Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

xi0TpAxHGMsm.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.597245068665957
Filename:	xi0TpAxHGMsm.exe
Filesize:	494080
MD5:	effe954da69f8377295e43c84e48bd77
SHA1:	2cce76b35acab30714dcb56042808efbf05ae969
SHA256:	950b538fcf4aa8021867bce803c551b098b1481fc9b468772efb81f51c4c1c8c
SHA512:	280f3aba77d9815f4b2e81462a97751f399c4d73a07a5fb3812bb6594826a81fe5ac449cf53409f8d51b16a6e61b99162923a28c54a02171ce016935823448cc
SSDEEP:	6144:+XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNe5Gv:+X7tPMK8ctGe4Dzl4h2QnuPs/Zsvcv
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..- ..~ ..~ ..~.f$~3..~.f&~...~.f'~>..~).Q~!..~.Z.~"..~....:..~.......~.......~).F~9..~ ..~...~....D..~..*~!..~....!..~Rich ..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Found malware configuration	AV Detection	Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Machine Learning detection for sample	AV Detection
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary	Access Token Manipulation
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Executes visual basic scripts	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Might use command line arguments	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\Disk\Disk.dat

data

dropped

Details

File:	C:\ProgramData\Disk\Disk.dat
Category:	dropped
Dump:	Disk.dat.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Type:	data
Entropy:	3.340563546555108
Encrypted:	false
Ssdeep:	3:rhlKlFelZlNQlbU5JWRal2Jl+7R0DAlBG45klovDl6v:6lsZ4ZU5YcIeeDAlOWAv
Size:	144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json
Category:	dropped
Dump:	json[1].json.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Type:	JSON data
Entropy:	5.023626250399301
Encrypted:	false
Ssdeep:	12:tkeknd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkw7x:qPdRNuKyGX85jvXhNlT3/7AcV9Wro
Size:	965
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Temp\yghndvikdwwpc.vbs

data

modified

Details

File:	C:\Users\user\AppData\Local\Temp\yghndvikdwwpc.vbs
Category:	modified
Dump:	yghndvikdwwpc.vbs.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Type:	data
Entropy:	3.5058350384510923
Encrypted:	false
Ssdeep:	12:xQ4lA2++ugypjBQMPURXkXIM64Q3DMkXIM649Hz/0aimi:7a2+SDxgnQTMgn9Aait
Size:	492
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\xi0TpAxHGMsm.exe

"C:\Users\user\Desktop\xi0TpAxHGMsm.exe"

Details

Is windows:	false
Is dropped:	false
PID:	524
Target ID:	0
Parent PID:	4056
Name:	xi0TpAxHGMsm.exe
Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Commandline:	"C:\Users\user\Desktop\xi0TpAxHGMsm.exe"
Size:	494080
MD5:	EFFE954DA69F8377295E43C84E48BD77
Time:	00:35:54
Date:	03/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Sigma detected: Script Interpreter Execution From Suspicious Folder	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Sigma detected: WScript or CScript Dropper	System Summary
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Use Short Name Path in Command Line	System Summary
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\yghndvikdwwpc.vbs"

Details

Is windows:	true
Is dropped:	false
PID:	7224
Target ID:	12
Parent PID:	524
Name:	wscript.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\wscript.exe
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\yghndvikdwwpc.vbs"
Size:	147456
MD5:	FF00E0480075B095948000BDC66E81F0
Time:	00:36:06
Date:	03/05/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xdd0000
Modulesize:	159744
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Script Interpreter Execution From Suspicious Folder	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Sigma detected: WScript or CScript Dropper	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Use Short Name Path in Command Line	System Summary
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Executes visual basic scripts	System Summary	Scripting
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

sendfiletiahforem.duckdns.org

Details

Name:	sendfiletiahforem.duckdns.org
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpT

unknown

Details

Name:	http://geoplugin.net/json.gpT
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe, 00000000.00000003.1309821634.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1300373282.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1298720877.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1299993684.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1310649095.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1297771861.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1231048351.00000000006DD000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp7

unknown

Details

Name:	http://geoplugin.net/json.gp7
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe, 00000000.00000003.1309821634.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1300373282.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1298720877.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1299993684.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1310649095.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1297771861.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1231048351.00000000006DD000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpI

unknown

Details

Name:	http://geoplugin.net/json.gpI
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe, 00000000.00000003.1309821634.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1300373282.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1298720877.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1299993684.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1310649095.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1297771861.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1231048351.00000000006DD000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpSystem32

unknown

Details

Name:	http://geoplugin.net/json.gpSystem32
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe, 00000000.00000003.1309821634.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1300373282.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1298720877.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1299993684.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1310649095.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1297771861.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1231048351.00000000006DD000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpN

unknown

Details

Name:	http://geoplugin.net/json.gpN
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe, 00000000.00000003.1309821634.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1300373282.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1298720877.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1299993684.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1310649095.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1297771861.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1231048351.00000000006DD000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp-

unknown

Details

Name:	http://geoplugin.net/json.gp-
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Source:	xi0TpAxHGMsm.exe, 00000000.00000003.1309821634.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1300373282.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1298720877.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1299993684.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1310649095.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1297771861.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, xi0TpAxHGMsm.exe, 00000000.00000003.1231048351.00000000006DD000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
URLs found in memory or binary data	Networking

Domains

Name

Malicious

sendfiletiahforem.duckdns.org

85.60.29.68

Details

Name:	sendfiletiahforem.duckdns.org
IP:	85.60.29.68
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

85.60.29.68

sendfiletiahforem.duckdns.org

Spain

Details

IP:	85.60.29.68
TargetID:	0
Current Path:	C:\Users\user\Desktop\xi0TpAxHGMsm.exe
Country:	Spain
Countrycode:	ESP
ASN number:	12479
ASN name:	UNI2-ASES
Private:	false
Domain:	sendfiletiahforem.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Rmc-4QQORA

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-4QQORA

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-4QQORA

time

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

LangID

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Windows\System32\WScript.exe.FriendlyAppName

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Windows\System32\WScript.exe.ApplicationCompany

Memdumps

Base Address

Regiontype

Protect

Malicious

459000

unkown

page readonly

69E000

heap

page read and write

459000

unkown

page readonly

400000

unkown

page readonly

70F000

heap

page read and write

394F000

stack

page read and write

471000

unkown

page read and write

395C000

heap

page read and write

AE7000

heap

page read and write

216C000

stack

page read and write

AE6000

heap

page read and write

660000

heap

page read and write

B05000

heap

page read and write

702000

heap

page read and write

AD1000

heap

page read and write

718000

heap

page read and write

AFB000

heap

page read and write

AA8000

heap

page read and write

3C0C000

stack

page read and write

718000

heap

page read and write

70F000

heap

page read and write

AE1000

heap

page read and write

6CD000

heap

page read and write

2E70000

heap

page read and write

4872000

heap

page read and write

710000

heap

page read and write

6DD000

heap

page read and write

AFE000

heap

page read and write

718000

heap

page read and write

A98000

heap

page read and write

6DD000

heap

page read and write

ACE000

heap

page read and write

70F000

heap

page read and write

A30000

heap

page read and write

B04000

heap

page read and write

AB8000

heap

page read and write

718000

heap

page read and write

BC5000

heap

page read and write

5DE000

stack

page read and write

3956000

heap

page read and write

ADD000

heap

page read and write

7CB000

stack

page read and write

AF7000

heap

page read and write

728000

heap

page read and write

B00000

heap

page read and write

3700000

heap

page read and write

702000

heap

page read and write

4875000

heap

page read and write

355C000

stack

page read and write

AD7000

heap

page read and write

725000

heap

page read and write

4D90000

heap

page read and write

1F0000

heap

page read and write

4D90000

heap

page read and write

2C0E000

stack

page read and write

702000

heap

page read and write

AF7000

heap

page read and write

AD6000

heap

page read and write

278C000

stack

page read and write

AD1000

heap

page read and write

728000

heap

page read and write

AF5000

heap

page read and write

718000

heap

page read and write

702000

heap

page read and write

4D81000

heap

page read and write

711000

heap

page read and write

718000

heap

page read and write

AD1000

heap

page read and write

ADB000

heap

page read and write

702000

heap

page read and write

702000

heap

page read and write

AF0000

heap

page read and write

AD6000

heap

page read and write

3E56000

heap

page read and write

3D0D000

stack

page read and write

58A5000

heap

page read and write

69A000

heap

page read and write

711000

heap

page read and write

6CD000

heap

page read and write

702000

heap

page read and write

725000

heap

page read and write

AE1000

heap

page read and write

22CF000

stack

page read and write

AE3000

heap

page read and write

AB8000

heap

page read and write

36FC000

stack

page read and write

702000

heap

page read and write

2D0F000

stack

page read and write

725000

heap

page read and write

B04000

heap

page read and write

274F000

stack

page read and write

6DD000

heap

page read and write

AC1000

heap

page read and write

595000

heap

page read and write

AD4000

heap

page read and write

4D0E000

stack

page read and write

383E000

stack

page read and write

4D90000

heap

page read and write

6DD000

heap

page read and write

398C000

stack

page read and write

4F4F000

stack

page read and write

373B000

heap

page read and write

264E000

stack

page read and write

36BC000

stack

page read and write

3A8B000

stack

page read and write

5395000

heap

page read and write

2EF0000

heap

page read and write

AF4000

heap

page read and write

288F000

stack

page read and write

ACB000

heap

page read and write

30FF000

stack

page read and write

2E3E000

stack

page read and write

AE9000

heap

page read and write

ADC000

heap

page read and write

A7E000

stack

page read and write

6D4000

heap

page read and write

337E000

stack

page read and write

6CD000

heap

page read and write

4D80000

heap

page read and write

4D90000

heap

page read and write

478000

unkown

page readonly

2E4F000

stack

page read and write

250E000

stack

page read and write

AFF000

heap

page read and write

A80000

heap

page read and write

21AC000

stack

page read and write

401000

unkown

page execute read

3730000

heap

page read and write

AE4000

heap

page read and write

AC1000

heap

page read and write

2D4E000

stack

page read and write

2E8E000

stack

page read and write

718000

heap

page read and write

4D81000

heap

page read and write

9C000

stack

page read and write

711000

heap

page read and write

260F000

stack

page read and write

711000

heap

page read and write

D9E000

stack

page read and write

4E8A000

heap

page read and write

AF9000

heap

page read and write

70F000

heap

page read and write

24CF000

stack

page read and write

560000

heap

page read and write

AC1000

heap

page read and write

4365000

heap

page read and write

6DD000

heap

page read and write

65E000

stack

page read and write

4E0F000

stack

page read and write

710000

heap

page read and write

61E000

stack

page read and write

AD1000

heap

page read and write

6CB000

stack

page read and write

AFF000

heap

page read and write

4D81000

heap

page read and write

ADE000

heap

page read and write

AED000

heap

page read and write

AD1000

heap

page read and write

98F000

stack

page read and write

AF3000

heap

page read and write

ACF000

heap

page read and write

AB8000

heap

page read and write

6EDF1000

unkown

page execute read

AEC000

heap

page read and write

AE7000

heap

page read and write

2FFE000

stack

page read and write

702000

heap

page read and write

6DD000

heap

page read and write

471000

unkown

page write copy

AFF000

heap

page read and write

725000

heap

page read and write

6EDF0000

unkown

page readonly

AE3000

heap

page read and write

3840000

heap

page read and write

AF8000

heap

page read and write

718000

heap

page read and write

AF5000

heap

page read and write

436A000

heap

page read and write

ACD000

heap

page read and write

AE1000

heap

page read and write

2EFA000

heap

page read and write

6DD000

heap

page read and write

AE3000

heap

page read and write

479E000

stack

page read and write

3952000

heap

page read and write

AE5000

heap

page read and write

6CD000

heap

page read and write

34BB000

stack

page read and write

718000

heap

page read and write

327E000

stack

page read and write

19C000

stack

page read and write

AFB000

heap

page read and write

6EE06000

unkown

page readonly

6EE0D000

unkown

page read and write

AC0000

heap

page read and write

B03000

heap

page read and write

6CD000

heap

page read and write

2E50000

heap

page read and write

718000

heap

page read and write

A90000

heap

page read and write

725000

heap

page read and write

AD2000

heap

page read and write

AA5000

heap

page read and write

323E000

stack

page read and write

33BE000

stack

page read and write

313E000

stack

page read and write

474000

unkown

page read and write

AEB000

heap

page read and write

B03000

heap

page read and write

4D90000

heap

page read and write

AE3000

heap

page read and write

AE9000

heap

page read and write

401000

unkown

page execute read

478000

unkown

page readonly

718000

heap

page read and write

6EE0F000

unkown

page readonly

4F50000

heap

page read and write

2F8F000

stack

page read and write

590000

heap

page read and write

6DD000

heap

page read and write

AF5000

heap

page read and write

690000

heap

page read and write

4E4E000

stack

page read and write

88E000

stack

page read and write

365E000

stack

page read and write

6DD000

heap

page read and write

AFE000

heap

page read and write

AE5000

heap

page read and write

21C7000

heap

page read and write

BC0000

heap

page read and write

23CF000

stack

page read and write

718000

heap

page read and write

400000

unkown

page readonly

702000

heap

page read and write

718000

heap

page read and write

AD9000

heap

page read and write

21C0000

heap

page read and write

3E52000

heap

page read and write

72A000

heap

page read and write

There are 229 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
xi0TpAxHGMsm.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportxi0TpAxHGMsm.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
xi0TpAxHGMsm.exe