URL:

http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcw9DoIwGADQjyPo7upYCuKACf4lxjiYYDQ6mtKW0qTwNW0FuYmX9A7Gd4A3OcKXRvCZRuDMSNOGeNeTlmnDsQsODeHYQpbk9F4NhzRd5FkCttG-0Z0iXkvnGEezFVrpgTlJOhmgCcH6VRwL5J4oRGXkv4lffCPfFl0oBA6dQSbmWhTJktV9dQ68Rp2ccG93Dzteb5fyqcZQ06oEgNk6gh8iZzkq&Z

Full analysis: https://app.any.run/tasks/cd82797a-8d87-4cd9-90c5-ae9f2548b051
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: February 09, 2024, 02:05:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
keylogger
Indicators:
MD5:

2E572E7FD73BF17CA8FB31B8BB6C8594

SHA1:

FF0D23E0B6D9C4090070168182133416060FD190

SHA256:

306DAE47CC9C3E038380D5EF44A54FC58280F01241008E70F361AF111D08F959

SSDEEP:

6:COcuCugjiER0hlNM2D3W9ypr+/6qqBZcO6C57ox8aC7ahFmtrAiGYn:xDg3Rqle8/r+/6ZkJClEi4QAir

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Remcos is detected

      • csc.exe (PID: 3308)
      • csc.exe (PID: 3308)

    • Starts Visual C# compiler

      • ACCION TUTELA RAD 1100140880612024-00181-00.exe (PID: 2000)

    • REMCOS has been detected (SURICATA)

      • csc.exe (PID: 3308)

    • REMCOS has been detected (YARA)

      • csc.exe (PID: 3308)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • ACCION TUTELA RAD 1100140880612024-00181-00.exe (PID: 2000)

    • Connects to unusual port

      • csc.exe (PID: 3308)

    • Reads the Internet Settings

      • csc.exe (PID: 3308)

    • Writes files like Keylogger logs

      • csc.exe (PID: 3308)

    • Reads security settings of Internet Explorer

      • csc.exe (PID: 3308)

  • INFO

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3700)

    • Reads the computer name

      • ACCION TUTELA RAD 1100140880612024-00181-00.exe (PID: 2000)
      • csc.exe (PID: 3308)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2688)
      • iexplore.exe (PID: 3700)

    • Checks supported languages

      • csc.exe (PID: 3308)
      • ACCION TUTELA RAD 1100140880612024-00181-00.exe (PID: 2000)

    • Reads the machine GUID from the registry

      • ACCION TUTELA RAD 1100140880612024-00181-00.exe (PID: 2000)
      • csc.exe (PID: 3308)

    • Reads product name

      • csc.exe (PID: 3308)

    • Reads Environment values

      • csc.exe (PID: 3308)

    • Checks proxy server information

      • csc.exe (PID: 3308)

    • Creates files in the program directory

      • csc.exe (PID: 3308)

    • Creates files or folders in the user directory

      • csc.exe (PID: 3308)

    • Manual execution by a user

      • ACCION TUTELA RAD 1100140880612024-00181-00.exe (PID: 2000)

    • Application launched itself

      • iexplore.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3308) csc.exe
C2 (1)febrero08.con-ip.com:7770
BotnetNEGOCIO
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-HOYD64
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs accion tutela rad 1100140880612024-00181-00.exe no specs #REMCOS csc.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\cmd.exe—ACCION TUTELA RAD 1100140880612024-00181-00.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1236"cmd" /c copy "C:\Users\admin\Desktop\ACCION TUTELA RAD 1100140880612024-00181-00.exe" "C:\Users\admin\AppData\Roaming\AppData\AppData.exe"C:\Windows\System32\cmd.exe—ACCION TUTELA RAD 1100140880612024-00181-00.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1340schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2000"C:\Users\admin\Desktop\ACCION TUTELA RAD 1100140880612024-00181-00.exe" C:\Users\admin\Desktop\ACCION TUTELA RAD 1100140880612024-00181-00.exe—explorer.exe
User:
admin
Company:
武汉网幂科技有限公司
Integrity Level:
MEDIUM
Description:
备忘录记事本 Installer
Exit code:
0
Version:
2.1.1
Modules
Images
c:\users\admin\desktop\accion tutela rad 1100140880612024-00181-00.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2688"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\ACCION TUTELA RAD 1100140880612024-00181-00.tar"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2904"cmd" /c mkdir "C:\Users\admin\AppData\Roaming\AppData"C:\Windows\System32\cmd.exe—ACCION TUTELA RAD 1100140880612024-00181-00.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2920"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3700 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3308"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
ACCION TUTELA RAD 1100140880612024-00181-00.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(3308) csc.exe
C2 (1)febrero08.con-ip.com:7770
BotnetNEGOCIO
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-HOYD64
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3700"C:\Program Files\Internet Explorer\iexplore.exe" "http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcw9DoIwGADQjyPo7upYCuKACf4lxjiYYDQ6mtKW0qTwNW0FuYmX9A7Gd4A3OcKXRvCZRuDMSNOGeNeTlmnDsQsODeHYQpbk9F4NhzRd5FkCttG-0Z0iXkvnGEezFVrpgTlJOhmgCcH6VRwL5J4oRGXkv4lffCPfFl0oBA6dQSbmWhTJktV9dQ68Rp2ccG93Dzteb5fyqcZQ06oEgNk6gh8iZzkq&Z"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
24 211
Read events
24 029
Write events
139
Delete events
43

Modification events

(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31087356
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31087356
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
27
Text files
21
Unknown types
2

Dropped files

PID
Process
Filename
Type
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\bootstrap-responsive[1].csstext
MD5:F9DEE47322D809A5B97EFB10FF9E45E7
SHA256:E738183A60E8CF19E763729B96C19D0CCEE30F225E75AD61B8648A3CC7BFA969
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\bootstrap[1].csstext
MD5:AB3117DE176756AE49FE66166F1DBE72
SHA256:0A879254A8059FFCA5F46C30DA040F603B9A08EC9CF769B923294DA9E6669943
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1A692E6D03AEBD3F900FAA1072CF4F79
SHA256:37DB531C62FD9074EBBB149A55F7C0D215F054B0D03B54BC0D1F63A351980114
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\success[1].pngimage
MD5:AFA666DB1988CC9CAD27F7614FE05FB9
SHA256:7990A456B08FD166AFA514C9EA93481EEAE9245308ADD794F6118C0CC17E230F
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\notification[1].csstext
MD5:D91B68ED1C96410948DEF0401E0E57D4
SHA256:2811D0858F7FD1BFE56B09E48364F36AEEF4783BD2A47E17B9F6BBC54D3F0F37
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:2B33B0833148DC664D6B13C3F7E97BC2
SHA256:FEDE4ADCE8CF32BB9DC17A6F389971EBCE68EF8415F949F5690B04612EE8E5A3
2688WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2688.34400\ACCION TUTELA RAD 1100140880612024-00181-00.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
33
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2920
iexplore.exe
GET
403
208.87.233.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcw9DoIwGADQjyPo7upYCuKACf4lxjiYYDQ6mtKW0qTwNW0FuYmX9A7Gd4A3OcKXRvCZRuDMSNOGeNeTlmnDsQsODeHYQpbk9F4NhzRd5FkCttG-0Z0iXkvnGEezFVrpgTlJOhmgCcH6VRwL5J4oRGXkv4lffCPfFl0oBA6dQSbmWhTJktV9dQ68Rp2ccG93Dzteb5fyqcZQ06oEgNk6gh8iZzkq&Z
unknown
html
5.07 Kb
unknown
2920
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/notification.css
unknown
text
5.06 Kb
unknown
2920
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/warning.png
unknown
image
5.02 Kb
unknown
2920
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap-responsive.css
unknown
text
2.74 Kb
unknown
2920
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap.css
unknown
text
14.2 Kb
unknown
3700
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
2920
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/empty.js
unknown
—
—
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
3700
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b23edf5cfbe16fd7
unknown
—
—
unknown
2920
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/success.png
unknown
image
6.40 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2920
iexplore.exe
208.87.233.180:80
webdefence.global.blackspider.com
Forcepoint Cloud Ltd
US
unknown
2920
iexplore.exe
85.115.52.220:80
www.mailcontrol.com
Forcepoint Cloud Ltd
GB
unknown
3700
iexplore.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
unknown
3700
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3700
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2920
iexplore.exe
142.250.186.129:443
doc-04-7c-docs.googleusercontent.com
GOOGLE
US
whitelisted
2920
iexplore.exe
142.250.186.35:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
webdefence.global.blackspider.com
  • 208.87.233.180
whitelisted
www.mailcontrol.com
  • 85.115.52.220
whitelisted
help724.digiware.net
  • —
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.145
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 87.248.204.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
doc-04-7c-docs.googleusercontent.com
  • 142.250.186.129
whitelisted
ocsp.pki.goog
  • 142.250.186.35
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
2920
iexplore.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
3308
csc.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
3308
csc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcw9DoIwGADQjyPo7upYCuKACf4lxjiYYDQ6mtKW0qTwNW0FuYmX9A7Gd4A3OcKXRvCZRuDMSNOGeNeTlmnDsQsODeHYQpbk9F4NhzRd5FkCttG-0Z0iXkvnGEezFVrpgTlJOhmgCcH6VRwL5J4oRGXkv4lffCPfFl0oBA6dQSbmWhTJktV9dQ68Rp2ccG93Dzteb5fyqcZQ06oEgNk6gh8iZzkq&Z