Windows Analysis Report
3TpW2Sn68z.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 3TpW2Sn68z.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		2_2_004338C8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		8_2_004338C8

Source: RegAsymX.exe, 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_98b29fde-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00407538 _wcslen,CoGetObject,		2_2_00407538
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00407538 _wcslen,CoGetObject,		8_2_00407538

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 2.2.RegAsymX.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 8.2.RegAsymX.exe.400000.0.unpack

Source: 3TpW2Sn68z.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005CDBBE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D68EE FindFirstFileW,FindClose,	0_2_005D68EE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005D698F
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD076
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD3A9
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D9642
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D979D
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005D9B2B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005D5C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0084DBBE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008568EE FindFirstFileW,FindClose,	1_2_008568EE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	1_2_0085698F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D076
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D3A9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00859642
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0085979D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00859B2B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00855C97 FindFirstFileW,FindNextFileW,FindClose,	1_2_00855C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00407877 FindFirstFileW,FindNextFileW,	2_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_0327698F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032768EE FindFirstFileW,FindClose,	3_2_032768EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D3A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0327979D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_03279642
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_03279B2B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0326DBBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03275C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_03275C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00407877 FindFirstFileW,FindNextFileW,	8_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_0040BD72

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407CD2

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49730 -> 84.38.132.103:7001
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:53013 -> 84.38.132.103:7001
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:53009 -> 84.38.132.103:7001

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 84.38.132.103

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 84.38.132.103:7001

Source: Joe Sandbox View

ASN Name: DATACLUBLV DATACLUBLV

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.132.103

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005DCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_005DCE44

Source: RegAsymX.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: RegAsymX.exe, 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

2_2_0040A2F3

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005DEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_005DEAFF

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005DED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_005DED6A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	1_2_0085ED6A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	2_2_004168FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_0327ED6A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	8_2_004168FC

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

0_2_005DEAFF

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005CAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_005CAA57

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005F9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_005F9576
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00879576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	1_2_00879576
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	3_2_03299576

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041CA6D SystemParametersInfoW,	2_2_0041CA6D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041CA73 SystemParametersInfoW,	2_2_0041CA73
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041CA6D SystemParametersInfoW,	8_2_0041CA6D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041CA73 SystemParametersInfoW,	8_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: 3TpW2Sn68z.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 3TpW2Sn68z.exe, 00000000.00000002.1682848717.0000000000622000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_814a09af-6
Source: 3TpW2Sn68z.exe, 00000000.00000002.1682848717.0000000000622000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_017a4c7f-1
Source: 3TpW2Sn68z.exe, 00000000.00000003.1681672618.0000000003DE1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_deae4797-6
Source: 3TpW2Sn68z.exe, 00000000.00000003.1681672618.0000000003DE1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3ebbe7c7-3
Source: RegAsymX.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: RegAsymX.exe, 00000001.00000000.1681932970.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d894eeb2-c
Source: RegAsymX.exe, 00000001.00000000.1681932970.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d93d97fc-5
Source: RegAsymX.exe, 00000002.00000002.4144768646.0000000003F72000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_610698ee-5
Source: RegAsymX.exe, 00000002.00000002.4144768646.0000000003F72000.00000040.10000000.00040000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_69ad603f-e
Source: RegAsymX.exe, 00000002.00000002.4144625611.0000000003DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7e079ba4-9
Source: RegAsymX.exe, 00000002.00000002.4144625611.0000000003DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bc41f37b-8
Source: RegAsymX.exe, 00000002.00000002.4143541171.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2f49fdef-1
Source: RegAsymX.exe, 00000002.00000002.4143541171.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5b8ae25b-2
Source: svchost.exe, 00000003.00000002.2005838898.00000000032C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4b7a6453-9
Source: svchost.exe, 00000003.00000002.2005838898.00000000032C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0407e11f-a
Source: RegAsymX.exe, 00000008.00000000.1810224415.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7002a894-9
Source: RegAsymX.exe, 00000008.00000000.1810224415.00000000008A2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c4435ec3-3
Source: RegAsymX.exe, 00000008.00000002.4144091090.0000000004276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_095845a4-a
Source: RegAsymX.exe, 00000008.00000002.4144091090.0000000004276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f2a9c828-4
Source: 3TpW2Sn68z.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_959647dd-f
Source: 3TpW2Sn68z.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_745d09d1-8
Source: RegAsymX.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2e2a7c22-2
Source: RegAsymX.exe.0.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2fc89a24-2

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	2_2_0041812A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	2_2_0041330D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	2_2_0041BBC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	2_2_0041BB9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0329A2D7 NtdllDialogWndProc_W,	3_2_0329A2D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032987B2 NtdllDialogWndProc_W,CallWindowProcW,	3_2_032987B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03218BA4 NtdllDialogWndProc_W,	3_2_03218BA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03298AAA NtdllDialogWndProc_W,	3_2_03298AAA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03298FC9 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	3_2_03298FC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299380 NtdllDialogWndProc_W,	3_2_03299380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032993CB NtdllDialogWndProc_W,	3_2_032993CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0329911E DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	3_2_0329911E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03203170 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	3_2_03203170
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03219052 NtdllDialogWndProc_W,	3_2_03219052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032190A7 NtdllDialogWndProc_W,	3_2_032190A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032990A1 SendMessageW,NtdllDialogWndProc_W,	3_2_032990A1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032197C0 GetParent,NtdllDialogWndProc_W,	3_2_032197C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0329953A GetWindowLongW,NtdllDialogWndProc_W,	3_2_0329953A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	3_2_03299576
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299400 ClientToScreen,NtdllDialogWndProc_W,	3_2_03299400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321997D NtdllDialogWndProc_W,GetSysColor,SetBkColor,NtdllDialogWndProc_W,	3_2_0321997D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299F86 GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	3_2_03299F86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299E74 NtdllDialogWndProc_W,	3_2_03299E74
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03299EF3 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	3_2_03299EF3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	8_2_0041330D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	8_2_0041BBC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	8_2_0041BB9A

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005CD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_005CD5EB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005C1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_005C1201

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_005CE8F6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	1_2_0084E8F6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	2_2_004167EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	3_2_0326E8F6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	8_2_004167EF

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0056BF40	0_2_0056BF40
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D2046	0_2_005D2046
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00568060	0_2_00568060
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005C8298	0_2_005C8298
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0059E4FF	0_2_0059E4FF
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0059676B	0_2_0059676B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005F4873	0_2_005F4873
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0056CAF0	0_2_0056CAF0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0058CAA0	0_2_0058CAA0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057CC39	0_2_0057CC39
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00596DD9	0_2_00596DD9
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057B119	0_2_0057B119
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005691C0	0_2_005691C0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581394	0_2_00581394
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581706	0_2_00581706
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0058781B	0_2_0058781B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057997D	0_2_0057997D
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00567920	0_2_00567920
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005819B0	0_2_005819B0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00587A4A	0_2_00587A4A
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581C77	0_2_00581C77
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00587CA7	0_2_00587CA7
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005EBE44	0_2_005EBE44
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00599EEE	0_2_00599EEE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00581F32	0_2_00581F32
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02023660	0_2_02023660
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007E8060	1_2_007E8060
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00852046	1_2_00852046
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00848298	1_2_00848298
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0081E4FF	1_2_0081E4FF
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0081676B	1_2_0081676B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00874873	1_2_00874873
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0080CAA0	1_2_0080CAA0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007ECAF0	1_2_007ECAF0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007FCC39	1_2_007FCC39
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00816DD9	1_2_00816DD9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007FB119	1_2_007FB119
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007E91C0	1_2_007E91C0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801394	1_2_00801394
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801706	1_2_00801706
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0080781B	1_2_0080781B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007F997D	1_2_007F997D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008019B0	1_2_008019B0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007E7920	1_2_007E7920
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00807A4A	1_2_00807A4A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00807CA7	1_2_00807CA7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801C77	1_2_00801C77
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00819EEE	1_2_00819EEE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0086BE44	1_2_0086BE44
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00801F32	1_2_00801F32
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00603660	1_2_00603660
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043706A	2_2_0043706A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00414005	2_2_00414005
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043E11C	2_2_0043E11C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004541D9	2_2_004541D9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004381E8	2_2_004381E8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041F18B	2_2_0041F18B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00446270	2_2_00446270
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043E34B	2_2_0043E34B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004533AB	2_2_004533AB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0042742E	2_2_0042742E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00437566	2_2_00437566
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043E5A8	2_2_0043E5A8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004387F0	2_2_004387F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043797E	2_2_0043797E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004339D7	2_2_004339D7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0044DA49	2_2_0044DA49
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00427AD7	2_2_00427AD7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041DBF3	2_2_0041DBF3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00427C40	2_2_00427C40
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00437DB3	2_2_00437DB3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00435EEB	2_2_00435EEB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043DEED	2_2_0043DEED
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00426E9F	2_2_00426E9F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01033660	2_2_01033660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03268298	3_2_03268298
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03208060	3_2_03208060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03272046	3_2_03272046
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0323676B	3_2_0323676B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0323E4FF	3_2_0323E4FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0322CAA0	3_2_0322CAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0320CAF0	3_2_0320CAF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03294873	3_2_03294873
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03236DD9	3_2_03236DD9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321CC39	3_2_0321CC39
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221394	3_2_03221394
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321B119	3_2_0321B119
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032091C0	3_2_032091C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221706	3_2_03221706
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03227A4A	3_2_03227A4A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03207920	3_2_03207920
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321997D	3_2_0321997D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032219B0	3_2_032219B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0322781B	3_2_0322781B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221F32	3_2_03221F32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0328BE44	3_2_0328BE44
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03239EEE	3_2_03239EEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03221C77	3_2_03221C77
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03227CA7	3_2_03227CA7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043706A	8_2_0043706A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00414005	8_2_00414005
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043E11C	8_2_0043E11C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004541D9	8_2_004541D9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004381E8	8_2_004381E8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041F18B	8_2_0041F18B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00446270	8_2_00446270
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043E34B	8_2_0043E34B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004533AB	8_2_004533AB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0042742E	8_2_0042742E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00437566	8_2_00437566
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043E5A8	8_2_0043E5A8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004387F0	8_2_004387F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043797E	8_2_0043797E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004339D7	8_2_004339D7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0044DA49	8_2_0044DA49
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00427AD7	8_2_00427AD7
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041DBF3	8_2_0041DBF3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00427C40	8_2_00427C40
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00437DB3	8_2_00437DB3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00435EEB	8_2_00435EEB
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043DEED	8_2_0043DEED
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00426E9F	8_2_00426E9F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A3660	8_2_018A3660

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 007FF9F2 appears 31 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00800A30 appears 46 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00401E65 appears 70 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00401FAB appears 44 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03220A30 appears 46 times
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: String function: 00580A30 appears 46 times
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: String function: 0057F9F2 appears 31 times

Source: C:\Windows\SysWOW64\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568

Source: 3TpW2Sn68z.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@11/18@0/1

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D37B5 GetLastError,FormatMessageW,

0_2_005D37B5

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005C10BF AdjustTokenPrivileges,CloseHandle,	0_2_005C10BF
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005C16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_005C16C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008410BF AdjustTokenPrivileges,CloseHandle,	1_2_008410BF
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	1_2_008416C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	2_2_0041798D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032610BF AdjustTokenPrivileges,CloseHandle,	3_2_032610BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032616C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	3_2_032616C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	8_2_0041798D

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005D51CD

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005EA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_005EA67C

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_005D648E

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_005642A2

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AADB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File created: C:\Users\user\AppData\Local\directory

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7660
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R-W
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File created: C:\Users\user\AppData\Local\Temp\autA43A.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"

Source: 3TpW2Sn68z.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 3TpW2Sn68z.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File read: C:\Users\user\Desktop\3TpW2Sn68z.exe

Source: unknown	Process created: C:\Users\user\Desktop\3TpW2Sn68z.exe "C:\Users\user\Desktop\3TpW2Sn68z.exe"
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\Desktop\3TpW2Sn68z.exe"
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\Desktop\3TpW2Sn68z.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Detected unpacking (creates a PE file in dynamic memory)

Source: 3TpW2Sn68z.exe

Static file information: File size 1426944 > 1048576

Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 3TpW2Sn68z.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 3TpW2Sn68z.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 3TpW2Sn68z.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 2.2.RegAsymX.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Unpacked PE file: 8.2.RegAsymX.exe.400000.0.unpack

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00580A76 push ecx; ret	0_2_00580A89
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00800A76 push ecx; ret	1_2_00800A89
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00457186 push ecx; ret	2_2_00457199
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041C7F3 push eax; retf	2_2_0041C7FD
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00457AA8 push eax; ret	2_2_00457AC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00434EB6 push ecx; ret	2_2_00434EC9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03220A76 push ecx; ret	3_2_03220A89
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00457186 push ecx; ret	8_2_00457199
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041C7F3 push eax; retf	8_2_0041C7FD
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00457AA8 push eax; ret	8_2_00457AC6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00434EB6 push ecx; ret	8_2_00434EC9

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_00406EEB ShellExecuteW,URLDownloadToFileW,

2_2_00406EEB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

File created: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs

Delayed program exit found

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0041AADB

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0057F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_0057F98E
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005F1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_005F1C41
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_007FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	1_2_007FF98E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00871C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	1_2_00871C41
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0321F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	3_2_0321F98E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03291C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	3_2_03291C41

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

2_2_0041CBE1

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040F7E2 Sleep,ExitProcess,		2_2_0040F7E2
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040F7E2 Sleep,ExitProcess,		8_2_0040F7E2

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep			graph_0-96870
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		2_2_0041A7D9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		8_2_0041A7D9

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Window / User API: threadDelayed 1632	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Window / User API: threadDelayed 1623	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Window / User API: threadDelayed 3312	Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	API coverage: 3.8 %
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	API coverage: 3.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 1.0 %
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	API coverage: 7.9 %

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7640	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7644	Thread sleep count: 1632 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7644	Thread sleep time: -4896000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7652	Thread sleep count: 1623 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 7652	Thread sleep time: -4869000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 5804	Thread sleep count: 3312 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe TID: 5804	Thread sleep time: -3312000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_005CDBBE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D68EE FindFirstFileW,FindClose,	0_2_005D68EE
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_005D698F
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD076
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005CD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_005CD3A9
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D9642
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_005D979D
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_005D9B2B
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005D5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_005D5C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0084DBBE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008568EE FindFirstFileW,FindClose,	1_2_008568EE
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	1_2_0085698F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D076
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0084D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0084D3A9
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00859642
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0085979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0085979D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00859B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00859B2B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00855C97 FindFirstFileW,FindNextFileW,FindClose,	1_2_00855C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	2_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	2_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	2_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00407877 FindFirstFileW,FindNextFileW,	2_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	2_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	2_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	3_2_0327698F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032768EE FindFirstFileW,FindClose,	3_2_032768EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D3A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_0326D076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0327979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0327979D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_03279642
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03279B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	3_2_03279B2B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0326DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0326DBBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03275C97 FindFirstFileW,FindNextFileW,FindClose,	3_2_03275C97
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_0040928E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_0041C322
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_0040C388
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004096A0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00408847
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00407877 FindFirstFileW,FindNextFileW,	8_2_00407877
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_00419B86
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_0040BD72

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

2_2_00407CD2

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll81
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005DEAA2 BlockInput,

0_2_005DEAA2

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_00592622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00592622

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00584CE8 mov eax, dword ptr fs:[00000030h]	0_2_00584CE8
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_020234F0 mov eax, dword ptr fs:[00000030h]	0_2_020234F0
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02023550 mov eax, dword ptr fs:[00000030h]	0_2_02023550
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02021E7E mov eax, dword ptr fs:[00000030h]	0_2_02021E7E
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_02021E90 mov eax, dword ptr fs:[00000030h]	0_2_02021E90
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00804CE8 mov eax, dword ptr fs:[00000030h]	1_2_00804CE8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_006034F0 mov eax, dword ptr fs:[00000030h]	1_2_006034F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00603550 mov eax, dword ptr fs:[00000030h]	1_2_00603550
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00601E7E mov eax, dword ptr fs:[00000030h]	1_2_00601E7E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00601E90 mov eax, dword ptr fs:[00000030h]	1_2_00601E90
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00443355 mov eax, dword ptr fs:[00000030h]	2_2_00443355
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01033550 mov eax, dword ptr fs:[00000030h]	2_2_01033550
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_010334F0 mov eax, dword ptr fs:[00000030h]	2_2_010334F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01031E7E mov eax, dword ptr fs:[00000030h]	2_2_01031E7E
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_01031E90 mov eax, dword ptr fs:[00000030h]	2_2_01031E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03224CE8 mov eax, dword ptr fs:[00000030h]	3_2_03224CE8
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00443355 mov eax, dword ptr fs:[00000030h]	8_2_00443355
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A3550 mov eax, dword ptr fs:[00000030h]	8_2_018A3550
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A34F0 mov eax, dword ptr fs:[00000030h]	8_2_018A34F0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A1E90 mov eax, dword ptr fs:[00000030h]	8_2_018A1E90
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_018A1E7E mov eax, dword ptr fs:[00000030h]	8_2_018A1E7E

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005C0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_005C0B62

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00592622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00592622
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_0058083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0058083F
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_005809D5 SetUnhandledExceptionFilter,	0_2_005809D5
Source: C:\Users\user\Desktop\3TpW2Sn68z.exe	Code function: 0_2_00580C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00580C21
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00812622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00812622
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_0080083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0080083F
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_008009D5 SetUnhandledExceptionFilter,	1_2_008009D5
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 1_2_00800C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00800C21
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043503C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00434A8A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0043BB71
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 2_2_00434BD8 SetUnhandledExceptionFilter,	2_2_00434BD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03232622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_03232622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032209D5 SetUnhandledExceptionFilter,	3_2_032209D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0322083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0322083F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03220C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_03220C21
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0043503C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00434A8A
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0043BB71
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: 8_2_00434BD8 SetUnhandledExceptionFilter,	8_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Code function: 2_2_0041812A GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

2_2_0041812A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3179008

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		2_2_00412132
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		8_2_00412132

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

0_2_005C1201

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005A2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_005A2BA5

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005CB226 SendInput,keybd_event,

0_2_005CB226

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005E22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_005E22DA

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\RegAsymX.exe "C:\Users\user\AppData\Local\directory\RegAsymX.exe"			Jump to behavior

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

0_2_005C0B62

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005C1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_005C1663

Source: 3TpW2Sn68z.exe, RegAsymX.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RegAsymX.exe, 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2R\
Source: 3TpW2Sn68z.exe, RegAsymX.exe	Binary or memory string: Shell_TrayWnd
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2R\G
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2R\Y
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager@
Source: RegAsymX.exe, 00000002.00000002.4143971478.0000000001168000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9
Source: RegAsymX.exe, 00000002.00000002.4144358556.0000000001346000.00000004.00000020.00020000.00000000.sdmp, logs.dat.2.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_00580698 cpuid

0_2_00580698

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_0045201B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_004520B6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452143
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	2_2_00452393
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_00448484
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004524BC
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	2_2_004525C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452690
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	2_2_0044896D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoA,	2_2_0040F90C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00451D58
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	2_2_00451FD0
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_0045201B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_004520B6
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00452143
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	8_2_00452393
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_00448484
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_004524BC
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	8_2_004525C3
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00452690
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoW,	8_2_0044896D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: GetLocaleInfoA,	8_2_0040F90C
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_00451D58
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: EnumSystemLocalesW,	8_2_00451FD0

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005D8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_005D8195

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005BD27A GetUserNameW,

0_2_005BD27A

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_0059BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0059BB6F

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Code function: 0_2_005642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Users\user\Desktop\3TpW2Sn68z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsymX.exe.4130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.1040000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsymX.exe.dd0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsymX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4144608465.0000000003CEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143940399.0000000001B5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143632839.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001118000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143971478.0000000001148000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4144505602.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsymX.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		2_2_0040BA4D
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		8_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \key3.db	2_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	8_2_0040BB6B
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Code function: \key3.db	8_2_0040BB6B

Source: RegAsymX.exe	Binary or memory string: WIN_81
Source: RegAsymX.exe	Binary or memory string: WIN_XP
Source: RegAsymX.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: RegAsymX.exe	Binary or memory string: WIN_XPe
Source: RegAsymX.exe	Binary or memory string: WIN_VISTA
Source: RegAsymX.exe	Binary or memory string: WIN_7
Source: RegAsymX.exe	Binary or memory string: WIN_8

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\RegAsymX.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-FR1M2R-W			Jump to behavior