| File name: | SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426 |
| Full analysis: | https://app.any.run/tasks/4e6c2c4d-2326-4611-8b3a-3e87769e4002 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | August 14, 2024, 04:31:00 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows |
| MD5: | 27C848CC8C3E2FA769E418FFC2BB5DFC |
| SHA1: | CFBC5F79E7C6D3A1A5CDDE28D3E3200A87C2F7E6 |
| SHA256: | 0371D6E1E7638E52AF5CDEF7265500EBD3426A0E3754AFCF0B4F431D30F2025C |
| SSDEEP: | 98304:yJ2eu17eOn/qbN/jFTVFPSEMe4GuzfckftbMF9pgduSeCysYgIOq1ynxUtM:i |
| .exe | | | InstallShield setup (57.6) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.9) |
| .exe | | | Generic Win/DOS Executable (2.6) |
| .exe | | | DOS Executable Generic (2.6) |
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:08:13 21:53:44+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.4 |
| CodeSize: | 1338880 |
| InitializedDataSize: | 1415168 |
| UninitializedDataSize: | 373248 |
| EntryPoint: | 0x6b668 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.3.389.34 |
| ProductVersionNumber: | 4.3.389.34 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Iso3166CountryName2TryPush |
| FileDescription: | Iso3166CountryName2TryPush |
| FileVersion: | 4.3.389.34 |
| InternalName: | Iso3166CountryName2TryPush.dll |
| LegalCopyright: | |
| OriginalFileName: | Iso3166CountryName2TryPush.dll |
| ProductName: | Iso3166CountryName2TryPush |
| ProductVersion: | 4.3.389.34 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6308 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | explorer.exe | ||||||||||||
User: admin Company: Iso3166CountryName2TryPush Integrity Level: MEDIUM Description: Iso3166CountryName2TryPush Exit code: 0 Version: 4.3.389.34 Modules
| |||||||||||||||
| 6332 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6432 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 4.8.9037.0 built by: NET481REL1 Modules
Remcos(PID) Process(6432) RegAsm.exe C2 (1)107.173.4.16:2560 Botnet2560 Options Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Install_HKLM\Winlogon\Shell100000 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueFalse Hide_fileFalse Mutex_nameRmc-L6F79W Keylog_flag1 Keylog_path%LOCALAPPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos | |||||||||||||||
| 6648 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /stext "C:\Users\admin\AppData\Local\Temp\uwjrtnyyhtesmv" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | RegAsm.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6656 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /stext "C:\Users\admin\AppData\Local\Temp\fqokufjzdbwfojgsir" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | RegAsm.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6664 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /stext "C:\Users\admin\AppData\Local\Temp\psucuxutrjokypuwrcdfl" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | RegAsm.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| (PID) Process: | (6308) SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426 |
Value: C:\Users\admin\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-L6F79W |
| Operation: | write | Name: | exepath |
Value: 2EB54A6F7F6B701883CDAFCCD001BBE9DD68E7777AE94BC4E1D7AE2C67F0401082D730845433F9B329E56BCAF5FAFE9A1F13940C41A50F2661B0FF7F929990E2866E7B8CE5EA361C2305D14CDC1FD9E94C2B5A56EF358A9364595313EDE16DFF3EEE79A5293485076FE64CB5439A07479B03 | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-L6F79W |
| Operation: | write | Name: | licence |
Value: 1F611B3E6C81BFDFFC9C054835043B6B | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-L6F79W |
| Operation: | write | Name: | time |
Value: | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6432) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6648 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\bhv5CF0.tmp | — | |
MD5:— | SHA256:— | |||
| 6308 | SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | C:\Users\admin\SecuriteInfo.com.W64.GenKryptik.MAGC.tr.15181.21426.exe | executable | |
MD5:27C848CC8C3E2FA769E418FFC2BB5DFC | SHA256:0371D6E1E7638E52AF5CDEF7265500EBD3426A0E3754AFCF0B4F431D30F2025C | |||
| 6432 | RegAsm.exe | C:\ProgramData\remcos\logs.dat | binary | |
MD5:5363784C1FD232E8975E48CD4D9F0BCB | SHA256:BA577D1AA67B6FEAD834CF0CF690D064B38E6CD7A334E97B410D155E85CB9036 | |||
| 6648 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\uwjrtnyyhtesmv | text | |
MD5:73AFEF57A57FF8285682E59AEBA8FE4A | SHA256:9081F636845E9A6B7D781F2F35A28B33B7FDF5373075B435C5B373119D0934A3 | |||
| 6432 | RegAsm.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\json[1].json | binary | |
MD5:16C93431FAF024A02448095CA90C27B3 | SHA256:47549520231BE8476CD1CBCD831C466C8C77F521BF5A69AE7D4626ED68869215 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6432 | RegAsm.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | whitelisted |
1948 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1948 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6988 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
7044 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4664 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1164 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6432 | RegAsm.exe | 107.173.4.16:2560 | — | AS-COLOCROSSING | US | malicious |
6432 | RegAsm.exe | 178.237.33.50:80 | geoplugin.net | Schuberg Philis B.V. | NL | unknown |
4664 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5336 | SearchApp.exe | 104.126.37.153:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
geoplugin.net |
| malicious |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
th.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6432 | RegAsm.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
6432 | RegAsm.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
6432 | RegAsm.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
6432 | RegAsm.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |