Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

tu.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.357495907894201
Filename:	tu.exe
Filesize:	1340704
MD5:	de717951989420c6b9790c9160a23d35
SHA1:	df8621b3d9fa7e4e1d511d6ff732457aac6a0a1d
SHA256:	d434e12726aee7ad7378dc4e395dd5f8fba6255546eef9e1dbb51d52d966af2c
SHA512:	77bdb1c94823c3340082ad5b3ba064cbbd4116758866795053d1b7b0da2f6ba07ad6a94ed8d721aed339a69f5499f0f87406a8dccc64e30aeeb5ef5976c22096
SSDEEP:	24576:ZQHDm64xrB90l7rjM19qIljCh/qIxjySlfa/JY78NLRAgTE//aZ66z24VZbH:J90NM1gqjEBa/S8NLRdTE/iZ66z24VZb
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K8d..Y...Y...Y.......Y...!...Y...!...Y...!...Y..(.g..Y..(.q..Y...Y...Y...!..]Y.......Y...!...Y..Rich.Y..........PE..L....i3Z...

Signature Hits	Behavior Group	Mitre Attack
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Contains functionality to infect the boot sector	Persistence and Installation Behavior, Boot Survival	Bootkit Access Token Manipulation
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation
Drops PE files to the document folder of the user	Persistence and Installation Behavior
Drops large PE files	System Summary	Access Token Manipulation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Abnormal high CPU Usage	System Summary	Access Token Manipulation
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to communicate with device drivers	System Summary
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery Ingress Tool Transfer
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation Security Software Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion	Security Software Discovery
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion	Security Software Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
PE / OLE file has an invalid certificate	System Summary	File and Directory Discovery
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation Security Software Discovery System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information Security Software Discovery
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Software Packing
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder Access Token Manipulation File and Directory Discovery
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Security Software Discovery Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery Security Software Discovery System Owner/User Discovery Archive Collected Data
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation Security Software Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary	Security Software Discovery
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\ProgramData\remcos\logs.dat

data

dropped

Details

File:	C:\ProgramData\remcos\logs.dat
Category:	dropped
Dump:	logs.dat.5.dr
ID:	dr_2
Target ID:	5
Process:	C:\Users\user\Desktop\tu.exe
Type:	data
Entropy:	3.316572720533958
Encrypted:	false
Ssdeep:	6:6l+VGljF65YcIeeDAlOWAAe5q1gWAAe5q1gWAv:6l9RFKec0WFe5BWFe5BW+
Size:	288
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information

C:\Users\user\Documents\ChromeUpdate\SentinelOne.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\Documents\ChromeUpdate\SentinelOne.exe
Category:	dropped
Dump:	SentinelOne.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\tu.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.028493769083129367
Encrypted:	false
Size:	800000000
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files to the document folder of the user	Persistence and Installation Behavior
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json
Category:	dropped
Dump:	json[1].json.5.dr
ID:	dr_1
Target ID:	5
Process:	C:\Users\user\Desktop\tu.exe
Type:	JSON data
Entropy:	4.995620093649274
Encrypted:	false
Ssdeep:	12:tklzTknd6CsGkMyGWKyGXPVGArwY3+8aIHrGIArpv/mOAaNO+ao9W7iN5zzkw7Rr:qlkdRNuKyGX855vXhNlT3/77Kdxtro
Size:	963
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\tu.exe

"C:\Users\user\Desktop\tu.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5412
Target ID:	0
Parent PID:	4004
Name:	tu.exe
Path:	C:\Users\user\Desktop\tu.exe
Commandline:	"C:\Users\user\Desktop\tu.exe"
Size:	1340704
MD5:	DE717951989420C6B9790C9160A23D35
Time:	18:15:50
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	1351680
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE / OLE file has an invalid certificate	System Summary
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section and no other executable section	System Summary
Public key (encryption) found	Cryptography	Archive Collected Data
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\tu.exe

"C:\Users\user\Desktop\tu.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4256
Target ID:	5
Parent PID:	5412
Name:	tu.exe
Path:	C:\Users\user\Desktop\tu.exe
Commandline:	"C:\Users\user\Desktop\tu.exe"
Size:	1340704
MD5:	DE717951989420C6B9790C9160A23D35
Time:	18:16:11
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	1351680
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE / OLE file has an invalid certificate	System Summary
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section and no other executable section	System Summary
Public key (encryption) found	Cryptography	Archive Collected Data
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

URLs

Name

Malicious

http://geoplugin.net/json.gp

178.237.33.50

http://geoplugin.net/json.gp/C

unknown

abril18.con-ip.com

http://down.360safe.com/setup.exeIsBetaVersion360ver.dllSOFTWARE

unknown

http://crl.godaddy.com/gdroot-g2.crl0F

unknown

http://geoplugin.net/json.gpalF

unknown

http://crl.godaddy.com/gdig2s5-6.crl0

unknown

http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe

unknown

http://geoplugin.net/

unknown

http://geoplugin.net/json.gpl

unknown

http://geoplugin.net/json.gpK

unknown

http://certificates.godaddy.com/repository/0

unknown

http://geoplugin.net/json.gpJ

unknown

http://certs.godaddy.com/repository/1301

unknown

http://geoplugin.net/json.gpT

unknown

http://geoplugin.net/json.gpQ

unknown

http://down.360safe.com/360zip_setup.exe360SysReset

unknown

https://certs.godaddy.com/repository/0

unknown

http://.inihttps://map/set

unknown

http://certificates.godaddy.com/repository/gdig2.crt0

unknown

http://geoplugin.net/json.gpSystem32

unknown

http://geoplugin.net/;

unknown

There are 12 hidden URLs, click here to show them.

Domains

Name

Malicious

abril18.con-ip.com

179.14.10.110

Details

Name:	abril18.con-ip.com
IP:	179.14.10.110
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

179.14.10.110

abril18.con-ip.com

Colombia

Details

IP:	179.14.10.110
TargetID:	5
Current Path:	C:\Users\user\Desktop\tu.exe
Country:	Colombia
Countrycode:	COL
ASN number:	27831
ASN name:	ColombiaMovilCO
Private:	false
Domain:	abril18.con-ip.com

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SentinelOneIsCrap

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	SentinelOneIsCrap
Value data:	C:\Users\user\Documents\ChromeUpdate\SentinelOne.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\Rmc-PO8SC5

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-PO8SC5

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-PO8SC5

time

Memdumps

Base Address

Regiontype

Protect

Malicious

937000

heap

page read and write

8F8000

heap

page read and write

550000

remote allocation

page execute and read and write

24CF000

stack

page read and write

23C0000

direct allocation

page execute and read and write

46D000

unkown

page execute and read and write

27BE000

stack

page read and write

4E7000

unkown

page readonly

339F000

stack

page read and write

400000

unkown

page readonly

96C000

heap

page read and write

267C000

stack

page read and write

97A000

heap

page read and write

400000

unkown

page readonly

46D000

unkown

page readonly

401000

unkown

page execute read

29FF000

stack

page read and write

5D0000

heap

page read and write

8F0000

heap

page read and write

99F000

stack

page read and write

77E000

stack

page read and write

97A000

heap

page read and write

5C4000

remote allocation

page execute and read and write

7AA000

heap

page read and write

46D000

unkown

page readonly

7DE000

heap

page read and write

9B000

stack

page read and write

8D0000

heap

page read and write

45C000

unkown

page readonly

BEF000

stack

page read and write

B9F000

stack

page read and write

401000

unkown

page execute read

28BF000

stack

page read and write

263F000

stack

page read and write

5AE000

stack

page read and write

2572000

direct allocation

page read and write

277F000

stack

page read and write

5C8000

remote allocation

page execute and read and write

780000

heap

page read and write

7CE000

heap

page read and write

A9F000

stack

page read and write

46D000

unkown

page readonly

5D5000

heap

page read and write

61C000

stack

page read and write

953000

heap

page read and write

928000

heap

page read and write

467000

unkown

page read and write

71C000

stack

page read and write

45C000

unkown

page readonly

9F0000

heap

page read and write

468000

unkown

page write copy

7AE000

heap

page read and write

7CD000

heap

page read and write

250C000

stack

page read and write

400000

unkown

page readonly

401000

unkown

page execute read

7D3000

heap

page read and write

7D2000

heap

page read and write

7B5000

heap

page read and write

972000

heap

page read and write

196000

stack

page read and write

7CE000

heap

page read and write

972000

heap

page read and write

953000

heap

page read and write

400000

unkown

page readonly

467000

unkown

page write copy

2589000

direct allocation

page read and write

45C000

unkown

page readonly

467000

unkown

page write copy

550000

heap

page read and write

2490000

direct allocation

page read and write

7DF000

heap

page read and write

2438000

direct allocation

page execute and read and write

2480000

heap

page read and write

401000

unkown

page execute read

45C000

unkown

page readonly

7D2000

heap

page read and write

740000

heap

page read and write

28FE000

stack

page read and write

96A000

heap

page read and write

730000

heap

page read and write

467000

unkown

page write copy

972000

heap

page read and write

7B0000

heap

page read and write

7A0000

heap

page read and write

97A000

heap

page read and write

937000

heap

page read and write

2530000

heap

page read and write

A00000

heap

page read and write

6EE000

stack

page read and write

72E000

stack

page read and write

23B0000

heap

page read and write

23CE000

stack

page read and write

7D2000

heap

page read and write

560000

heap

page read and write

329E000

stack

page read and write

There are 86 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
tu.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporttu.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
tu.exe