xKtzvdEoDAjLmvN.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Nov. 11, 2024, 9:40 a.m. | Nov. 11, 2024, 9:57 a.m. |
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\xKtzvdEoDAjLmvN.exe"
2436 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\uXVGwksuXiVBy.exe"
2496 -
schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmpF69F.tmp"
2556 -
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
2992 -
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\uXVGwksuXiVBy.exe"
3040 -
schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmp34C2.tmp"
2104 -
-
-
-
iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:145409
2800 -
iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:79875
2980
-
-
-
svchost.exe svchost.exe
2132 -
svchost.exe svchost.exe
2404
-
-
-
-
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| pdb_path | VCV.pdb |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmpF69F.tmp" |
| cmdline | schtasks.exe /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmpF69F.tmp" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\xKtzvdEoDAjLmvN.exe" |
| cmdline | http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\uXVGwksuXiVBy.exe" |
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmp34C2.tmp" |
| cmdline | powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\uXVGwksuXiVBy.exe" |
| cmdline | powershell Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe" |
| cmdline | schtasks.exe /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmp34C2.tmp" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe" |
| cmdline | svchost.exe |
| cmdline | powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\xKtzvdEoDAjLmvN.exe" |
| section | {u'size_of_data': u'0x00103200', u'virtual_address': u'0x00002000', u'entropy': 7.763201519088053, u'name': u'.text', u'virtual_size': u'0x001031f0'} | entropy | 7.76320151909 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.997593840231 | description | Overall entropy of this PE file is high | |||||||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Client_SW_User_Data_Stealer | rule | Client_SW_User_Data_Stealer | ||||||
| description | Win Backdoor RemcosRAT | rule | Win_Backdoor_RemcosRAT | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | browser info stealer | rule | infoStealer_browser_Zero | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Google Chrome User Data Check | rule | Chrome_User_Data_Check_Zero | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Client_SW_User_Data_Stealer | rule | Client_SW_User_Data_Stealer | ||||||
| description | Win Backdoor RemcosRAT | rule | Win_Backdoor_RemcosRAT | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | browser info stealer | rule | infoStealer_browser_Zero | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Google Chrome User Data Check | rule | Chrome_User_Data_Check_Zero | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmpF69F.tmp" |
| cmdline | "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:145409 |
| cmdline | schtasks.exe /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmpF69F.tmp" |
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmp34C2.tmp" |
| cmdline | schtasks.exe /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmp34C2.tmp" |
| cmdline | "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:79875 |
| cmdline | "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome |
| host | 66.63.162.79 | |||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M | reg_value | "C:\ProgramData\Remcos\remcos.exe" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M | reg_value | "C:\ProgramData\Remcos\remcos.exe" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M | reg_value | "C:\ProgramData\Remcos\remcos.exe" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-1CY96M | reg_value | "C:\ProgramData\Remcos\remcos.exe" | ||||||
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob |
| dead_host | 66.63.162.79:2404 |
| Bkav | W32.AIDetectMalware.CS |
| Lionic | Trojan.Win32.Taskun.4!c |
| CAT-QuickHeal | Trojan.MSIL |
| Skyhigh | BehavesLike.Win32.Generic.tc |
| ALYac | Trojan.Generic.36939444 |
| Cylance | Unsafe |
| VIPRE | Trojan.Generic.36939444 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| BitDefender | Trojan.Generic.36939444 |
| K7GW | Trojan ( 005b44a91 ) |
| K7AntiVirus | Trojan ( 005b44a91 ) |
| Arcabit | Trojan.Generic.D233A6B4 |
| VirIT | Trojan.Win32.GenusT.ECTL |
| Symantec | Scr.Malcode!gdn34 |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of MSIL/Kryptik.AMPS |
| APEX | Malicious |
| Avast | Win32:MalwareX-gen [Trj] |
| Kaspersky | HEUR:Trojan.MSIL.Taskun.gen |
| Alibaba | Trojan:MSIL/Formbook.86691afa |
| NANO-Antivirus | Trojan.Win32.Taskun.ktgued |
| MicroWorld-eScan | Trojan.Generic.36939444 |
| Rising | Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:TMU51YxV0HAvcXnsEeWLHw) |
| Emsisoft | Trojan.Generic.36939444 (B) |
| F-Secure | Trojan.TR/Kryptik.yewxd |
| McAfeeD | ti!E791665F9DF5 |
| CTX | exe.trojan.msil |
| Sophos | Mal/Generic-S |
| SentinelOne | Static AI - Malicious PE |
| FireEye | Generic.mg.9d246f5e01f060fe |
| Detected | |
| Avira | TR/Kryptik.yewxd |
| Antiy-AVL | Trojan/MSIL.Taskun |
| Kingsoft | MSIL.Trojan.Taskun.gen |
| Gridinsoft | Ransom.Win32.Wacatac.sa |
| Xcitium | Malware@#prtwplthv45u |
| Microsoft | Trojan:MSIL/Formbook.PNYH!MTB |
| ZoneAlarm | UDS:DangerousObject.Multi.Generic |
| GData | Trojan.Generic.36939444 |
| Varist | W32/MSIL_Kryptik.KQK.gen!Eldorado |
| AhnLab-V3 | Trojan/Win.FormBook.C5690737 |
| McAfee | Artemis!9D246F5E01F0 |
| DeepInstinct | MALICIOUS |
| Malwarebytes | Trojan.MalPack.PNG.Generic |
| Ikarus | Trojan-Spy.Agent |
| Panda | Trj/GdSda.A |
| Tencent | Malware.Win32.Gencirc.142021a8 |
| huorong | HEUR:TrojanSpy/MSIL.AgentTesla.sl |
| MaxSecure | Trojan.Malware.74644571.susgen |
| Fortinet | MSIL/GenKryptik.GWRN!tr |