Edit tour

Windows Analysis Report
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Overview

General Information

Sample name:	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe
Analysis ID:	1472791
MD5:	472052db7a344b5dba08aec26d6bdf6f
SHA1:	72d44235387e2ce08665b8976424e802a672c65f
SHA256:	5aef1b0e1673044cc7a46a3ea02e4caf2ec853acdf50e3d9a72aa9ac0fb1f88f
Tags:	exe
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to bypass UAC (CMSTPLUA)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Installs a global keyboard hook

Machine Learning detection for sample

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe" MD5: 472052DB7A344B5DBA08AEC26D6BDF6F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "areaseguras.con-ip.com:2707:1", "Assigned name": "spacolombia2707RAPTOR", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "Rmc121455011-7TOVMS", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\loggsdSSC\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x134a8:$a1: Remcos restarted by watchdog! 0x13a20:$a3: %02i:%02i:%02i:%03i
00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x134a8:$a1: Remcos restarted by watchdog! 0x13a20:$a3: %02i:%02i:%02i:%03i
00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xb2e6:$a1: Remcos restarted by watchdog! 0x233cf:$a1: Remcos restarted by watchdog! 0xb840:$a3: %02i:%02i:%02i:%03i 0xbc6f:$a3: %02i:%02i:%02i:%03i 0x23929:$a3: %02i:%02i:%02i:%03i 0x23d58:$a3: %02i:%02i:%02i:%03i
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Avira: detected

Antivirus detection for URL or domain

Source: areaseguras.con-ip.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "areaseguras.con-ip.com:2707:1", "Assigned name": "spacolombia2707RAPTOR", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "Rmc121455011-7TOVMS", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for domain / URL

Source: areaseguras.con-ip.com	Virustotal: Detection: 10%			Perma Link
Source: areaseguras.con-ip.com	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Virustotal: Detection: 79%

Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\loggsdSSC\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_00433837

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_1e0e93a8-9

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_004074FD _wcslen,CoGetObject,

0_2_004074FD

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409253
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C291
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C34D
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409665
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_0040880C
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040783C FindFirstFileW,FindNextFileW,	0_2_0040783C
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419AF5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB30
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD37

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407C97

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: areaseguras.con-ip.com

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 86.104.72.183:2707

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: TELE-ROM-ASstrAleeaPaciiBlB5Ap16RO TELE-ROM-ASstrAleeaPaciiBlB5Ap16RO

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0041B380

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: areaseguras.con-ip.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000662000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000662000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000641000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000662000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000662000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000641000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp6fgQ
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000641000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp=Q
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000662000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

0_2_0040A2B8

Installs a global keyboard hook

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Jump to behavior

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B70E

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_004168C1

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B70E

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_0040A3E0

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\loggsdSSC\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041C9E2 SystemParametersInfoW,

0_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_004132D2
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0041BB09
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	0_2_0041BB35

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

0_2_004167B4

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0043E0CC	0_2_0043E0CC
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0041F0FA	0_2_0041F0FA
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00454159	0_2_00454159
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00438168	0_2_00438168
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_004461F0	0_2_004461F0
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0043E2FB	0_2_0043E2FB
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0045332B	0_2_0045332B
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0042739D	0_2_0042739D
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_004374E6	0_2_004374E6
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0043E558	0_2_0043E558
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00438770	0_2_00438770
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_004378FE	0_2_004378FE
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00433946	0_2_00433946
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0044D9C9	0_2_0044D9C9
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00427A46	0_2_00427A46
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0041DB62	0_2_0041DB62
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00427BAF	0_2_00427BAF
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00437D33	0_2_00437D33
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00435E5E	0_2_00435E5E
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00426E0E	0_2_00426E0E
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0043DE9D	0_2_0043DE9D
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00413FCA	0_2_00413FCA
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00436FEA	0_2_00436FEA

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: String function: 00434770 appears 42 times
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: String function: 00401E65 appears 34 times

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@1/2@3/2

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_00417952

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040F474

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041B4A8

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AA4A

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Jump to behavior

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc121455011-7TOVMS

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: Software\	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: Exe	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: Exe	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: Inj	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: Inj	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: 8SG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: exepath	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: 8SG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: exepath	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: licence	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: dMG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: PSG	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: Administrator	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: User	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: del	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: del	0_2_0040E9C5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Command line argument: del	0_2_0040E9C5

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Virustotal: Detection: 79%

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041CB50

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00457106 push ecx; ret	0_2_00457119
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00457A28 push eax; ret	0_2_00457A46
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00434E56 push ecx; ret	0_2_00434E69

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

0_2_00406EB0

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AA4A

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

0_2_0041CB50

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0040F7A7 Sleep,ExitProcess,

0_2_0040F7A7

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

0_2_0041A748

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Window / User API: threadDelayed 5167	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Window / User API: threadDelayed 4304	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Window / User API: foregroundWindowGot 1763	Jump to behavior

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe TID: 2720	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe TID: 2720	Thread sleep time: -124000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe TID: 2504	Thread sleep count: 5167 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe TID: 2504	Thread sleep time: -15501000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe TID: 2504	Thread sleep count: 4304 > 30	Jump to behavior
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe TID: 2504	Thread sleep time: -12912000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409253
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C291
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C34D
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00409665
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_0040880C
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040783C FindFirstFileW,FindNextFileW,	0_2_0040783C
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419AF5
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB30
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD37

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407C97

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.000000000067B000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751099377.000000000067B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.000000000067B000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751099377.000000000067B000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

API call chain: ExitProcess graph end node

graph_0-48207

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004349F9

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

0_2_0041CB50

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_004432B5 mov eax, dword ptr fs:[00000030h]

0_2_004432B5

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00412077 GetProcessHeap,HeapFree,

0_2_00412077

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004349F9
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00434B47 SetUnhandledExceptionFilter,	0_2_00434B47
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043BB22
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: 0_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00434FDC

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

0_2_00412117

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00419627 mouse_event,

0_2_00419627

Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000003.1751014820.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerK7,
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, logs.dat.0.dr	Binary or memory string: [2024/07/13 22:17:04 Program Manager]
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerEM
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerinutes
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager3?\|
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageri?
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerK?
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd7I
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managero7@
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp, 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000641000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd?
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000674000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerF?
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerz7{
Source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, 00000000.00000002.4191170000.0000000000670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managers7d

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00434C52 cpuid

0_2_00434C52

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetLocaleInfoA,	0_2_0040F8D1
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: EnumSystemLocalesW,	0_2_00452036
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004520C3
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetLocaleInfoW,	0_2_00452313
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: EnumSystemLocalesW,	0_2_00448404
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0045243C
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetLocaleInfoW,	0_2_00452543
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452610
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: GetLocaleInfoW,	0_2_004488ED
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00451CD8
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: EnumSystemLocalesW,	0_2_00451F50
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: EnumSystemLocalesW,	0_2_00451F9B

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

0_2_00404F51

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_0041B60D GetComputerNameExW,GetUserNameW,

0_2_0041B60D

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: 0_2_004493AD _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_004493AD

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\loggsdSSC\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

0_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		0_2_0040BB30
Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe	Code function: \key3.db		0_2_0040BB30

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe, type: SAMPLE
Source: Yara match	File source: 0.0.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4190979631.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1734672534.0000000000459000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4191170000.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\loggsdSSC\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Code function: cmd.exe

0_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 Masquerading	LSA Secrets	23 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b_dump.exe