Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.6013931659711655
Filename:	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Filesize:	494592
MD5:	c6a88078a75cf820171ddec254f357f1
SHA1:	f02b7858ad352b812f4299b28992499c124d4337
SHA256:	b36228caaab561c68ae6fedd187804142090698761163947174d9d7513877567
SHA512:	c26292ca04c479ec9d9b4b92b8d89edbcd21a271e0c7577f8189f9f9b45581d82bc2a8d1d8d0912f06ffa5ebd8ae04afbc0585150c634dda88a0583b76726069
SSDEEP:	6144:QTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrzT4:QTlrYw1RUh3NFn+N5WfIQIjbs/ZXAT4
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.-H..~H..~H..~..'~[..~..%~...~..$~V..~AbR~I..~...~J..~.D..R..~.D..r..~.D..j..~AbE~Q..~H..~v..~.D..,..~.D)~I..~.D..I..~RichH..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Clipboard Data
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Security Software Discovery
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Ingress Tool Transfer
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Security Software Discovery
Machine Learning detection for sample	AV Detection	Security Software Discovery
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	Data from Local System
Tries to steal Instant Messenger accounts or passwords	Stealing of Sensitive Information	Security Software Discovery
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to steal Mail credentials (via file registry)	Stealing of Sensitive Information	Credentials in Registry
Abnormal high CPU Usage	System Summary	Access Token Manipulation System Time Discovery
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Security Software Discovery
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)	Malware Analysis System Evasion, Anti Debugging	Security Software Discovery
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Ingress Tool Transfer
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Security Software Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Security Software Discovery
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Security Software Discovery
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading Security Software Discovery
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation Archive Collected Data Encrypted Channel
Enables debug privileges	Anti Debugging
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found decision node followed by non-executed suspicious APIs	Malware Analysis System Evasion	Access Token Manipulation
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading Security Software Discovery
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation System Time Discovery
Contains functionality to modify the execution of threads in other processes		Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading Security Software Discovery
Creates mutexes	System Summary	Access Token Manipulation Security Software Discovery
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Found strings which match to known social media urls	Networking
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
Might use command line arguments	System Summary	Masquerading Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion	Security Software Discovery
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery
Queries a list of all open handles	System Summary	Process Discovery
Queries a list of all running processes	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads ini files	System Summary
Reads software policies	System Summary	Access Token Manipulation Security Software Discovery
SQL strings found in memory and binary data	System Summary	File and Directory Discovery
Sample is known by Antivirus	System Summary	Access Token Manipulation Security Software Discovery
Sample requires command line parameters (based on API chain)	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Checks if Microsoft Office is installed	System Summary	Access Token Manipulation System Information Discovery
Tries to open an application configuration file (.cfg)	System Summary	Access Token Manipulation

C:\ProgramData\remcos\logs.dat

data

dropped

Details

File:	C:\ProgramData\remcos\logs.dat
Category:	dropped
Dump:	logs.dat.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Type:	data
Entropy:	3.3829237234308707
Encrypted:	false
Ssdeep:	3:rhlKlM+VlSlpNDkwlDl5JWRal2Jl+7R0DAlBG45klovDl6v:6lJSlpNDLb5YcIeeDAlOWAv
Size:	144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json
Category:	dropped
Dump:	json[1].json.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Type:	JSON data
Entropy:	5.013811273052389
Encrypted:	false
Ssdeep:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Temp\bhv8305.tmp

Extensible storage engine DataBase, version 0x620, checksum 0x98bd6f1b, page size 32768, DirtyShutdown, Windows version 10.0

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\bhv8305.tmp
Category:	dropped
Dump:	bhv8305.tmp.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Type:	Extensible storage engine DataBase, version 0x620, checksum 0x98bd6f1b, page size 32768, DirtyShutdown, Windows version 10.0
Entropy:	1.283023164350904
Encrypted:	false
Ssdeep:	12288:ZRSPOhijljKhBfvKDv2G+555ckQB8WBbjWE:mii9PDp+
Size:	20447232
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\glwdcdfurqkkskz

Unicode text, UTF-16, little-endian text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\glwdcdfurqkkskz
Category:	dropped
Dump:	glwdcdfurqkkskz.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Entropy:	1.0
Encrypted:	false
Ssdeep:	3:Qn:Qn
Size:	2
Whitelisted:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

"C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4280
Target ID:	0
Parent PID:	2580
Name:	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Path:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Commandline:	"C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe"
Size:	494592
MD5:	C6A88078A75CF820171DDEC254F357F1
Time:	16:17:23
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\glwdcdfurqkkskz"

Details

Is windows:	false
Is dropped:	false
PID:	4812
Target ID:	1
Parent PID:	4280
Name:	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Path:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Commandline:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\glwdcdfurqkkskz"
Size:	494592
MD5:	C6A88078A75CF820171DDEC254F357F1
Time:	16:17:28
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	491520
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\injodopvfycxvqnxqc"

Details

Is windows:	false
Is dropped:	false
PID:	5316
Target ID:	2
Parent PID:	4280
Name:	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Path:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Commandline:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\injodopvfycxvqnxqc"
Size:	494592
MD5:	C6A88078A75CF820171DDEC254F357F1
Time:	16:17:28
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	401408
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\siogdgapbgucfwkbamoda"

Details

Is windows:	false
Is dropped:	false
PID:	2316
Target ID:	3
Parent PID:	4280
Name:	17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Path:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Commandline:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\siogdgapbgucfwkbamoda"
Size:	494592
MD5:	C6A88078A75CF820171DDEC254F357F1
Time:	16:17:28
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	147456
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected WebBrowserPassView password recovery tool	Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

URLs

Name

Malicious

dumboi.duckdns.org

http://www.imvu.comr

unknown

https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W

unknown

http://www.imvu.comta

unknown

https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad

unknown

https://aefd.nelreports.net/api/report?cat=bingth

unknown

https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc

unknown

http://www.nirsoft.net

unknown

https://aefd.nelreports.net/api/report?cat=bingaotak

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr

unknown

http://geoplugin.net/json.gp5

unknown

https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742

unknown

https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51

unknown

https://www.google.com

unknown

https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c

unknown

http://geoplugin.net/json.gp/C

unknown

https://maps.windows.com/windows-app-web-link

unknown

https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat

unknown

https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8

unknown

https://login.yahoo.com/config/login

unknown

http://www.nirsoft.net/

unknown

https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d

unknown

https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg

unknown

https://www.office.com/

unknown

https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8

unknown

https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68

unknown

https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2

unknown

https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d

unknown

https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437

unknown

http://www.imvu.com

unknown

https://aefd.nelreports.net/api/report?cat=wsb

unknown

https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326

unknown

https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03

unknown

http://geoplugin.net/json.gp

178.237.33.50

https://aefd.nelreports.net/api/report?cat=bingaot

unknown

https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae

unknown

https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7

unknown

https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD

unknown

https://aefd.nelreports.net/api/report?cat=bingrms

unknown

https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993

unknown

https://www.google.com/accounts/servicelogin

unknown

https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5

unknown

https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3

unknown

https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135

unknown

https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59

unknown

http://www.ebuddy.com

unknown

There are 40 hidden URLs, click here to show them.

Domains

Name

Malicious

dumboi.duckdns.org

185.236.203.101

Details

Name:	dumboi.duckdns.org
IP:	185.236.203.101
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

185.236.203.101

dumboi.duckdns.org

Romania

Details

IP:	185.236.203.101
TargetID:	0
Current Path:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Country:	Romania
Countrycode:	ROU
ASN number:	9009
ASN name:	M247GB
Private:	false
Domain:	dumboi.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	0
Current Path:	C:\Users\user\Desktop\17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-8AXK3L

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-8AXK3L

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-8AXK3L

time

Memdumps

Base Address

Regiontype

Protect

Malicious

459000

unkown

page readonly

459000

unkown

page readonly

229F000

stack

page read and write

459000

unkown

page readonly

501000

heap

page read and write

4BE000

heap

page read and write

459000

unkown

page readonly

501000

heap

page read and write

459000

unkown

page readonly

501000

heap

page read and write

2799000

heap

page read and write

20EF000

heap

page read and write

20E9000

heap

page read and write

2260000

heap

page read and write

19C000

stack

page read and write

20E2000

heap

page read and write

23DC000

stack

page read and write

63E000

heap

page read and write

2101000

heap

page read and write

478000

unkown

page readonly

4FA000

heap

page read and write

3849000

heap

page read and write

279A000

heap

page read and write

614000

heap

page read and write

2190000

heap

page read and write

614000

heap

page read and write

20F1000

heap

page read and write

644000

heap

page read and write

20E8000

heap

page read and write

627000

heap

page read and write

2799000

heap

page read and write

2795000

heap

page read and write

2B92000

heap

page read and write

474000

unkown

page read and write

614000

heap

page read and write

2798000

heap

page read and write

400000

unkown

page readonly

20F1000

heap

page read and write

53E000

stack

page read and write

540000

heap

page read and write

4F2000

heap

page read and write

5EE000

stack

page read and write

644000

heap

page read and write

20EA000

heap

page read and write

53E000

heap

page read and write

5F0000

heap

page read and write

211E000

stack

page read and write

20F6000

heap

page read and write

215F000

heap

page read and write

20E8000

heap

page read and write

478000

unkown

page readonly

20F4000

heap

page read and write

645000

heap

page read and write

533000

heap

page read and write

39DC000

unclassified section

page execute and read and write

63D000

heap

page read and write

523000

heap

page read and write

20F1000

heap

page read and write

401000

unkown

page execute read

644000

heap

page read and write

3753000

heap

page read and write

640000

heap

page read and write

53E000

heap

page read and write

471000

unkown

page write copy

644000

heap

page read and write

620000

heap

page read and write

27BE000

heap

page read and write

210A000

heap

page read and write

8FF000

stack

page read and write

9C000

stack

page read and write

2B18000

heap

page read and write

10016000

direct allocation

page execute and read and write

61E000

stack

page read and write

2791000

heap

page read and write

20DC000

heap

page read and write

20E1000

heap

page read and write

3959000

unclassified section

page execute and read and write

20EF000

heap

page read and write

401000

unkown

page execute read

478000

unkown

page readonly

645000

heap

page read and write

279A000

heap

page read and write

614000

heap

page read and write

2591000

heap

page read and write

1F0000

heap

page read and write

3849000

heap

page read and write

193000

stack

page read and write

265E000

stack

page read and write

20F8000

heap

page read and write

2691000

heap

page read and write

2B92000

heap

page read and write

8FF000

stack

page read and write

2990000

trusted library allocation

page read and write

3A0B000

unclassified section

page execute and read and write

20E6000

heap

page read and write

614000

heap

page read and write

459000

system

page execute and read and write

644000

heap

page read and write

279A000

heap

page read and write

614000

heap

page read and write

20E1000

heap

page read and write

3859000

heap

page read and write

20EA000

heap

page read and write

4B0000

heap

page read and write

400000

unkown

page readonly

45C000

system

page execute and read and write

400000

unkown

page readonly

27AD000

heap

page read and write

20D0000

heap

page read and write

2AA0000

heap

page read and write

4BE000

stack

page read and write

3661000

heap

page read and write

614000

heap

page read and write

2791000

heap

page read and write

3752000

heap

page read and write

2799000

heap

page read and write

644000

heap

page read and write

20E7000

heap

page read and write

17C000

stack

page read and write

3849000

heap

page read and write

9A3000

heap

page read and write

401000

unkown

page execute read

644000

heap

page read and write

20F5000

heap

page read and write

644000

heap

page read and write

20F1000

heap

page read and write

20E6000

heap

page read and write

20E8000

heap

page read and write

4BA000

heap

page read and write

20F1000

heap

page read and write

53E000

heap

page read and write

2B18000

heap

page read and write

401000

unkown

page execute read

3660000

heap

page read and write

81F000

stack

page read and write

27A3000

heap

page read and write

2990000

trusted library allocation

page read and write

644000

heap

page read and write

41B000

system

page execute and read and write

3847000

heap

page read and write

644000

heap

page read and write

18F000

stack

page read and write

37CB000

heap

page read and write

10001000

direct allocation

page execute and read and write

63E000

heap

page read and write

9AD000

heap

page read and write

AEC000

heap

page read and write

614000

heap

page read and write

645000

heap

page read and write

1F0000

heap

page read and write

644000

heap

page read and write

20F6000

heap

page read and write

2B1A000

heap

page read and write

2795000

heap

page read and write

AEC000

heap

page read and write

19C000

stack

page read and write

395D000

unclassified section

page execute and read and write

2690000

heap

page read and write

20F2000

heap

page read and write

279A000

heap

page read and write

279A000

heap

page read and write

20F6000

heap

page read and write

45D000

system

page execute and read and write

20F0000

heap

page read and write

269F000

heap

page read and write

2AA1000

heap

page read and write

610000

heap

page read and write

9C000

stack

page read and write

614000

heap

page read and write

20E6000

heap

page read and write

279C000

heap

page read and write

2591000

heap

page read and write

20F2000

heap

page read and write

20E1000

heap

page read and write

27AB000

heap

page read and write

4E8000

heap

page read and write

3847000

heap

page read and write

630000

heap

page read and write

3868000

heap

page read and write

521000

heap

page read and write

385D000

heap

page read and write

3753000

heap

page read and write

312E000

stack

page read and write

645000

heap

page read and write

279A000

heap

page read and write

19A000

stack

page read and write

7A8000

heap

page read and write

644000

heap

page read and write

700000

heap

page read and write

71F000

stack

page read and write

2691000

heap

page read and write

20E6000

heap

page read and write

20E8000

heap

page read and write

20F5000

heap

page read and write

53E000

heap

page read and write

614000

heap

page read and write

471000

unkown

page write copy

AE0000

heap

page read and write

2691000

heap

page read and write

20C0000

heap

page read and write

614000

heap

page read and write

523000

heap

page read and write

20F8000

heap

page read and write

2795000

heap

page read and write

2797000

heap

page read and write

508000

heap

page read and write

614000

heap

page read and write

4AE000

stack

page read and write

478000

unkown

page readonly

10000000

direct allocation

page read and write

37FB000

heap

page read and write

9A0000

heap

page read and write

21C0000

heap

page read and write

36DA000

heap

page read and write

20F5000

heap

page read and write

523000

heap

page read and write

4FE000

stack

page read and write

AE3000

heap

page read and write

91F000

stack

page read and write

279A000

heap

page read and write

20EA000

heap

page read and write

279D000

heap

page read and write

501000

heap

page read and write

401000

unkown

page execute read

AB0000

heap

page read and write

5CE000

stack

page read and write

456000

system

page execute and read and write

3847000

heap

page read and write

20E0000

heap

page read and write

39D6000

unclassified section

page execute and read and write

9C000

stack

page read and write

614000

heap

page read and write

3849000

heap

page read and write

20EC000

heap

page read and write

3980000

unclassified section

page execute and read and write

279D000

heap

page read and write

20F8000

heap

page read and write

3849000

heap

page read and write

37FC000

heap

page read and write

1F0000

heap

page read and write

535000

heap

page read and write

547000

heap

page read and write

21C0000

trusted library allocation

page read and write

950000

heap

page read and write

37CB000

heap

page read and write

645000

heap

page read and write

645000

heap

page read and write

2B18000

heap

page read and write

500000

heap

page read and write

20E1000

heap

page read and write

21D0000

trusted library allocation

page read and write

2795000

heap

page read and write

27AB000

heap

page read and write

490000

heap

page read and write

614000

heap

page read and write

473000

system

page execute and read and write

620000

heap

page read and write

2796000

heap

page read and write

279D000

heap

page read and write

1F0000

heap

page read and write

279A000

heap

page read and write

3973000

unclassified section

page execute and read and write

7A0000

heap

page read and write

3859000

heap

page read and write

523000

heap

page read and write

20EA000

heap

page read and write

27A3000

heap

page read and write

210E000

heap

page read and write

279D000

heap

page read and write

471000

unkown

page write copy

478000

unkown

page readonly

523000

heap

page read and write

2123000

heap

page read and write

614000

heap

page read and write

533000

heap

page read and write

177000

stack

page read and write

644000

heap

page read and write

261F000

stack

page read and write

4F2000

heap

page read and write

400000

system

page execute and read and write

2990000

trusted library allocation

page read and write

400000

unkown

page readonly

215C000

stack

page read and write

547000

heap

page read and write

471000

unkown

page read and write

4F2000

heap

page read and write

9AD000

heap

page read and write

644000

heap

page read and write

27DC000

heap

page read and write

4B0000

heap

page read and write

20E1000

heap

page read and write

644000

heap

page read and write

53E000

heap

page read and write

20F8000

heap

page read and write

3847000

heap

page read and write

27ED000

heap

page read and write

239F000

stack

page read and write

25BA000

heap

page read and write

2AA1000

heap

page read and write

20E4000

heap

page read and write

20EF000

heap

page read and write

2990000

trusted library allocation

page read and write

20E8000

heap

page read and write

3661000

heap

page read and write

2990000

trusted library allocation

page read and write

3847000

heap

page read and write

7FF000

stack

page read and write

20E8000

heap

page read and write

2158000

heap

page read and write

383B000

heap

page read and write

4E0000

heap

page read and write

278F000

stack

page read and write

20F5000

heap

page read and write

2794000

heap

page read and write

2590000

heap

page read and write

9C000

stack

page read and write

400000

unkown

page readonly

3847000

heap

page read and write

20E8000

heap

page read and write

471000

unkown

page write copy

20E6000

heap

page read and write

380B000

heap

page read and write

400000

system

page execute and read and write

20F5000

heap

page read and write

20F1000

heap

page read and write

3900000

unclassified section

page execute and read and write

251E000

stack

page read and write

614000

heap

page read and write

20EA000

heap

page read and write

4F2000

heap

page read and write

645000

heap

page read and write

39F0000

unclassified section

page execute and read and write

547000

heap

page read and write

20DC000

heap

page read and write

27DC000

heap

page read and write

20DC000

heap

page read and write

20F4000

heap

page read and write

24DF000

stack

page read and write

275F000

stack

page read and write

644000

heap

page read and write

4C0000

heap

page read and write

636000

heap

page read and write

614000

heap

page read and write

2990000

trusted library allocation

page read and write

2790000

heap

page read and write

2795000

heap

page read and write

322F000

stack

page read and write

645000

heap

page read and write

20EC000

heap

page read and write

3849000

heap

page read and write

523000

heap

page read and write

400000

system

page execute and read and write

27CE000

heap

page read and write

20DC000

heap

page read and write

There are 344 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
17282393454a20ebb72846132bb7146ed4a1a58abc0a2fcca78c88bb5a73356856494e7ece637.dat-decoded.exe