|
remittance.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
| Filetype: |
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
6.704936269736051
|
| Filename: |
remittance.exe
|
| Filesize: |
1066496
|
| MD5: |
31c5c19e5cbf0993baeef892e8f73ada
|
| SHA1: |
3f39dd3802f34e7f0b8d307a5aa31daac779c3c8
|
| SHA256: |
b9b9fa184afcfe0808c76a42a44a22e960d0283cf763c120be371122d0de8174
|
| SHA512: |
083b584a585fc100ee3619ad31042d0b9188e2bf81ec3f178fb2e89a2854af30d57adef2e59e46e48f0a6abfd951706d5dee52d9479f4c12317dd0fdf2e4fe86
|
| SSDEEP: |
12288:BGVMmLXxPgZ8Uqcozk9h5uRsOLNoJ86aA/qoUmdaee/QCaCNqGVM9d4dIw8:B1mRgZjqco49hKssoJ8tydLC/VIdkIt
|
| Preview: |
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!-c..............P..V..........^u...
........@.. ....................................@................................
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Multi AV Scanner detection for submitted file |
AV Detection |
|
| Malicious sample detected (through community Yara rule) |
System Summary |
|
| Detected Nanocore Rat |
Remote Access Functionality |
|
| Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) |
Malware Analysis System Evasion |
|
| Machine Learning detection for sample |
AV Detection |
|
| .NET source code contains potential unpacker |
Data Obfuscation |
|
| Injects a PE file into a foreign processes |
HIPS / PFW / Operating System Protection Evasion |
|
| .NET source code contains very large strings |
System Summary |
|
| Hides that the sample has been downloaded from the Internet (zone.identifier) |
Hooking and other Techniques for Hiding and Protection |
Hidden Files and Directories
|
| Uses schtasks.exe or at.exe to add and modify task schedules |
Boot Survival |
|
| Uses 32bit PE files |
Compliance, System Summary |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
| Yara signature match |
System Summary |
|
| Antivirus or Machine Learning detection for unpacked file |
AV Detection |
|
| May sleep (evasive loops) to hinder dynamic analysis |
Malware Analysis System Evasion |
|
| Checks if Antivirus/Antispyware/Firewall program is installed (via WMI) |
Lowering of HIPS / PFW / Operating System Security Settings |
Windows Management Instrumentation
Security Software Discovery
|
| Uses code obfuscation techniques (call, push, ret) |
Data Obfuscation |
|
| Detected potential crypto function |
System Summary |
|
| Contains long sleeps (>= 3 min) |
Malware Analysis System Evasion |
|
| Enables debug privileges |
Anti Debugging |
|
| Found a high number of Window / User specific system calls (may be a loop to detect user behavior) |
Malware Analysis System Evasion |
|
| Found inlined nop instructions (likely shell or obfuscated code) |
Software Vulnerabilities |
Obfuscated Files or Information
|
| Installs a raw input device (often for capturing keystrokes) |
Key, Mouse, Clipboard, Microphone and Screen Capturing |
|
| Sample file is different than original file name gathered from version info |
System Summary |
|
| PE file contains strange resources |
System Summary |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Queries a list of all running processes |
Malware Analysis System Evasion |
|
| Sample is known by Antivirus |
System Summary |
|
| Sample reads its own file content |
System Summary |
|
| PE file has an executable .text section and no other executable section |
System Summary |
|
| Reads software policies |
System Summary |
|
| Queries the cryptographic machine GUID |
Language, Device and Operating System Detection |
|
| Uses an in-process (OLE) Automation server |
System Summary |
|
| Contains medium sleeps (>= 30s) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Creates files inside the user directory |
System Summary |
|
| Creates temporary files |
System Summary |
|
| .NET source code contains many randomly named methods |
Data Obfuscation |
|
| Disables application error messsages (SetErrorMode) |
Hooking and other Techniques for Hiding and Protection |
|
| Reads ini files |
System Summary |
File and Directory Discovery
|
| Creates guard pages, often used to prevent reverse engineering and debugging |
Anti Debugging |
|
| Parts of this applications are using the .NET runtime (Probably coded in C#) |
System Summary |
|
| Creates files inside the program directory |
System Summary |
|
| URLs found in memory or binary data |
Networking |
|
| May try to detect the Windows Explorer process (often used for injection) |
HIPS / PFW / Operating System Protection Evasion |
|
| .NET source code contains calls to encryption/decryption functions |
System Summary |
Deobfuscate/Decode Files or Information
|
| PE file contains a debug data directory |
System Summary |
|
| Contains modern PE file flags such as dynamic base (ASLR) or NX |
Compliance, System Summary |
|
| Submission file is bigger than most known malware samples |
System Summary |
|
| PE file contains a COM descriptor data directory |
System Summary |
|
| Uses Microsoft Silverlight |
System Summary |
|
|
|
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
|
| Category: |
dropped
|
| Dump: |
dhcpmon.exe.4.dr
|
| ID: |
dr_8
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
6.704936269736051
|
| Encrypted: |
false
|
| Ssdeep: |
12288:BGVMmLXxPgZ8Uqcozk9h5uRsOLNoJ86aA/qoUmdaee/QCaCNqGVM9d4dIw8:B1mRgZjqco49hKssoJ8tydLC/VIdkIt
|
| Size: |
1066496
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Injects a PE file into a foreign processes |
HIPS / PFW / Operating System Protection Evasion |
|
| Machine Learning detection for dropped file |
AV Detection |
|
| Contains long sleeps (>= 3 min) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Enables debug privileges |
Anti Debugging |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
| Contains medium sleeps (>= 30s) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Disables application error messsages (SetErrorMode) |
Hooking and other Techniques for Hiding and Protection |
|
| Parts of this applications are using the .NET runtime (Probably coded in C#) |
System Summary |
|
| Spawns processes |
System Summary |
|
|
|
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier
|
| Category: |
dropped
|
| Dump: |
dhcpmon.exe_Zone.Identifier.4.dr
|
| ID: |
dr_7
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
3.95006375643621
|
| Encrypted: |
false
|
| Ssdeep: |
3:ggPYV:rPYV
|
| Size: |
26
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Injects a PE file into a foreign processes |
HIPS / PFW / Operating System Protection Evasion |
|
| Machine Learning detection for dropped file |
AV Detection |
|
| Contains long sleeps (>= 3 min) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Enables debug privileges |
Anti Debugging |
|
| Queries the volume information (name, serial number etc) of a device |
Language, Device and Operating System Detection |
System Information Discovery
|
| Contains medium sleeps (>= 30s) |
Malware Analysis System Evasion |
Virtualization/Sandbox Evasion
|
| Disables application error messsages (SetErrorMode) |
Hooking and other Techniques for Hiding and Protection |
|
| Parts of this applications are using the .NET runtime (Probably coded in C#) |
System Summary |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\remittance.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\remittance.exe.log
|
| Category: |
dropped
|
| Dump: |
remittance.exe.log.0.dr
|
| ID: |
dr_2
|
| Target ID: |
0
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
5.355304211458859
|
| Encrypted: |
false
|
| Ssdeep: |
24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
|
| Size: |
1216
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Multi AV Scanner detection for submitted file |
AV Detection |
|
| Machine Learning detection for sample |
AV Detection |
|
| PE file contains strange resources |
System Summary |
|
| Sample file is different than original file name gathered from version info |
System Summary |
|
| Uses 32bit PE files |
Compliance, System Summary |
|
| PE file has an executable .text section and no other executable section |
System Summary |
|
| Parts of this applications are using the .NET runtime (Probably coded in C#) |
System Summary |
|
| Sample is known by Antivirus |
System Summary |
|
| PE file contains a debug data directory |
System Summary |
|
| Contains modern PE file flags such as dynamic base (ASLR) or NX |
Compliance, System Summary |
|
| PE file contains a COM descriptor data directory |
System Summary |
|
| Submission file is bigger than most known malware samples |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Temp\tmpAD34.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\tmpAD34.tmp
|
| Category: |
dropped
|
| Dump: |
tmpAD34.tmp.0.dr
|
| ID: |
dr_1
|
| Target ID: |
0
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1742056536028755
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBZtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3F
|
| Size: |
1659
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Sigma detected: Scheduled temp file as task from temp location |
Persistence and Installation Behavior |
|
| Uses schtasks.exe or at.exe to add and modify task schedules |
Boot Survival |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Creates temporary files |
System Summary |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
|
Non-ISO extended-ASCII text, with no line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
|
| Category: |
dropped
|
| Dump: |
run.dat.4.dr
|
| ID: |
dr_6
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
Non-ISO extended-ASCII text, with no line terminators
|
| Entropy: |
3.0
|
| Encrypted: |
false
|
| Ssdeep: |
3:tyt:k
|
| Size: |
8
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Sigma detected: NanoCore |
AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality |
|
|
|
C:\Users\user\AppData\Roaming\QgSBwlYTdt.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\QgSBwlYTdt.exe
|
| Category: |
dropped
|
| Dump: |
QgSBwlYTdt.exe.0.dr
|
| ID: |
dr_0
|
| Target ID: |
0
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
| Entropy: |
6.704936269736051
|
| Encrypted: |
false
|
| Ssdeep: |
12288:BGVMmLXxPgZ8Uqcozk9h5uRsOLNoJ86aA/qoUmdaee/QCaCNqGVM9d4dIw8:B1mRgZjqco49hKssoJ8tydLC/VIdkIt
|
| Size: |
1066496
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Machine Learning detection for dropped file |
AV Detection |
|
| Drops PE files |
Persistence and Installation Behavior |
|
| Creates files inside the user directory |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log
|
| Category: |
dropped
|
| Dump: |
dhcpmon.exe.log.19.dr
|
| ID: |
dr_16
|
| Target ID: |
19
|
| Process: |
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
|
| Type: |
ASCII text, with CRLF line terminators
|
| Entropy: |
5.355304211458859
|
| Encrypted: |
false
|
| Ssdeep: |
24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
|
| Size: |
1216
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Local\Temp\tmp264C.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\tmp264C.tmp
|
| Category: |
dropped
|
| Dump: |
tmp264C.tmp.16.dr
|
| ID: |
dr_13
|
| Target ID: |
16
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1742056536028755
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBZtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3F
|
| Size: |
1659
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Temp\tmp4136.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\tmp4136.tmp
|
| Category: |
dropped
|
| Dump: |
tmp4136.tmp.18.dr
|
| ID: |
dr_14
|
| Target ID: |
18
|
| Process: |
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1742056536028755
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBZtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3F
|
| Size: |
1659
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Temp\tmp5403.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\tmp5403.tmp
|
| Category: |
dropped
|
| Dump: |
tmp5403.tmp.19.dr
|
| ID: |
dr_15
|
| Target ID: |
19
|
| Process: |
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.1742056536028755
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBZtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3F
|
| Size: |
1659
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Temp\tmpB828.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\tmpB828.tmp
|
| Category: |
dropped
|
| Dump: |
tmpB828.tmp.4.dr
|
| ID: |
dr_9
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.083908227241512
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0Txtn:cbk4oL600QydbQxIYODOLedq3Mj
|
| Size: |
1304
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Local\Temp\tmpC057.tmp
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Local\Temp\tmpC057.tmp
|
| Category: |
dropped
|
| Dump: |
tmpC057.tmp.4.dr
|
| ID: |
dr_11
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
XML 1.0 document, ASCII text, with CRLF line terminators
|
| Entropy: |
5.109425792877704
|
| Encrypted: |
false
|
| Ssdeep: |
24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
|
| Size: |
1310
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
| Signature Hits |
Behavior Group |
Mitre Attack |
|
| Creates a process in suspended mode (likely to inject code) |
HIPS / PFW / Operating System Protection Evasion |
|
| Spawns processes |
System Summary |
|
|
|
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
|
| Category: |
dropped
|
| Dump: |
catalog.dat.4.dr
|
| ID: |
dr_12
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
data
|
| Entropy: |
7.024371743172393
|
| Encrypted: |
false
|
| Ssdeep: |
6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
|
| Size: |
232
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak
|
data
|
modified
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak
|
| Category: |
modified
|
| Dump: |
settings.bak.4.dr
|
| ID: |
dr_5
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
data
|
| Entropy: |
4.501629167387823
|
| Encrypted: |
false
|
| Ssdeep: |
3:9bzY6oRDIvYk:RzWDI3
|
| Size: |
24
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
|
| Category: |
dropped
|
| Dump: |
settings.bin.4.dr
|
| ID: |
dr_4
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
data
|
| Entropy: |
5.153055907333276
|
| Encrypted: |
false
|
| Ssdeep: |
3:9bzY6oRDT6P2bfVn1:RzWDT621
|
| Size: |
40
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
|
data
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
|
| Category: |
dropped
|
| Dump: |
storage.dat.4.dr
|
| ID: |
dr_3
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
data
|
| Entropy: |
7.99938831605763
|
| Encrypted: |
true
|
| Ssdeep: |
6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm
|
| Size: |
327432
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
|
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat
|
ASCII text, with no line terminators
|
dropped
|
|
|
|
| File: |
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat
|
| Category: |
dropped
|
| Dump: |
task.dat.4.dr
|
| ID: |
dr_10
|
| Target ID: |
4
|
| Process: |
C:\Users\user\Desktop\remittance.exe
|
| Type: |
ASCII text, with no line terminators
|
| Entropy: |
4.030567322750604
|
| Encrypted: |
false
|
| Ssdeep: |
3:oN0naRRXeELXJ:oNcSRuETJ
|
| Size: |
41
|
| Whitelisted: |
false
|
| Reputation: |
timeout
|
|
