848rat_c1bc60587353e61f9ed04b1269eb0afb_jpg_2019-09-03_18_30.txt

* ID: 848
* MalFamily: "Remcos"

* MalScore: 10.0

* File Name: "rat_c1bc60587353e61f9ed04b1269eb0afb.jpg"
* File Size: 1064960
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "fa9a94b32f7fa1e1e3eef63d3fb9003fda8d295e1f1a3e521691725e4c7da9f3"
* MD5: "c1bc60587353e61f9ed04b1269eb0afb"
* SHA1: "b8fa6fbd4d3d08c2a8b89460c9e7fd4e7094d962"
* SHA512: "1ec653c03b257bfe1ba5fb08890d861d78bbc106fccb60668f007cfa5c28765eaeab7ee163f63c240387bcb2c240df42f029a4fafc18be59bbba1ceaa9718e0e"
* CRC32: "3A83E124"
* SSDEEP: "12288:3Mr6y90gD5M+gpgHDEkaNr4KhhbRG+0nrjrl+5cPFSqE+2Oy:Ny1adpylaVy+mZ+CMqE+25"

* Process Execution:
    "FuBsFjslImXuq.exe",
    "REMCOS~4.EXE",
    "FO.exe",
    "explorer.exe"


* Executed Commands:
    "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE",
    "\"C:\\Users\\user\\Jos5\\FO.exe\"",
    "C:\\Users\\user\\Jos5\\FO.exe "


* Signatures Detected:

        "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
        "Details":


        "Description": "Behavioural detection: Executable code extraction",
        "Details":


        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "REMCOS~4.EXE, PID 2680"




        "Description": "A process attempted to delay the analysis task.",
        "Details":

                "Process": "FO.exe tried to sleep 686 seconds, actually delayed analysis time by 0 seconds"




        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: REMCOS~4.EXE, pid: 2680, offset: 0x00000000, length: 0x17e2f401"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\Jos5\\FO.exe"


                "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup0"


                "data": "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\\""


                "file": "C:\\Windows\\win.ini"


                "file": "C:\\Windows\\win.ini"




        "Description": "File has been identified by 14 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "Generic.mg.c1bc60587353e61f"


                "Cylance": "Unsafe"


                "Cybereason": "malicious.d4d3d0"


                "Invincea": "heuristic"


                "APEX": "Malicious"


                "F-Secure": "Trojan.TR/Dropper.Gen"


                "Paloalto": "generic.ml"


                "Jiangmin": "Trojan-PSW.Azorult.b"


                "Avira": "TR/Dropper.Gen"


                "Antiy-AVL": "TrojanArcBomb/Win32.Agent"


                "Endgame": "malicious (moderate confidence)"


                "Ikarus": "Trojan-Spy.Agent"


                "AVG": "FileRepMetagen Malware"


                "Qihoo-360": "HEUR/QVM20.1.A4BB.Malware.Gen"




        "Description": "Created network traffic indicative of malicious activity",
        "Details":

                "signature": "ET TROJAN Remcos RAT Checkin 23"





* Started Service:

* Mutexes:
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Remcos_Mutex_Inj",
    "Remcos-HW1SL4"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\TMP4351$.TMP",
    "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFEF792AADDFC26563.TMP",
    "C:\\Windows\\win.ini",
    "C:\\Users\\user\\Jos5\\FO.exe",
    "C:\\Users\\user\\Jos5\\FO.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFDD99D3E034AF7864.TMP"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP",
    "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\REMCOS~4.EXE",
    "C:\\Users\\user\\AppData\\Local\\Temp\\IXP000.TMP\\"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Remcos-HW1SL4\\",
    "HKEY_CURRENT_USER\\Software\\Remcos-HW1SL4\\exepath",
    "HKEY_CURRENT_USER\\Software\\Remcos-HW1SL4\\licence"


* Deleted Registry Keys:
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup0"


* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

        "country_name": "Ukraine",
        "ip": "37.19.193.217",
        "inaddrarpa": "",
        "hostname": ""



* Network Communication - IRC: