Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\3TpW2Sn68z.exe

"C:\Users\user\Desktop\3TpW2Sn68z.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7548
Target ID:	0
Parent PID:	2580
Name:	3TpW2Sn68z.exe
Path:	C:\Users\user\Desktop\3TpW2Sn68z.exe
Commandline:	"C:\Users\user\Desktop\3TpW2Sn68z.exe"
Size:	1426944
MD5:	C7FC0CEE8CA35D709ED276E9F88DDBED
Time:	08:16:55
Date:	05/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x560000
Modulesize:	1449984
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\directory\RegAsymX.exe

"C:\Users\user\Desktop\3TpW2Sn68z.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7564
Target ID:	1
Parent PID:	7548
Name:	RegAsymX.exe
Class:	system-tools
Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Commandline:	"C:\Users\user\Desktop\3TpW2Sn68z.exe"
Size:	1426944
MD5:	C7FC0CEE8CA35D709ED276E9F88DDBED
Time:	08:16:56
Date:	05/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7e0000
Modulesize:	1449984
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (creates a PE file in dynamic memory)	Compliance, Data Obfuscation	Software Packing
Sigma detected: Drops script at startup location	Data Obfuscation
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Binary is likely a compiled AutoIt script file	System Summary
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sigma detected: Uncommon Svchost Parent Process	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Local\directory\RegAsymX.exe

"C:\Users\user\AppData\Local\directory\RegAsymX.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7608
Target ID:	2
Parent PID:	7564
Name:	RegAsymX.exe
Class:	system-tools
Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Commandline:	"C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Size:	1426944
MD5:	C7FC0CEE8CA35D709ED276E9F88DDBED
Time:	08:16:57
Date:	05/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7e0000
Modulesize:	1449984
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (creates a PE file in dynamic memory)	Compliance, Data Obfuscation	Software Packing
Sigma detected: Drops script at startup location	Data Obfuscation
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Binary is likely a compiled AutoIt script file	System Summary
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sigma detected: Uncommon Svchost Parent Process	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Details

Is windows:	true
Is dropped:	false
PID:	7660
Target ID:	3
Parent PID:	7608
Name:	svchost.exe
Path:	C:\Windows\SysWOW64\svchost.exe
Commandline:	svchost.exe
Size:	46504
MD5:	1ED18311E3DA35942DB37D15FA40CC5B
Time:	08:16:59
Date:	05/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x900000
Modulesize:	53248
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspect Svchost Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Uncommon Svchost Parent Process	System Summary
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"

Details

Is windows:	true
Is dropped:	false
PID:	7884
Target ID:	7
Parent PID:	2580
Name:	wscript.exe
Class:	wscript
Path:	C:\Windows\System32\wscript.exe
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs"
Size:	170496
MD5:	A47CBE969EA935BDD3AB568BB126BC80
Time:	08:17:08
Date:	05/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff66f9c0000
Modulesize:	184320
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: WScript or CScript Dropper	System Summary
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Executes visual basic scripts	System Summary	Scripting
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\directory\RegAsymX.exe

"C:\Users\user\AppData\Local\directory\RegAsymX.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7936
Target ID:	8
Parent PID:	7884
Name:	RegAsymX.exe
Class:	system-tools
Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Commandline:	"C:\Users\user\AppData\Local\directory\RegAsymX.exe"
Size:	1426944
MD5:	C7FC0CEE8CA35D709ED276E9F88DDBED
Time:	08:17:09
Date:	05/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x7e0000
Modulesize:	1449984
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (creates a PE file in dynamic memory)	Compliance, Data Obfuscation	Software Packing
Sigma detected: Drops script at startup location	Data Obfuscation
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Binary is likely a compiled AutoIt script file	System Summary
Sigma detected: Suspect Svchost Activity	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sigma detected: Uncommon Svchost Parent Process	System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568

Details

Is windows:	true
Is dropped:	false
PID:	7764
Target ID:	6
Parent PID:	7660
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 568
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	08:17:02
Date:	05/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x500000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

84.38.132.103

Details

Name:	84.38.132.103
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\3TpW2Sn68z.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

http://geoplugin.net/json.gp

unknown

http://upx.sf.net

unknown

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	1
From Memory:	true
Current Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Source:	RegAsymX.exe, 00000001.00000002.1695928275.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143842254.0000000001040000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000002.00000002.4143167796.0000000000400000.00000040.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4144035421.0000000004130000.00000004.00001000.00020000.00000000.sdmp, RegAsymX.exe, 00000008.00000002.4143019501.0000000000400000.00000040.00001000.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

84.38.132.103

unknown

Latvia

Details

IP:	84.38.132.103
TargetID:	2
Current Path:	C:\Users\user\AppData\Local\directory\RegAsymX.exe
Country:	Latvia
Countrycode:	LVA
ASN number:	52048
ASN name:	DATACLUBLV
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-FR1M2R

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-FR1M2R

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-FR1M2R

time

HKEY_CURRENT_USER\SOFTWARE\Rmc-FR1M2R