File name:

PO 1100620230526.pdf(39kb).exe

Full analysis: https://app.any.run/tasks/1170531a-7d6e-4799-abb2-e646b70969ab
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: October 31, 2023, 16:29:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
remcos
remote
stealer
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

26B43CADF6622B3D0E50BF3763CC5180

SHA1:

D84D2F83975F74767E7D398E8AD039BE00C47598

SHA256:

089FE1A7004A07E2FA5A8E706359B2D8D0B141BBC4719DB9BC378E33B0771764

SSDEEP:

98304:JAfNIZvLksWM2Vc+yjMU93QAvg9DJRNW8J/VCzjHeMiourz+9Vh3LS5wdZoCacgz:A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • CasPol.exe (PID: 2424)
      • CasPol.exe (PID: 1556)
      • CasPol.exe (PID: 3056)
      • CasPol.exe (PID: 2892)
      • CasPol.exe (PID: 2680)
      • CasPol.exe (PID: 2412)
      • CasPol.exe (PID: 2688)

    • UAC/LUA settings modification

      • Iserver.exe (PID: 2728)
      • Iserver.exe (PID: 1924)

    • Steals credentials from Web Browsers

      • CasPol.exe (PID: 2892)
      • CasPol.exe (PID: 2412)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2868)
      • CasPol.exe (PID: 2688)

    • REMCOS has been detected (SURICATA)

      • CasPol.exe (PID: 2688)

    • Steals credentials

      • CasPol.exe (PID: 2892)
      • CasPol.exe (PID: 2424)
      • CasPol.exe (PID: 2680)
      • CasPol.exe (PID: 2412)

    • Uses NirSoft utilities to collect credentials

      • CasPol.exe (PID: 2892)
      • CasPol.exe (PID: 2424)
      • CasPol.exe (PID: 2680)
      • CasPol.exe (PID: 2412)

    • REMCOS has been detected (YARA)

      • CasPol.exe (PID: 2688)

    • Remcos is detected

      • CasPol.exe (PID: 2688)

  • SUSPICIOUS

    • Reads the Internet Settings

      • CasPol.exe (PID: 2688)

    • Reads browser cookies

      • CasPol.exe (PID: 2688)

    • Accesses Microsoft Outlook profiles

      • CasPol.exe (PID: 2424)
      • CasPol.exe (PID: 2680)

    • Connects to unusual port

      • CasPol.exe (PID: 2688)
      • iexplore.exe (PID: 2868)

    • Writes files like Keylogger logs

      • CasPol.exe (PID: 2688)

    • Application launched itself

      • CasPol.exe (PID: 2688)

  • INFO

    • Reads the machine GUID from the registry

      • PO 1100620230526.pdf(39kb).exe (PID: 2328)
      • CasPol.exe (PID: 2688)
      • Iserver.exe (PID: 2728)
      • CasPol.exe (PID: 1556)
      • CasPol.exe (PID: 2892)
      • CasPol.exe (PID: 3056)
      • Iserver.exe (PID: 1924)
      • CasPol.exe (PID: 2412)

    • Checks supported languages

      • PO 1100620230526.pdf(39kb).exe (PID: 2328)
      • CasPol.exe (PID: 2688)
      • Iserver.exe (PID: 2728)
      • iexplore.exe (PID: 2868)
      • CasPol.exe (PID: 2412)
      • CasPol.exe (PID: 2680)
      • CasPol.exe (PID: 3056)
      • Iserver.exe (PID: 1924)
      • CasPol.exe (PID: 2892)
      • CasPol.exe (PID: 1556)
      • CasPol.exe (PID: 2424)

    • Reads the computer name

      • CasPol.exe (PID: 2688)
      • PO 1100620230526.pdf(39kb).exe (PID: 2328)
      • CasPol.exe (PID: 1556)
      • CasPol.exe (PID: 2424)
      • CasPol.exe (PID: 2892)
      • iexplore.exe (PID: 2868)
      • CasPol.exe (PID: 3056)
      • CasPol.exe (PID: 2412)
      • CasPol.exe (PID: 2680)

    • Reads Environment values

      • CasPol.exe (PID: 2688)

    • Checks proxy server information

      • CasPol.exe (PID: 2688)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 2688)
      • iexplore.exe (PID: 2868)

    • Create files in a temporary directory

      • CasPol.exe (PID: 2688)
      • CasPol.exe (PID: 1556)
      • CasPol.exe (PID: 2892)
      • Iserver.exe (PID: 2728)
      • iexplore.exe (PID: 2868)
      • CasPol.exe (PID: 2424)
      • CasPol.exe (PID: 2680)
      • CasPol.exe (PID: 3056)
      • CasPol.exe (PID: 2412)
      • Iserver.exe (PID: 1924)

    • Creates files in the program directory

      • CasPol.exe (PID: 2688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2688) CasPol.exe
C2 (2)cloudhost.myfirewall.org:9302
sandshoe.myfirewall.org:2404
BotnetHARD
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%TEMP%
Copy_fileWindowUpdate.exe
Startup_valueFalse
Hide_fileTrue
Mutex_nameRmcqSxe-3TCTRL
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:07:14 00:47:16+02:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 104448
InitializedDataSize: 1722880
UninitializedDataSize: -
EntryPoint: 0xcd2f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: MKkI9887
FileVersion: 1.0.0.0
InternalName: MKkI9887.exe
LegalCopyright: Copyright © 2023
LegalTrademarks: -
OriginalFileName: MKkI9887.exe
ProductName: MKkI9887
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
24
Malicious processes
7
Suspicious processes
4

Behavior graph

Click at the process to see the details
start po 1100620230526.pdf(39kb).exe no specs caspol.exe no specs caspol.exe no specs caspol.exe no specs #REMCOS caspol.exe iserver.exe no specs caspol.exe no specs caspol.exe no specs caspol.exe caspol.exe no specs caspol.exe no specs caspol.exe caspol.exe no specs caspol.exe caspol.exe no specs iserver.exe iexplore.exe caspol.exe caspol.exe no specs caspol.exe caspol.exe no specs caspol.exe iserver.exe no specs iserver.exe

Process information

PID
CMD
Path
Indicators
Parent process
568C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\admin\AppData\Local\Temp\kwbzxpc"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—CasPol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
0
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
980"C:\Users\admin\AppData\Local\Temp\Iserver.exe" C:\Users\admin\AppData\Local\Temp\Iserver.exe—CasPol.exe
User:
admin
Company:
Abronsius
Integrity Level:
MEDIUM
Description:
Update
Exit code:
3221226540
Version:
3.00.0010
Modules
Images
c:\users\admin\appdata\local\temp\iserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1156C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\admin\AppData\Local\Temp\fpsdgesyg"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—CasPol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
0
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1172"C:\Users\admin\AppData\Local\Temp\Iserver.exe" C:\Users\admin\AppData\Local\Temp\Iserver.exe—CasPol.exe
User:
admin
Company:
Abronsius
Integrity Level:
MEDIUM
Description:
Update
Exit code:
3221226540
Version:
3.00.0010
Modules
Images
c:\users\admin\appdata\local\temp\iserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1556C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\admin\AppData\Local\Temp\uqpsyhnzus"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
CasPol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
0
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1612C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\admin\AppData\Local\Temp\kwbzxpc"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—CasPol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
0
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1660C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\admin\AppData\Local\Temp\uqpsyhnzus"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—CasPol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
0
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1924"C:\Users\admin\AppData\Local\Temp\Iserver.exe" C:\Users\admin\AppData\Local\Temp\Iserver.exe
CasPol.exe
User:
admin
Company:
Abronsius
Integrity Level:
HIGH
Description:
Update
Exit code:
0
Version:
3.00.0010
Modules
Images
c:\users\admin\appdata\local\temp\iserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2328"C:\Users\admin\AppData\Local\Temp\PO 1100620230526.pdf(39kb).exe" C:\Users\admin\AppData\Local\Temp\PO 1100620230526.pdf(39kb).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
MKkI9887
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\po 1100620230526.pdf(39kb).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2348"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—PO 1100620230526.pdf(39kb).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
4294967295
Version:
4.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
1 664
Read events
1 649
Write events
15
Delete events
0

Modification events

(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2688) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2728) Iserver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
1
(PID) Process:(1924) Iserver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center
Operation:writeName:UACDisableNotify
Value:
0
Executable files
2
Suspicious files
5
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2892CasPol.exeC:\Users\admin\AppData\Local\Temp\bhvA81D.tmp —
MD5:—
SHA256:—
2412CasPol.exeC:\Users\admin\AppData\Local\Temp\bhvE8FA.tmp —
MD5:—
SHA256:—
2688CasPol.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\json[1].jsonbinary
MD5:2E92FB60FD68A06D7AFB23A4C7EC5F40
SHA256:01E00E89117AC2684F8D29BE709B1C6C00E85AB2697222A18E7A18C217D9D9C2
2688CasPol.exeC:\Users\admin\AppData\Local\Temp\Iserver.exeexecutable
MD5:98DBA4873D2B9B467158400540B5EEBE
SHA256:7532708EB8B2150FC58FF178790F86AB88F1352F82DCF450500ABD52B92F64F4
2892CasPol.exeC:\Users\admin\AppData\Local\Temp\iuwptext
MD5:2D9139D0CBF8301AE9DAD9173A0A6357
SHA256:2AFE12053A281037E21B2C83109E366E151B4848E9D5357E7B5AE6100CC1C481
2688CasPol.exeC:\ProgramData\remcos\logs.datbinary
MD5:E27227B9BECE7CC5020BFF1CD08F7591
SHA256:95FA17946869DE4053F3D5DDDE2050F51F38E60E647DE98E25D1ECC1C484AC61
2424CasPol.exeC:\Users\admin\AppData\Local\Temp\kwbzxpctext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
2688CasPol.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\json[1].jsonbinary
MD5:2E92FB60FD68A06D7AFB23A4C7EC5F40
SHA256:01E00E89117AC2684F8D29BE709B1C6C00E85AB2697222A18E7A18C217D9D9C2
2680CasPol.exeC:\Users\admin\AppData\Local\Temp\vnnsftext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
2412CasPol.exeC:\Users\admin\AppData\Local\Temp\ssiaftxdxokbuwkgazpbncofknulragidtext
MD5:2D9139D0CBF8301AE9DAD9173A0A6357
SHA256:2AFE12053A281037E21B2C83109E366E151B4848E9D5357E7B5AE6100CC1C481
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
23
DNS requests
7
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2688
CasPol.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
950 b
unknown
2688
CasPol.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
950 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2688
CasPol.exe
79.110.48.151:9302
cloudhost.myfirewall.org
ASN-QUADRANET-GLOBAL
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2688
CasPol.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
unknown
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2868
iexplore.exe
79.110.48.151:5344
cloudhost.myfirewall.org
ASN-QUADRANET-GLOBAL
US
unknown
2688
CasPol.exe
79.110.48.151:2404
cloudhost.myfirewall.org
ASN-QUADRANET-GLOBAL
US
unknown

DNS requests

Domain
IP
Reputation
cloudhost.myfirewall.org
  • 79.110.48.151
malicious
geoplugin.net
  • 178.237.33.50
malicious
sandshoe.myfirewall.org
  • 79.110.48.151
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to DDNS Domain .myfirewall .org
2688
CasPol.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2688
CasPol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2688
CasPol.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2688
CasPol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2688
CasPol.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2688
CasPol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2688
CasPol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2688
CasPol.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to DDNS Domain .myfirewall .org
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PO 1100620230526.pdf(39kb).exe