File name:

174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe

Full analysis: https://app.any.run/tasks/2b2c5ad9-ef9e-4539-b5cf-1c23ae66bdf3
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 24, 2025, 13:21:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

ED2A604468031EE6CBCF2EAE25E6E316

SHA1:

B0E0FE86F4B4FA9849BF730D68116D38E9BCA102

SHA256:

1C9D34307F9492A0257D5E3F6EEC997C6FD1D92DEE13F9BFF785A62645FA7CCE

SSDEEP:

12288:oucEko68OD9XdZ3JiY0meNN2od7bQc1kcnB6ZYapWVVVVVVVVVVVVVVVVV7n67:Mo6869wMENXbFt6Zvpkn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS has been detected

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • REMCOS has been detected (YARA)

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • REMCOS mutex has been found

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • REMCOS has been detected (SURICATA)

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • Connects to unusual port

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • Contacting a server suspected of hosting an CnC

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
  • INFO

    • Checks supported languages

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • Reads the machine GUID from the registry

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • Reads the computer name

      • 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe (PID: 7348)
    • Checks proxy server information

      • slui.exe (PID: 7944)
    • Reads the software policy settings

      • slui.exe (PID: 7944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:24 10:00:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 356864
InitializedDataSize: 140800
UninitializedDataSize: -
EntryPoint: 0x34d64
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REMCOS 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7348"C:\Users\admin\Desktop\174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe" C:\Users\admin\Desktop\174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7944C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 588
Read events
5 584
Write events
4
Delete events
0

Modification events

(PID) Process:(7348) 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YY8AXH
Operation:writeName:exepath
Value:
681910A7A5E8CEFA9C5989890F91F1C46EA6872F29E8F5C78F88EA0557FBB3A702A66958E0B59FE4CC9758943DCD25F35E2A78F854EA623D17240F4467F265DA35FD650C2A2426AAE87BDB25AD66A4A378A0C5225A457CED820F75DF439B21DC01F924A0FFABA3F6E2ED1D9A06B32D9CBF4E90E3FEE350EEBBA6A8D70EBDBE228DCBFD4CE5234D5D060F82783E33902D1D14E33493E339BA81EADC0E3717CC4F2187974B5700A1F878EBC45CB6996DB1AD953B972605E2085A24CD23A7F7F3F5C722FFA561866B5D895E3620A009F77EE5A25E0916FA6BDFC3BE8BAAD876EBC1DCDDF0E858160581E1ED
(PID) Process:(7348) 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YY8AXH
Operation:writeName:licence
Value:
AD92E70D90CFA7E84FA4FFC5DF62943C
(PID) Process:(7348) 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YY8AXH
Operation:writeName:time
Value:
(PID) Process:(7348) 174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YY8AXH
Operation:writeName:UID
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
176
DNS requests
4
Threats
310

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
whitelisted
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
192.3.64.144:1070
AS-COLOCROSSING
US
malicious
2104
svchost.exe
23.48.23.164:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
192.3.64.144:14646
AS-COLOCROSSING
US
malicious
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
192.3.64.144:7070
AS-COLOCROSSING
US
malicious
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
192.3.64.144:14645
AS-COLOCROSSING
US
malicious
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.164
  • 23.48.23.194
  • 23.48.23.193
  • 23.48.23.143
  • 23.48.23.173
  • 23.48.23.141
  • 23.48.23.180
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7348
174282220385a15258c05bc5be9a89a2deb3b63982bff17cf47c964df82b90140a974095c2923.dat-decoded.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info