File name:

10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.zip

Full analysis: https://app.any.run/tasks/b78ec061-5d47-4a79-834b-397b10b508b0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: April 08, 2025, 09:39:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
remcos
remote
stealer
arch-exec
mpress
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

14EDA1AF220008D333EE3E21E53F97D6

SHA1:

CB29E79F2418DBB83CA2F827A386E0C30B3A0AFA

SHA256:

0B5E7D9C0C748A38C8C1555E5B68C7C9071C0BA185B3ED2AC2792DFCAB9114B5

SSDEEP:

24576:kC5Tpsi3ElOEEF8ed/cqCc+bq4AMfWKUcXDoIzG6Ihhm9FSE3dD0A7YQdWX6ul9r:kC5Tpsi3ElOEEF8ed/cqCc+bq4AMOKUl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • REMCOS has been detected (SURICATA)

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • REMCOS has been detected

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • REMCOS mutex has been found

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • Steals credentials from Web Browsers

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • recover.exe (PID: 5124)
    • Actions looks like stealing of personal data

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • chrome.exe (PID: 6268)
      • recover.exe (PID: 6036)
      • recover.exe (PID: 3676)
      • recover.exe (PID: 5124)
      • msedge.exe (PID: 960)
    • REMCOS has been detected (YARA)

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
  • SUSPICIOUS

    • Application launched itself

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
      • chrome.exe (PID: 6268)
      • msedge.exe (PID: 960)
    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6372)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • Creates file in the systems drive root

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
    • Contacting a server suspected of hosting an CnC

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • Connects to unusual port

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • There is functionality for taking screenshot (YARA)

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
    • Executable content was dropped or overwritten

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
    • The process creates files with name similar to system file names

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6372)
    • The sample compiled with english language support

      • WinRAR.exe (PID: 6372)
    • Reads the machine GUID from the registry

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • chrome.exe (PID: 6268)
      • msedge.exe (PID: 960)
    • Checks supported languages

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • chrome.exe (PID: 6268)
      • msedge.exe (PID: 960)
    • Create files in a temporary directory

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • recover.exe (PID: 5124)
      • recover.exe (PID: 6036)
      • recover.exe (PID: 3676)
      • chrome.exe (PID: 6268)
    • Checks proxy server information

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • chrome.exe (PID: 6268)
      • msedge.exe (PID: 960)
      • slui.exe (PID: 5008)
    • Creates files or folders in the user directory

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
    • Reads the software policy settings

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • slui.exe (PID: 728)
      • slui.exe (PID: 5008)
    • Reads the computer name

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
      • chrome.exe (PID: 6268)
      • msedge.exe (PID: 960)
      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 2284)
    • Reads Environment values

      • chrome.exe (PID: 6268)
      • msedge.exe (PID: 960)
    • Manual execution by a user

      • Taskmgr.exe (PID: 5364)
      • Taskmgr.exe (PID: 4696)
    • Mpress packer has been detected

      • 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe (PID: 4976)
    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 5364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:08 09:39:06
ZipCRC: 0x0e5a5881
ZipCompressedSize: 767836
ZipUncompressedSize: 785904
ZipFileName: 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
19
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe #REMCOS 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe conhost.exe no specs chrome.exe recover.exe recover.exe recover.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs slui.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
812C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
960--user-data-dir=C:\Users\admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2284"C:\Users\admin\AppData\Local\Temp\Rar$EXb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
WinRAR.exe
User:
admin
Company:
bagroom derhenne
Integrity Level:
MEDIUM
Description:
kvikkens slappest imer
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2644"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --mojo-platform-channel-handle=1460 --field-trial-handle=1464,i,6309272196540985791,6928975168315839727,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3676C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\kasxemztedggzrvl"C:\Windows\SysWOW64\recover.exe
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Recover Files Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\recover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
3896"C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\TmpUserData\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc8a01dc40,0x7ffc8a01dc4c,0x7ffc8a01dc58C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4696"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
4844"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1744 --field-trial-handle=1440,i,4504210239374256591,156183329167518833,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4976"C:\Users\admin\AppData\Local\Temp\Rar$EXb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
User:
admin
Company:
bagroom derhenne
Integrity Level:
MEDIUM
Description:
kvikkens slappest imer
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
8 115
Read events
8 074
Write events
40
Delete events
1

Modification events

(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2284) 10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeKey:HKEY_CURRENT_USER\unimbibing\Uninstall\Godkendelsesbehandling\kabelbrndens
Operation:writeName:sidehngtes
Value:
1
Executable files
2
Suspicious files
19
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
228410a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\Yatagan\Whitenose\slaskende.arb
MD5:
SHA256:
228410a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\Yatagan\Whitenose\vandpaafyldning.nuc
MD5:
SHA256:
228410a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\AppData\Local\Temp\nslEC66.tmp
MD5:
SHA256:
228410a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\Yatagan\Fladbrds.jpgbinary
MD5:1F48026DF6E9E4AEBC2867CB2A07A07D
SHA256:994252C8960CF2A4008C57BB64C39A18937638230293DB1CA2CBC7BC63FC8BA5
6372WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6372.48147\10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeexecutable
MD5:CC862C2F4F9E036C2CDE30DE73A296B1
SHA256:10A73F1DCA53508CD3AEC1B755DCB0DA00B1CC0841273D1A7AF4ECFBFEA09E25
5124recover.exeC:\Users\admin\AppData\Local\Temp\bhv4DFE.tmp
MD5:
SHA256:
497610a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
228410a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\Yatagan\Whitenose\Lynnedslagene78.txttext
MD5:993AA8CF29DAA3B30C4A3CE63083900A
SHA256:A86336440B3752084EF9CC33C2E6A5F2C513AAA830C71342759702722E8FC139
228410a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\Yatagan\Skohornenes.Forbinary
MD5:06EC34E5A7DC307EDA639C7E5699ADF0
SHA256:D063DBCFC5746FC46AAF6DCF1D14582A8BB0A7A8AFA73E966F43133DC70601AD
497610a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B5FC60CCA5D8CF767A7572C65728CD6_99D27CBA0D4B68C894F658C49157FD99der
MD5:E4C9817793669DBFB9F9E33B6054E224
SHA256:0148C56F5BD673AD05BD1E152F02CC42AA5174375F5AEB441F6ED9C2C231E295
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
30
DNS requests
21
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4120
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
4120
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/r4.crl
unknown
whitelisted
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
GET
200
142.250.186.131:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQCaWeNpIFSBzAkvnnFNzwtC
unknown
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
GET
200
142.250.186.131:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQDHi9aO%2BrLYIArv8VY0Y8O5
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4120
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4120
SIHClient.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.67
  • 20.190.160.65
  • 40.126.32.136
  • 20.190.160.132
  • 20.190.160.131
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
drive.google.com
  • 142.250.186.46
whitelisted

Threats

PID
Process
Class
Message
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4976
10a73f1dca53508cd3aec1b755dcb0da00b1cc0841273d1a7af4ecfbfea09e25.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info