Windows Analysis Report
s0VxndYXq0

Overview

General Information

Sample Name: s0VxndYXq0 (renamed file extension from none to exe)
Analysis ID: 679299
MD5: de9784a4f56eaf8affc96754a15a5cd3
SHA1: 35c361a8bfdb894e80fe99728e60ad7d08745af1
SHA256: f384a96582763be490ea4eeed6d3f10291d7df964f64db077b4d10697149a7da
Tags: exe
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Yara detected Remcos RAT
Antivirus / Scanner detection for submitted sample
Detected Remcos RAT
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Injects a PE file into a foreign processes
Yara detected Generic Downloader
Uses ping.exe to sleep
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: s0VxndYXq0.exe Virustotal: Detection: 53% Perma Link
Source: s0VxndYXq0.exe ReversingLabs: Detection: 53%
Yara detected Remcos RAT
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.365233653.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.342391067.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.269857625.0000000002CD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.493007691.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 2732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 3264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5580, type: MEMORYSTR
Antivirus / Scanner detection for submitted sample
Source: s0VxndYXq0.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\remcos\remcos.exe Avira: detection malicious, Label: TR/Kryptik.wodao
Multi AV Scanner detection for dropped file
Source: C:\Users\user\remcos\remcos.exe ReversingLabs: Detection: 53%
Machine Learning detection for sample
Source: s0VxndYXq0.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\remcos\remcos.exe Joe Sandbox ML: detected
Source: 0000001C.00000002.365233653.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "79.134.225.97:8600:123456|", "Assigned name": "Host", "Connect interval": "5", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "User Profile", "Copy file": "remcos.exe", "Startup value": "remcos", "Hide file": "Disable", "Mutex": "remcos_totevzugmgbhhbj", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screens", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "audio", "Connect delay": "0", "Copy folder": "remcos", "Keylog folder": "remcos"}
Uses 32bit PE files
Source: s0VxndYXq0.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: s0VxndYXq0.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE PING 127.0.0.1 -n 2
Yara detected Generic Downloader
Source: Yara match File source: s0VxndYXq0.exe, type: SAMPLE
Source: Yara match File source: 0.0.s0VxndYXq0.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\remcos\remcos.exe, type: DROPPED
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 79.134.225.97
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 79.134.225.97 79.134.225.97
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49765 -> 79.134.225.97:8600
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: unknown TCP traffic detected without corresponding DNS query: 79.134.225.97
Source: s0VxndYXq0.exe, remcos.exe.5.dr String found in binary or memory: http://bit.ly/unCoIY?http://lolnotes-
Source: s0VxndYXq0.exe, remcos.exe.5.dr String found in binary or memory: http://bladecoding.com/lolnotes/leagueofstats.php?name=
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: s0VxndYXq0.exe, 00000000.00000003.243809889.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.243932808.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.243586194.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244127013.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244021936.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.243771965.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.243848246.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244328823.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244234942.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.249288953.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000002.274138797.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.agfamonotype.cw
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244188865.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000002.274032296.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244610211.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244375972.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.264248405.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com.TTF
Source: s0VxndYXq0.exe, 00000000.00000003.237525657.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.238027244.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237981073.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.238107631.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.238027244.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.238027244.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: s0VxndYXq0.exe, 00000000.00000003.237791179.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237771360.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237819421.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersF
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: s0VxndYXq0.exe, 00000000.00000003.237710320.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersP
Source: s0VxndYXq0.exe, 00000000.00000003.238476266.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.238443260.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersa
Source: s0VxndYXq0.exe, 00000000.00000003.244079552.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerse
Source: s0VxndYXq0.exe, 00000000.00000003.237791179.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237910949.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237771360.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237851832.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237819421.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237952730.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerses-es_tradnlw
Source: s0VxndYXq0.exe, 00000000.00000003.244112658.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244079552.0000000005B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerst
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com7
Source: s0VxndYXq0.exe, 00000000.00000003.244188865.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244610211.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244375972.0000000005AED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsF
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsR
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsk
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: s0VxndYXq0.exe, 00000000.00000003.238946519.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessed
Source: s0VxndYXq0.exe, 00000000.00000003.244188865.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244610211.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244375972.0000000005AED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comictav
Source: s0VxndYXq0.exe, 00000000.00000003.244188865.0000000005AEE000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244610211.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.244375972.0000000005AED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: s0VxndYXq0.exe, 00000000.00000003.236102854.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236394837.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: s0VxndYXq0.exe, 00000000.00000003.236244264.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236102854.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/%
Source: s0VxndYXq0.exe, 00000000.00000003.236244264.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236102854.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236394837.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y
Source: s0VxndYXq0.exe, 00000000.00000003.236244264.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236102854.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236394837.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: s0VxndYXq0.exe, 00000000.00000003.236244264.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236102854.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.236394837.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/l-g
Source: s0VxndYXq0.exe, remcos.exe.5.dr String found in binary or memory: http://www.lolking.net/summoner/
Source: s0VxndYXq0.exe, 00000000.00000003.237033632.0000000005B1E000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000003.237070417.0000000005B20000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.Wb
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: s0VxndYXq0.exe, 00000000.00000002.274487686.0000000006CF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: s0VxndYXq0.exe, remcos.exe.5.dr String found in binary or memory: https://github.com/high6/LoLNotes
Source: s0VxndYXq0.exe, remcos.exe.5.dr String found in binary or memory: https://raw.github.com/bladecoding/LoLNotes/master/General.txtO
Creates a DirectInput object (often for capturing keystrokes)
Source: remcos.exe, 00000009.00000002.322144849.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.365233653.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.342391067.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.269857625.0000000002CD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.493007691.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 2732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 3264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5580, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: s0VxndYXq0.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR Matched rule: webshell_jsp_generic_base64 date = 2021/01/24, author = Arnim Rupp, description = Generic JSP webshell with base64 encoded payload, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 1b916afdd415dfa4e77cecf47321fd676ba2184d
Detected potential crypto function
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Code function: 0_2_029DE4FC 0_2_029DE4FC
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Code function: 0_2_075A53C0 0_2_075A53C0
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Code function: 0_2_075A6988 0_2_075A6988
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Code function: 0_2_075AA3B8 0_2_075AA3B8
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Code function: 0_2_075A53B0 0_2_075A53B0
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_00F8E4FC 9_2_00F8E4FC
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_07006988 9_2_07006988
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_070053C0 9_2_070053C0
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0700A3B8 9_2_0700A3B8
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_070053B0 9_2_070053B0
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0ADCC078 9_2_0ADCC078
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0ADCC6E0 9_2_0ADCC6E0
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0ADC21F0 9_2_0ADC21F0
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0ADC21E1 9_2_0ADC21E1
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0AEE7AA0 9_2_0AEE7AA0
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0AEE0040 9_2_0AEE0040
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0AEE0039 9_2_0AEE0039
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0AEE8CF0 9_2_0AEE8CF0
Sample file is different than original file name gathered from version info
Source: s0VxndYXq0.exe, 00000000.00000002.276887769.00000000075C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamePlates.dll4 vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000000.00000002.267398551.0000000002ACF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000000.00000002.267211444.0000000002A71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameFroor.dll4 vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000000.00000003.253119443.00000000088CC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePlates.dll4 vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000000.00000000.224015352.0000000000552000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameChannelServicesD.exe2 vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000000.00000002.278244309.000000000B4F0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSchedulingClerk.dll. vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000000.00000002.268898105.0000000004279000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSchedulingClerk.dll. vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe, 00000005.00000003.263421070.000000000111B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameChannelServicesD.exe2 vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe Binary or memory string: OriginalFilenameChannelServicesD.exe2 vs s0VxndYXq0.exe
Source: s0VxndYXq0.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: remcos.exe.5.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: s0VxndYXq0.exe Virustotal: Detection: 53%
Source: s0VxndYXq0.exe ReversingLabs: Detection: 53%
Source: C:\Users\user\Desktop\s0VxndYXq0.exe File read: C:\Users\user\Desktop\s0VxndYXq0.exe Jump to behavior
Source: s0VxndYXq0.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\s0VxndYXq0.exe "C:\Users\user\Desktop\s0VxndYXq0.exe"
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Users\user\Desktop\s0VxndYXq0.exe C:\Users\user\Desktop\s0VxndYXq0.exe
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\install.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE PING 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\remcos\remcos.exe "C:\Users\user\remcos\remcos.exe"
Source: unknown Process created: C:\Users\user\remcos\remcos.exe "C:\Users\user\remcos\remcos.exe"
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe
Source: unknown Process created: C:\Users\user\remcos\remcos.exe "C:\Users\user\remcos\remcos.exe"
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Users\user\Desktop\s0VxndYXq0.exe C:\Users\user\Desktop\s0VxndYXq0.exe Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\install.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE PING 127.0.0.1 -n 2 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\remcos\remcos.exe "C:\Users\user\remcos\remcos.exe" Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\s0VxndYXq0.exe.log Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe File created: C:\Users\user\AppData\Local\Temp\install.bat Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@23/5@0/2
Source: C:\Users\user\Desktop\s0VxndYXq0.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: s0VxndYXq0.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Mutant created: \Sessions\1\BaseNamedObjects\remcos_totevzugmgbhhbj
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3708:120:WilError_01
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\install.bat" "
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\s0VxndYXq0.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: s0VxndYXq0.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: s0VxndYXq0.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_07004C20 pushfd ; iretd 9_2_07004C21
Source: C:\Users\user\remcos\remcos.exe Code function: 9_2_0ADC5FAC push edx; ret 9_2_0ADC5FB3
Source: initial sample Static PE information: section name: .text entropy: 7.366377921746369
Source: initial sample Static PE information: section name: .text entropy: 7.366377921746369
Drops PE files
Source: C:\Users\user\Desktop\s0VxndYXq0.exe File created: C:\Users\user\remcos\remcos.exe Jump to dropped file
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run remcos Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run remcos Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 2732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: s0VxndYXq0.exe, 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000005.00000002.268992522.0000000000410000.00000040.00000400.00020000.00000000.sdmp, remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000000C.00000002.351006623.0000000002F8B000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 00000016.00000002.374683263.000000000336D000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000001A.00000002.341382253.0000000000410000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: remcos.exe, 0000001A.00000002.341382253.0000000000410000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: D/PD/P`\YISBIEDLL.DLL
Source: s0VxndYXq0.exe, 00000005.00000002.268992522.0000000000410000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: D/PD/P`\COSBIEDLL.DLL
Source: s0VxndYXq0.exe, 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Uses ping.exe to sleep
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE PING 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE PING 127.0.0.1 -n 2 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\s0VxndYXq0.exe TID: 4288 Thread sleep time: -45877s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe TID: 1400 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 2960 Thread sleep time: -45877s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 3584 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 5536 Thread sleep time: -45877s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 2860 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 3656 Thread sleep time: -45877s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 5752 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\remcos\remcos.exe TID: 2188 Thread sleep time: -50000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\remcos\remcos.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Thread delayed: delay time: 45877 Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 45877 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 45877 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 45877 Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: s0VxndYXq0.exe, 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000005.00000002.268992522.0000000000410000.00000040.00000400.00020000.00000000.sdmp, remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000001A.00000002.341382253.0000000000410000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: s0VxndYXq0.exe, 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, s0VxndYXq0.exe, 00000005.00000002.268992522.0000000000410000.00000040.00000400.00020000.00000000.sdmp, remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, remcos.exe, 0000001A.00000002.341382253.0000000000410000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: @HARDWARE\ACPI\DSDT\VBOX__PROCMON_WINDOW_CLASSPROCEXPL21invalid vector<T> subscript?playaudiodatafmt WAVERIFF.wav%Y-%m-%d %H.%MgetcamsingleframenocamerastartcamcapclosecamgetcamframeinitcamcapFreeFrameGetFrameCloseCameraOpenCameracamdlldatacamframe|dmc|[DataStart][DataStart]0000%02i:%02i:%02i:%03i [KeepAlive] Enabled! (Timeout: %i seconds)
Source: remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\remcos\remcos.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Memory written: C:\Users\user\Desktop\s0VxndYXq0.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Memory written: C:\Users\user\remcos\remcos.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Memory written: C:\Users\user\remcos\remcos.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Users\user\Desktop\s0VxndYXq0.exe C:\Users\user\Desktop\s0VxndYXq0.exe Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\install.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE PING 127.0.0.1 -n 2 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\remcos\remcos.exe "C:\Users\user\remcos\remcos.exe" Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Process created: C:\Users\user\remcos\remcos.exe C:\Users\user\remcos\remcos.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Users\user\Desktop\s0VxndYXq0.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Users\user\remcos\remcos.exe VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Users\user\remcos\remcos.exe VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Users\user\remcos\remcos.exe VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\remcos\remcos.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\s0VxndYXq0.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.365233653.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.342391067.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.269857625.0000000002CD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.493007691.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 2732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 3264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5580, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Remcos RAT
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d17888.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bab5e4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d021b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.2d0b63c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2bb7830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.s0VxndYXq0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.452e400.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.4545420.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.remcos.exe.2ba2158.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.s0VxndYXq0.exe.45131e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.365233653.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.342391067.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.269857625.0000000002CD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.493007691.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 2732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: s0VxndYXq0.exe PID: 3264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3908, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: remcos.exe PID: 5580, type: MEMORYSTR
Detected Remcos RAT
Source: s0VxndYXq0.exe, 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Remcos_Mutex_Inj
Source: s0VxndYXq0.exe, 00000000.00000002.271680078.0000000004513000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS
Source: s0VxndYXq0.exe, 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Remcos_Mutex_Inj
Source: s0VxndYXq0.exe, 00000000.00000002.268436636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS
Source: s0VxndYXq0.exe, 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Remcos_Mutex_Inj
Source: s0VxndYXq0.exe, 00000005.00000000.261466626.0000000000410000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS
Source: remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Remcos_Mutex_Inj
Source: remcos.exe, 00000009.00000002.336989263.0000000002B77000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS
Source: remcos.exe, 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Remcos_Mutex_Inj
Source: remcos.exe, 0000000C.00000002.351406709.0000000002FDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS
Source: remcos.exe, 0000001C.00000002.367697487.0000000000E27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Remcos_Mutex_Injser
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 679299 Sample: s0VxndYXq0 Startdate: 05/08/2022 Architecture: WINDOWS Score: 100 52 Malicious sample detected (through community Yara rule) 2->52 54 Antivirus / Scanner detection for submitted sample 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 7 other signatures 2->58 9 s0VxndYXq0.exe 3 2->9         started        13 remcos.exe 2 2->13         started        15 remcos.exe 2 2->15         started        process3 file4 46 C:\Users\user\AppData\...\s0VxndYXq0.exe.log, ASCII 9->46 dropped 64 Injects a PE file into a foreign processes 9->64 17 s0VxndYXq0.exe 1 5 9->17         started        20 remcos.exe 13->20         started        22 remcos.exe 15->22         started        signatures5 process6 file7 42 C:\Users\user\remcos\remcos.exe, PE32 17->42 dropped 44 C:\Users\user\...\remcos.exe:Zone.Identifier, ASCII 17->44 dropped 24 cmd.exe 1 17->24         started        process8 signatures9 60 Uses ping.exe to sleep 24->60 62 Uses ping.exe to check the status of other devices and networks 24->62 27 remcos.exe 3 24->27         started        30 PING.EXE 1 24->30         started        33 conhost.exe 24->33         started        process10 dnsIp11 66 Antivirus detection for dropped file 27->66 68 Multi AV Scanner detection for dropped file 27->68 70 Machine Learning detection for dropped file 27->70 72 Injects a PE file into a foreign processes 27->72 35 remcos.exe 1 2 27->35         started        38 remcos.exe 27->38         started        40 remcos.exe 27->40         started        50 127.0.0.1 unknown unknown 30->50 signatures12 process13 dnsIp14 48 79.134.225.97, 49765, 49770, 49772 FINK-TELECOM-SERVICESCH Switzerland 35->48
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
79.134.225.97
 unknown Switzerland
6775 FINK-TELECOM-SERVICESCH true

Private

IP
127.0.0.1

Contacted URLs

Name Malicious Antivirus Detection Reputation
79.134.225.97 true
  • 3%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown