Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

P87unxnF4t4DSrTt43.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.7628064558005425
Filename:	P87unxnF4t4DSrTt43.exe
Filesize:	1056768
MD5:	51bb5f38593e255c16ab2712757cda43
SHA1:	458fbe81fed707852864c3bcc4997b27d6a65832
SHA256:	1c80bf8e780ae58203e7f816c8fe04f66df434a3fbd981ba7c6e52e588622c03
SHA512:	80d2f4464d5f036000318ef6ba43b23c8e5576c67989b0097adbf13545b790df1340937d1f7f67d0d8630b2f80c8b85e3286032554868424d2bb5612fda6dcf9
SSDEEP:	12288:O8iWXV7O7jJlohi9cptOybLZG6OHGw2/EvK6hxshTAaZpAWLq8uFTF+cMSIsYSv/:FO7jX+pRblGp1vKMuhtTk0sYyKvwTm
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*;...............0..............4... ...@....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools Input Capture
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Machine Learning detection for sample	AV Detection
Abnormal high CPU Usage	System Summary	Access Token Manipulation
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery Ingress Tool Transfer
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Process Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API System Information Discovery
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary
Uses Microsoft Silverlight	System Summary	Access Token Manipulation

C:\ProgramData\edefdefffff\logs.dat

data

dropped

Details

File:	C:\ProgramData\edefdefffff\logs.dat
Category:	dropped
Dump:	logs.dat.6.dr
ID:	dr_7
Target ID:	6
Process:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Type:	data
Entropy:	3.3683413243328855
Encrypted:	false
Ssdeep:	3:rglsIlfVl1liqlDl5JWRal2Jl+7R0DAlBG45klovDl6v:Mls4tliql55YcIeeDAlOWAv
Size:	144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P87unxnF4t4DSrTt43.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P87unxnF4t4DSrTt43.exe.log
Category:	dropped
Dump:	P87unxnF4t4DSrTt43.exe.log.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json
Category:	dropped
Dump:	json[1].json.6.dr
ID:	dr_6
Target ID:	6
Process:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Type:	JSON data
Entropy:	5.018421233492188
Encrypted:	false
Ssdeep:	12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkv:qlupdVauKyGX85jvXhNlT3/7XcV7Wro
Size:	963
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Category:	dropped
Dump:	StartupProfileData-NonInteractive.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	data
Entropy:	5.3810236212315665
Encrypted:	false
Ssdeep:	48:lylWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMugeC/ZPUyus:lGLHxv2IfLZ2KRH6Oug8s
Size:	2232
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpvoot1b.eeu.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpvoot1b.eeu.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_fpvoot1b.eeu.psm1.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k0vj2alo.4fb.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k0vj2alo.4fb.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_k0vj2alo.4fb.ps1.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l00yxfxh.rkr.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l00yxfxh.rkr.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_l00yxfxh.rkr.psm1.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wuc2hjpp.f05.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wuc2hjpp.f05.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_wuc2hjpp.f05.ps1.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe

"C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7644
Target ID:	1
Parent PID:	4056
Name:	P87unxnF4t4DSrTt43.exe
Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Commandline:	"C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Size:	1056768
MD5:	51BB5F38593E255C16AB2712757CDA43
Time:	03:09:09
Date:	16/01/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe10000
Modulesize:	1081344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7832
Target ID:	4
Parent PID:	7644
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Size:	433152
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Time:	03:09:10
Date:	16/01/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x300000
Modulesize:	446464
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Powershell Defender Exclusion	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe

"C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7848
Target ID:	6
Parent PID:	7644
Name:	P87unxnF4t4DSrTt43.exe
Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Commandline:	"C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Size:	1056768
MD5:	51BB5F38593E255C16AB2712757CDA43
Time:	03:09:10
Date:	16/01/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xc80000
Modulesize:	1081344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7840
Target ID:	5
Parent PID:	7832
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:09:10
Date:	16/01/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff75da10000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\wbem\WmiPrvSE.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	8140
Target ID:	8
Parent PID:	748
Name:	WmiPrvSE.exe
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Size:	496640
MD5:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Time:	03:09:12
Date:	16/01/2025
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	true
Modulebase:	0x7ff7fb730000
Modulesize:	516096
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

www.kposlifestyle.design

Details

Name:	www.kposlifestyle.design
TargetID:	0
From Memory:	false
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	6
From Memory:	false
Current Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Suricata IDS alerts with low severity for network traffic	Networking
URLs found in memory or binary data	Networking

http://geoplugin.net/

unknown

Details

Name:	http://geoplugin.net/
TargetID:	6
From Memory:	true
Current Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Source:	P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780695534.0000000001434000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	1
From Memory:	true
Current Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Source:	P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, P87unxnF4t4DSrTt43.exe, 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	1
From Memory:	true
Current Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Source:	P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341026272.00000000032F8000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

www.kposlifestyle.design

154.216.16.38

Details

Name:	www.kposlifestyle.design
IP:	154.216.16.38
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

171.39.242.20.in-addr.arpa

unknown

IPs

Domain

Country

Malicious

154.216.16.38

www.kposlifestyle.design

Seychelles

Details

IP:	154.216.16.38
TargetID:	6
Current Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Country:	Seychelles
Countrycode:	SYC
ASN number:	135357
ASN name:	SKHT-ASShenzhenKatherineHengTechnologyInformationCo
Private:	false
Domain:	www.kposlifestyle.design

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	6
Current Path:	C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-OH1QS4

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-OH1QS4

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-OH1QS4

time

HKEY_CURRENT_USER\SOFTWARE\Rmc-OH1QS4

UID

Memdumps

Base Address

Regiontype

Protect

Malicious

4B23000

trusted library allocation

page read and write

42B9000

trusted library allocation

page read and write

13C7000

heap

page read and write

400000

remote allocation

page execute and read and write

EDAF000

stack

page read and write

1600000

trusted library allocation

page read and write

1840000

trusted library allocation

page execute and read and write

113B000

stack

page read and write

5700000

trusted library allocation

page read and write

E8EE000

stack

page read and write

143B000

heap

page read and write

3F30000

heap

page read and write

1350000

heap

page read and write

32F8000

trusted library allocation

page read and write

73C86000

unkown

page readonly

1602000

trusted library allocation

page read and write

57A0000

trusted library allocation

page read and write

31DF000

stack

page read and write

14CD000

trusted library allocation

page execute and read and write

2F5F000

stack

page read and write

5790000

trusted library allocation

page read and write

1638000

heap

page read and write

16C3000

heap

page read and write

1830000

trusted library allocation

page read and write

8C70000

heap

page read and write

3060000

trusted library allocation

page execute and read and write

6300000

heap

page read and write

12A0000

heap

page read and write

161E000

heap

page read and write

73FE000

heap

page read and write

5760000

heap

page read and write

1654000

heap

page read and write

3ADB000

heap

page read and write

327E000

trusted library allocation

page read and write

EC6E000

stack

page read and write

143E000

stack

page read and write

73C70000

unkown

page readonly

14C4000

trusted library allocation

page read and write

3550000

heap

page read and write

30DE000

stack

page read and write

1606000

trusted library allocation

page execute and read and write

5720000

trusted library allocation

page read and write

3100000

trusted library allocation

page read and write

1610000

heap

page read and write

3EDE000

stack

page read and write

5A10000

trusted library allocation

page read and write

763F000

stack

page read and write

3087000

trusted library allocation

page read and write

3260000

trusted library allocation

page read and write

12D0000

heap

page read and write

AEC5000

trusted library allocation

page read and write

8E8F000

stack

page read and write

73C8F000

unkown

page readonly

5810000

heap

page read and write

42B1000

trusted library allocation

page read and write

5770000

trusted library allocation

page execute and read and write

1810000

trusted library allocation

page read and write

8CDA000

heap

page read and write

345F000

stack

page read and write

168A000

heap

page read and write

3CDE000

stack

page read and write

73C8D000

unkown

page read and write

14B0000

trusted library allocation

page read and write

180E000

stack

page read and write

57D0000

trusted library allocation

page execute and read and write

B4C0000

trusted library section

page read and write

30CE000

stack

page read and write

326B000

trusted library allocation

page read and write

3AC0000

heap

page read and write

ECAE000

stack

page read and write

15FD000

trusted library allocation

page execute and read and write

5A20000

heap

page execute and read and write

57C0000

trusted library allocation

page read and write

3F40000

heap

page read and write

1646000

heap

page read and write

E12000

unkown

page readonly

1812000

trusted library allocation

page read and write

59FB000

stack

page read and write

34CB000

stack

page read and write

1870000

heap

page read and write

354B000

stack

page read and write

15F3000

trusted library allocation

page read and write

15DE000

stack

page read and write

FAA000

stack

page read and write

57AD000

trusted library allocation

page read and write

5A00000

trusted library allocation

page read and write

160A000

trusted library allocation

page execute and read and write

8CD5000

heap

page read and write

5792000

trusted library allocation

page read and write

14C3000

trusted library allocation

page execute and read and write

305E000

stack

page read and write

335E000

stack

page read and write

13C0000

heap

page read and write

474000

remote allocation

page execute and read and write

330C000

trusted library allocation

page read and write

73F0000

heap

page read and write

56F5000

trusted library allocation

page read and write

E9EE000

stack

page read and write

15BF000

stack

page read and write

3110000

heap

page read and write

73C71000

unkown

page execute read

E67E000

stack

page read and write

EB2E000

stack

page read and write

EB6E000

stack

page read and write

1434000

heap

page read and write

2E5F000

stack

page read and write

E77E000

stack

page read and write

1817000

trusted library allocation

page execute and read and write

39DD000

stack

page read and write

1310000

heap

page read and write

1860000

trusted library allocation

page read and write

15E0000

heap

page read and write

321E000

stack

page read and write

16F1000

heap

page read and write

309F000

stack

page read and write

5D20000

trusted library section

page read and write

331F000

stack

page read and write

57F0000

trusted library section

page readonly

8CB8000

heap

page read and write

62F0000

heap

page read and write

321E000

stack

page read and write

E10000

unkown

page readonly

5CED000

stack

page read and write

3AD0000

heap

page read and write

5780000

heap

page read and write

16BC000

heap

page read and write

579B000

trusted library allocation

page read and write

325C000

stack

page read and write

EEEC000

stack

page read and write

8D8E000

stack

page read and write

3070000

trusted library allocation

page read and write

2F9C000

stack

page read and write

5BE0000

heap

page read and write

1431000

heap

page read and write

53AC000

stack

page read and write

139B000

stack

page read and write

5783000

heap

page read and write

1424000

heap

page read and write

135A000

heap

page read and write

3281000

trusted library allocation

page read and write

1180000

heap

page read and write

5805000

heap

page read and write

12F7000

stack

page read and write

3080000

trusted library allocation

page read and write

1877000

heap

page read and write

3DDF000

stack

page read and write

32A0000

heap

page execute and read and write

8C9B000

heap

page read and write

350E000

stack

page read and write

1850000

trusted library allocation

page read and write

32B1000

trusted library allocation

page read and write

1404000

heap

page read and write

129C000

stack

page read and write

13F0000

heap

page read and write

328D000

trusted library allocation

page read and write

330A000

trusted library allocation

page read and write

3286000

trusted library allocation

page read and write

3BDF000

stack

page read and write

7FD80000

trusted library allocation

page execute and read and write

79CD000

stack

page read and write

147E000

stack

page read and write

5AC0000

trusted library allocation

page execute and read and write

1651000

heap

page read and write

74F0000

trusted library allocation

page read and write

103C000

stack

page read and write

477000

remote allocation

page execute and read and write

13F6000

heap

page read and write

EDEC000

stack

page read and write

8CC7000

heap

page read and write

1618000

heap

page read and write

14D0000

heap

page read and write

5800000

heap

page read and write

5820000

heap

page read and write

181B000

trusted library allocation

page execute and read and write

34C2000

trusted library allocation

page read and write

131E000

stack

page read and write

15F0000

trusted library allocation

page read and write

56F0000

trusted library allocation

page read and write

753E000

stack

page read and write

14C0000

trusted library allocation

page read and write

EA2E000

stack

page read and write

There are 171 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
P87unxnF4t4DSrTt43.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportP87unxnF4t4DSrTt43.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
P87unxnF4t4DSrTt43.exe