File name:

199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d

Full analysis: https://app.any.run/tasks/9d6e54f6-ef9f-4e2e-a7e5-1f7e33fda2d0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: January 10, 2025, 19:29:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
evasion
upx
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

57F7D9095490A4AADDA9E261FEC73A68

SHA1:

45E51F97ABC52DD29E65D7EC78E18EE8D1721867

SHA256:

199AB84D301B4914A7EB23A40A575E2622928E58D3672DA79E43C77E453C4A3D

SSDEEP:

24576:BHlMd5NJ7WRR/ezNwvsMDOSAe4VLOYlJ4CSsXX4Qa0CALfsvyE9SYR+ngtygEN:VlMd5NJ7WRR/eksMDOSAe4VLOYliCSsB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS mutex has been found

      • bankrupture.exe (PID: 6268)
    • Create files in the Startup directory

      • bankrupture.exe (PID: 6268)
    • REMCOS has been detected

      • bankrupture.exe (PID: 6268)
      • bankrupture.exe (PID: 6268)
    • REMCOS has been detected (SURICATA)

      • bankrupture.exe (PID: 6268)
    • Connects to the CnC server

      • bankrupture.exe (PID: 6268)
    • REMCOS has been detected (YARA)

      • bankrupture.exe (PID: 6268)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
    • Starts itself from another location

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
    • Reads security settings of Internet Explorer

      • bankrupture.exe (PID: 6268)
    • Contacting a server suspected of hosting an CnC

      • bankrupture.exe (PID: 6268)
    • Connects to unusual port

      • bankrupture.exe (PID: 6268)
    • Checks for external IP

      • bankrupture.exe (PID: 6268)
    • There is functionality for taking screenshot (YARA)

      • bankrupture.exe (PID: 6268)
  • INFO

    • Creates files or folders in the user directory

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
      • bankrupture.exe (PID: 6268)
    • Checks supported languages

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
      • bankrupture.exe (PID: 6268)
    • Reads mouse settings

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
      • bankrupture.exe (PID: 6268)
    • Create files in a temporary directory

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
      • bankrupture.exe (PID: 6268)
    • The sample compiled with english language support

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
    • Reads the machine GUID from the registry

      • 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe (PID: 6212)
    • Checks proxy server information

      • bankrupture.exe (PID: 6268)
    • Creates files in the program directory

      • bankrupture.exe (PID: 6268)
    • Reads the computer name

      • bankrupture.exe (PID: 6268)
    • UPX packer has been detected

      • bankrupture.exe (PID: 6268)
    • The process uses AutoIt

      • bankrupture.exe (PID: 6268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x159a50
UninitializedDataSize: 1060864
InitializedDataSize: 532480
CodeSize: 352256
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:05 00:47:28+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start svchost.exe 199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe #REMCOS bankrupture.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6212"C:\Users\admin\AppData\Local\Temp\199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe" C:\Users\admin\AppData\Local\Temp\199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6268"C:\Users\admin\AppData\Local\Temp\199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe" C:\Users\admin\AppData\Local\ectosphere\bankrupture.exe
199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\ectosphere\bankrupture.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
557
Read events
551
Write events
6
Delete events
0

Modification events

(PID) Process:(6268) bankrupture.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-R1T905
Operation:writeName:exepath
Value:
37B6411759E18C0C3CA08988CF4F91292B3857EDBA40946D46B508D410D7677D42628C0FB3E07F78F6403756B094356A36D47E46330C1E7AAE5769068E76CD416C0402D1D5153527FFC278B94E4C357F2CD9FCB4ABD286B09D79B1B5C506DCC38D9C5B6C6A5A16416177EF983750C26B
(PID) Process:(6268) bankrupture.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-R1T905
Operation:writeName:licence
Value:
0EB06E9879E22DB55E5768653EA77A5C
(PID) Process:(6268) bankrupture.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-R1T905
Operation:writeName:time
Value:
(PID) Process:(6268) bankrupture.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6268) bankrupture.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6268) bankrupture.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6212199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exeC:\Users\admin\AppData\Local\Temp\aut6B31.tmpbinary
MD5:A9A0E5250052A7C19D3272E47DBF1F2D
SHA256:2CB6C8E181DD25247599136ADA37C8CFC64BDC5B073A236524A97182BA8FC720
6268bankrupture.exeC:\ProgramData\remcos\logs.datbinary
MD5:53415B138BD5EAEC69E803FE2592FD33
SHA256:4753EFCA53EFA2D02789BE48A18B0FA639CE0D8896B23AA1B7289934C9E257D6
6268bankrupture.exeC:\Users\admin\AppData\Local\Temp\aut733F.tmpbinary
MD5:A9A0E5250052A7C19D3272E47DBF1F2D
SHA256:2CB6C8E181DD25247599136ADA37C8CFC64BDC5B073A236524A97182BA8FC720
6212199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exeC:\Users\admin\AppData\Local\Temp\teerbinary
MD5:BD289FA20B842C995C4616D9CF521DF5
SHA256:686DEAE06FA39D9D353C1433D1C43A360877631186A36FF92BB29C3914D6238E
6212199ab84d301b4914a7eb23a40a575e2622928e58d3672da79e43c77e453c4a3d.exeC:\Users\admin\AppData\Local\ectosphere\bankrupture.exeexecutable
MD5:57F7D9095490A4AADDA9E261FEC73A68
SHA256:199AB84D301B4914A7EB23A40A575E2622928E58D3672DA79E43C77E453C4A3D
6268bankrupture.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bankrupture.vbsbinary
MD5:FFD81D89B17FB0D2F6C071CE412A1978
SHA256:4D5CE89B2F5F8F245E9062F73249142540CD5AAAEEF754CFC5D51F9EAF814356
6268bankrupture.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].jsonbinary
MD5:6098C74CD0C42F387343B45345022EF3
SHA256:CD03DFE4325896234F0F1E8A086E58ABDBFB28822B1F34E20AF018FD47130935
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
34
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6068
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6068
svchost.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6952
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6952
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6592
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6268
bankrupture.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6068
svchost.exe
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6068
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
6068
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6268
bankrupture.exe
192.210.150.26:8787
AS-COLOCROSSING
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.169
  • 23.48.23.159
  • 23.48.23.180
  • 23.48.23.143
  • 23.48.23.167
  • 23.48.23.166
  • 23.48.23.147
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.176
  • 104.126.37.170
  • 104.126.37.185
  • 104.126.37.162
  • 104.126.37.163
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
geoplugin.net
  • 178.237.33.50
malicious
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
1 ETPRO signatures available at the full report
No debug info