Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

WBQXywne4N.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.74537177604957
Filename:	WBQXywne4N.exe
Filesize:	1145856
MD5:	2ad6b435964c1607e848b2cbde8885ee
SHA1:	0800c4b079b6277aa86f434b78175da72366de3f
SHA256:	930fdedab0dcc5bbd3a1ab3e50a3675e4ba0823b601ca2b9602b92657b1de006
SHA512:	396712fb2b67afbf351b4d655a4ea63c7266c7dce28db7890df4c60e262295ca31fbd6baf8bc86e25f88ced4d547177edd6d0c7a020818cf020d8dbed1b1f6f4
SSDEEP:	24576:PjvV3Mn2jgnuHsOzj4j85M1hUQDAxzJX4YH:PjV8BusOzj4jGM1aK4FX
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b.*.........."...P..r............... ........@.. ....................................`................................

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection	Process Injection
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories Security Software Discovery
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Tries to delay execution (extensive OutputDebugStringW loop)	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Security Software Discovery
Checks if the current process is being debugged	Anti Debugging	Security Software Discovery
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API Access Token Manipulation
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Process Injection Virtualization/Sandbox Evasion Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	System Time Discovery Process Discovery
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion	Security Software Discovery
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Security Software Discovery
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	File and Directory Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Sample file is different than original file name gathered from version info	System Summary	Security Software Discovery System Shutdown/Reboot
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information Security Software Discovery
Yara signature match	System Summary	Process Injection
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Process Injection Software Packing
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Process Injection Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Process Injection Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Public key (encryption) found	Cryptography	Account Discovery Security Software Discovery System Owner/User Discovery Archive Collected Data
Queries a list of all running processes	Malware Analysis System Evasion	Process Injection
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Process Injection
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary	Security Software Discovery
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary
Uses Microsoft Silverlight	System Summary	Process Injection

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WBQXywne4N.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WBQXywne4N.exe.log
Category:	dropped
Dump:	WBQXywne4N.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\WBQXywne4N.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzea
Size:	1216
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\WBQXywne4N.exe

"C:\Users\user\Desktop\WBQXywne4N.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7508
Target ID:	0
Parent PID:	2592
Name:	WBQXywne4N.exe
Path:	C:\Users\user\Desktop\WBQXywne4N.exe
Commandline:	"C:\Users\user\Desktop\WBQXywne4N.exe"
Size:	1145856
MD5:	2AD6B435964C1607E848B2CBDE8885EE
Time:	00:14:38
Date:	11/01/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x840000
Modulesize:	1171456
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected DarkTortilla Crypter	Data Obfuscation
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for sample	AV Detection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7944
Target ID:	4
Parent PID:	7508
Name:	AddInProcess32.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Size:	43008
MD5:	9827FF3CDF4B83F9C86354606736CA9C
Time:	00:14:56
Date:	11/01/2025
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xc30000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

URLs

Name

Malicious

cjmancool.dynamic-dns.net

Details

Name:	cjmancool.dynamic-dns.net
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\WBQXywne4N.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp

unknown

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\WBQXywne4N.exe
Source:	WBQXywne4N.exe, 00000000.00000002.1819649058.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, WBQXywne4N.exe, 00000000.00000002.1819649058.00000000043E9000.00000004.00000800.00020000.00000000.sdmp, WBQXywne4N.exe, 00000000.00000002.1819649058.0000000004461000.00000004.00000800.00020000.00000000.sdmp, WBQXywne4N.exe, 00000000.00000002.1819649058.0000000004820000.00000004.00000800.00020000.00000000.sdmp, WBQXywne4N.exe, 00000000.00000002.1819649058.00000000045EC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.3759365928.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

cjmancool.dynamic-dns.net

94.78.99.194

Details

Name:	cjmancool.dynamic-dns.net
IP:	94.78.99.194
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

94.78.99.194

cjmancool.dynamic-dns.net

Turkey

Details

IP:	94.78.99.194
TargetID:	4
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Country:	Turkey
Countrycode:	TUR
ASN number:	44558
ASN name:	NETONLINETR
Private:	false
Domain:	cjmancool.dynamic-dns.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-GAT2GZ

exepath

Details

TargetID:	4
Path:	HKEY_CURRENT_USER\SOFTWARE\Rmc-GAT2GZ
Value name:	exepath
Value data:	04 51 11 BD C4 66 7E DF 94 3A 6E FC 43 3B D7 66 3C B7 DD 53 48 C0 E9 77 9F 9D DF 66 E1 F6 2D 02 D8 8E 57 B7 EE A0 1D 95 94 CE 26 5B 85 FA 67 AA E2 F9 CB C3 88 DE 40 FF 2C AD 23 70 E7 12 E6 88 F3 CB 6B A9 44 06 CA A1 A2 AA 96 F0 44 6E A7 98 E0 93 DE 11 D7 0E 44 CA 7E EB 13 0D 58 39 59 6B 7E 78 E1 CE C4 4A 87 05 95 97 2B EA 16 6C 58 2C EE 33 3B 6C 99 A2 73 31 D6 E7 52 9B 01 FA E1 E5 79 61

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Remcos	Stealing of Sensitive Information

HKEY_CURRENT_USER\SOFTWARE\Rmc-GAT2GZ

licence

Memdumps

Base Address

Regiontype

Protect

Malicious

400000

remote allocation

page execute and read and write

46C0000

trusted library allocation

page read and write

6380000

trusted library section

page read and write

43E9000

trusted library allocation

page read and write

33E1000

trusted library allocation

page read and write

4461000

trusted library allocation

page read and write

4820000

trusted library allocation

page read and write

45EC000

trusted library allocation

page read and write

129A000

heap

page read and write

36C3000

trusted library allocation

page read and write

3876000

trusted library allocation

page read and write

35A5000

trusted library allocation

page read and write

38A6000

trusted library allocation

page read and write

3A78000

trusted library allocation

page read and write

3A1F000

trusted library allocation

page read and write

6860000

trusted library allocation

page read and write

942000

unkown

page execute read

3627000

trusted library allocation

page read and write

3494000

trusted library allocation

page read and write

3602000

trusted library allocation

page read and write

39B2000

trusted library allocation

page read and write

34CD000

trusted library allocation

page read and write

37F6000

trusted library allocation

page read and write

35E4000

trusted library allocation

page read and write

3AB9000

trusted library allocation

page read and write

3922000

trusted library allocation

page read and write

39AC000

trusted library allocation

page read and write

6B50000

heap

page read and write

17E7000

trusted library allocation

page execute and read and write

184E000

stack

page read and write

38F8000

trusted library allocation

page read and write

3867000

trusted library allocation

page read and write

385D000

trusted library allocation

page read and write

37A3000

trusted library allocation

page read and write

7D44000

heap

page read and write

1180000

heap

page read and write

39A4000

trusted library allocation

page read and write

398D000

trusted library allocation

page read and write

83D2000

trusted library allocation

page read and write

3A40000

trusted library allocation

page read and write

DCC000

stack

page read and write

3882000

trusted library allocation

page read and write

3500000

trusted library allocation

page read and write

3686000

trusted library allocation

page read and write

3380000

trusted library allocation

page read and write

3688000

trusted library allocation

page read and write

3646000

trusted library allocation

page read and write

37B2000

trusted library allocation

page read and write

39DC000

trusted library allocation

page read and write

3B23000

trusted library allocation

page read and write

3B1D000

trusted library allocation

page read and write

151E000

stack

page read and write

17BD000

trusted library allocation

page execute and read and write

369F000

trusted library allocation

page read and write

36B2000

trusted library allocation

page read and write

6510000

heap

page read and write

3140000

trusted library allocation

page execute and read and write

35FB000

trusted library allocation

page read and write

3AE9000

trusted library allocation

page read and write

35AA000

trusted library allocation

page read and write

38E9000

trusted library allocation

page read and write

3941000

trusted library allocation

page read and write

931000

unkown

page execute read

6B96000

heap

page read and write

397C000

trusted library allocation

page read and write

3640000

trusted library allocation

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
WBQXywne4N.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportWBQXywne4N.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
WBQXywne4N.exe