File name:

remote.exe

Full analysis: https://app.any.run/tasks/03399c88-a5ec-4b1a-9e41-637ab31f226c
Verdict: Malicious activity
Analysis date: November 23, 2023, 12:31:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
vnc
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EC9847AB3A1780F67D6D8D88C4681924

SHA1:

08344C74E87817E08AA5B3A8D21C5EBD84C3FD8F

SHA256:

2BA4E9BC062840735B354BBD33BD1166C6D0052EC75C26A84C11E92E317FC2F1

SSDEEP:

49152:oYQyB8bF9mmeli3pQMybhL1fqPVO6VCWEAq5VhalDWGQ0AHs+uwx+bHOIij6tOuZ:SyBwmm0rhqYlWEdPGQ0Auz7OQOuiSIOB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • remote.exe (PID: 3472)
      • remote.exe (PID: 3436)
      • remote.tmp (PID: 3524)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • remote.tmp (PID: 3524)

    • Reads the Windows owner or organization settings

      • remote.tmp (PID: 3524)

  • INFO

    • Create files in a temporary directory

      • remote.exe (PID: 3436)
      • remote.exe (PID: 3472)
      • remote.tmp (PID: 3524)

    • Checks supported languages

      • remote.exe (PID: 3436)
      • remote.tmp (PID: 3448)
      • remote.exe (PID: 3472)
      • remote.tmp (PID: 3524)
      • winvnc.exe (PID: 3408)

    • Reads the computer name

      • remote.tmp (PID: 3448)
      • remote.tmp (PID: 3524)
      • winvnc.exe (PID: 3408)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:01:30 15:21:56+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 55296
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.2.1.1
ProductVersionNumber: 1.2.1.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Anter d.o.o.
FileDescription: PCA Remote - Podpora na daljavo, verzija 1.2.1.1
FileVersion: 1.2.1.1
LegalCopyright:
ProductName: Podpora na daljavo
ProductVersion: 1.5
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start remote.exe no specs remote.tmp no specs remote.exe remote.tmp no specs winvnc.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3408"C:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\winvnc.exe" -sc_prompt -sc_exit -id:1 -autoreconnect -connect server.anter.si::55010 -runC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\winvnc.exe—remote.tmp
User:
admin
Company:
UltraVNC
Integrity Level:
HIGH
Description:
VNC server
Exit code:
0
Version:
1.2.1.1
Modules
Images
c:\users\admin\appdata\local\temp\is-mntpq.tmp\winvnc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3436"C:\Users\admin\AppData\Local\Temp\remote.exe" C:\Users\admin\AppData\Local\Temp\remote.exe—explorer.exe
User:
admin
Company:
Anter d.o.o.
Integrity Level:
MEDIUM
Description:
PCA Remote - Podpora na daljavo, verzija 1.2.1.1
Exit code:
0
Version:
1.2.1.1
Modules
Images
c:\users\admin\appdata\local\temp\remote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3448"C:\Users\admin\AppData\Local\Temp\is-FNK08.tmp\remote.tmp" /SL5="$60134,741653,121344,C:\Users\admin\AppData\Local\Temp\remote.exe" C:\Users\admin\AppData\Local\Temp\is-FNK08.tmp\remote.tmp—remote.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-fnk08.tmp\remote.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3472"C:\Users\admin\AppData\Local\Temp\remote.exe" /SPAWNWND=$401F4 /NOTIFYWND=$60134 C:\Users\admin\AppData\Local\Temp\remote.exe
remote.tmp
User:
admin
Company:
Anter d.o.o.
Integrity Level:
HIGH
Description:
PCA Remote - Podpora na daljavo, verzija 1.2.1.1
Exit code:
0
Version:
1.2.1.1
Modules
Images
c:\users\admin\appdata\local\temp\remote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3488"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
3524"C:\Users\admin\AppData\Local\Temp\is-VG0BR.tmp\remote.tmp" /SL5="$601FC,741653,121344,C:\Users\admin\AppData\Local\Temp\remote.exe" /SPAWNWND=$401F4 /NOTIFYWND=$60134 C:\Users\admin\AppData\Local\Temp\is-VG0BR.tmp\remote.tmp—remote.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-vg0br.tmp\remote.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
914
Read events
914
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3436remote.exeC:\Users\admin\AppData\Local\Temp\is-FNK08.tmp\remote.tmpexecutable
MD5:0FB755204A5FD208E0336D2A42EDE497
SHA256:B54B279F7EF1779A9A1A96D2A2F9D43C541F7972D530AE8280B3C88D25DCE718
3472remote.exeC:\Users\admin\AppData\Local\Temp\is-VG0BR.tmp\remote.tmpexecutable
MD5:0FB755204A5FD208E0336D2A42EDE497
SHA256:B54B279F7EF1779A9A1A96D2A2F9D43C541F7972D530AE8280B3C88D25DCE718
3524remote.tmpC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
3524remote.tmpC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\vnchooks.dllexecutable
MD5:147509594936F4FE62FA63F3F0109E7E
SHA256:97F42759778101B6853B2E54B7CF80E6475128E84A18941972665DEC22CABC6C
3524remote.tmpC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\w8hook.dllexecutable
MD5:91DEEB5316D68E5F83DFA621A2A3D7DA
SHA256:DC97C40DC4A2292858C2D43C86AC751DE6820C57092CB1718A25D3B74DCA2F72
3524remote.tmpC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\UltraVNC.initext
MD5:76BE69078A947347DDF7E2B3101B3407
SHA256:E45A7B2D61DA85BF4DA0FF6F43DED7072FECE1BE37EA0F8A350F1867539D6862
3524remote.tmpC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\winvnc.exeexecutable
MD5:B4F9B8E02E197E190E0770B9BE8AF2BA
SHA256:41A83385B49D2DA64243A1048B2BB2E5C1F2C204946CB132B67293B340327BA5
3524remote.tmpC:\Users\admin\AppData\Local\Temp\is-MNTPQ.tmp\schook.dllexecutable
MD5:6924DC2E9C5BE303ADAFBBE6455B88A3
SHA256:C837596C885B650DE0CB5E1AE9395AB79605E2150E4A65BEAD37AB1A44059B3A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
5
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
server.anter.si
  • 212.93.241.90
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] VNC negotiation was detected (ProtocolVersion message)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
remote.exe