and write

2DC2000

heap

page read and write

18F000

stack

page read and write

2161000

heap

page read and write

216E000

heap

page read and write

3AD0000

unclassified section

page execute and read and write

868000

heap

page read and write

554000

heap

page read and write

554000

heap

page read and write

17C000

stack

page read and write

2178000

heap

page read and write

2161000

heap

page read and write

4A4000

heap

page read and write

284E000

heap

page read and write

554000

heap

page read and write

400000

unkown

page readonly

C5F000

stack

page read and write

555000

heap

page read and write

566000

heap

page read and write

598000

heap

page read and write

2861000

heap

page read and write

4A4000

heap

page read and write

595000

heap

page read and write

940000

trusted library allocation

page read and write

4FE000

heap

page read and write

580000

heap

page read and write

4A4000

heap

page read and write

266A000

heap

page read and write

2160000

heap

page read and write

529000

heap

page read and write

There are 482 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe