analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO_Excelcuts.img

Full analysis: https://app.any.run/tasks/b090b164-bf10-4da8-9b74-bef94e71a97f
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: June 18, 2019, 17:07:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
keylogger
Indicators:
MIME: application/x-iso9660-image
File info: UDF filesystem data (version 1.5) 'DESKTOP'
MD5:

C5CB1F35DF79F12C926E14CF421E8430

SHA1:

138FC9FA9F854DFBF7C9F3DDDA763530B2ADF4E1

SHA256:

0DDD16DAF26F6A789A47995AB3F2A528811DEAB44F9712C949F71B21CA76E7B6

SSDEEP:

6144:CkTm/VfalYyf2dZKHUuM7gJiFrlEVfZUc4PInPq9kd2x4JmTX7QAmaY4CeGzb:DsfaC62MmFr4mc/Fd2agTrQAm4BG3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PO_Excelcuts.exe (PID: 2960)
      • filename.exe (PID: 2104)
      • filename.exe (PID: 2632)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2576)

    • REMCOS RAT was detected

      • filename.exe (PID: 2104)

    • Detected logs from REMCOS RAT

      • filename.exe (PID: 2104)

  • SUSPICIOUS

    • Starts itself from another location

      • PO_Excelcuts.exe (PID: 2960)

    • Executable content was dropped or overwritten

      • PO_Excelcuts.exe (PID: 2960)
      • WinRAR.exe (PID: 3472)

    • Executes scripts

      • PO_Excelcuts.exe (PID: 2960)

    • Application launched itself

      • filename.exe (PID: 2632)

    • Creates files in the user directory

      • filename.exe (PID: 2104)

    • Writes files like Keylogger logs

      • filename.exe (PID: 2104)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

Composite

VolumeSize: 1198 kB

ISO

VolumeModifyDate: 2019:06:18 09:22:25.00+02:00
VolumeCreateDate: 2019:06:18 09:22:25.00+02:00
Software: IMGBURN V2.5.8.0 - THE ULTIMATE IMAGE BURNER!
VolumeSetName: UNDEFINED
RootDirectoryCreateDate: 2019:06:18 09:22:25+02:00
VolumeBlockSize: 2048
VolumeBlockCount: 599
VolumeName: DESKTOP
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start rundll32.exe no specs winrar.exe po_excelcuts.exe wscript.exe filename.exe no specs #REMCOS filename.exe

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\PO_Excelcuts.img.isoC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3472"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PO_Excelcuts.img.iso"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2960"C:\Users\admin\AppData\Local\Temp\Rar$EXa3472.19529\PO_Excelcuts.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3472.19529\PO_Excelcuts.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.05.0007
2576"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\subfolder\filename.vbs" C:\Windows\System32\WScript.exe
PO_Excelcuts.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2632"C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe" C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe—PO_Excelcuts.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.05.0007
2104C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe" C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe
filename.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.05.0007
Total events
1 257
Read events
1 159
Write events
98
Delete events
0

Modification events

(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\System32\isoburn.exe,-350
Value:
Disc Image File
(PID) Process:—Key:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\OpenWithProgids
Operation:writeName:Windows.IsoFile
Value:
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:LangID
Value:
0904
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@%SystemRoot%\System32\isoburn.exe,-352
Value:
Windows Disc Image Burner
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\System32\isoburn.exe
Value:
Windows Disc Image Burner
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\WinRAR\WinRAR.exe
Value:
WinRAR archiver
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Value:
Adobe Acrobat Reader DC
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:—Key:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Internet Explorer\iexplore.exe
Value:
Internet Explorer
Executable files
3
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2960PO_Excelcuts.exeC:\Users\admin\AppData\Local\Temp\subfolder\filename.vbstext
MD5:F586B7253DF47886FBB6057CAB7E38F7
SHA256:BE263E5EAA04346F4D8D293B86E9B8D91EAA71AA7E933BD0571EBD86047EA093
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3472.19529\PO_Excelcuts.exeexecutable
MD5:2B0D15857C1E93D28568BFBB138675D8
SHA256:9303C2DCB445CFCCFF50CC6A737435E7E21C12AE5ED9B10CF9B8C6F0B31C8B8F
2960PO_Excelcuts.exeC:\Users\admin\AppData\Local\Temp\subfolder\filename.exeexecutable
MD5:2B0D15857C1E93D28568BFBB138675D8
SHA256:9303C2DCB445CFCCFF50CC6A737435E7E21C12AE5ED9B10CF9B8C6F0B31C8B8F
3472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3472.26376\PO_Excelcuts.exeexecutable
MD5:2B0D15857C1E93D28568BFBB138675D8
SHA256:9303C2DCB445CFCCFF50CC6A737435E7E21C12AE5ED9B10CF9B8C6F0B31C8B8F
2104filename.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:87276A8A0AAEC6868207D538AB674166
SHA256:C8C538CC71F5ECF813664DAA1FAB4D6FDD3247007B6BE62B10EF7CDB01717E4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
filename.exe
185.247.228.77:6666
—
—
—
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2104
filename.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
2104
filename.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PO_Excelcuts.img