| File name: | Remcos-v5.1.0-Light.zip |
| Full analysis: | https://app.any.run/tasks/45c79a8d-ccc0-4678-a22e-839114c6ff16 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | July 27, 2024, 09:19:48 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 0CBBD1F2AED39B032719B9B6F4A0705B |
| SHA1: | AA47105A1B997CC028A644F26613190FE1BC20CE |
| SHA256: | 35AFCC81505046A5572387993F57FCCA2DE3480CD5B7E4778521756DE88E6765 |
| SSDEEP: | 393216:SGvT7XZtjDpZF2r8CY1RHgbai3J/sWTZyp0TkX:SQ7XPDHFaQgbai+WbkX |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2024:06:29 17:18:38 |
| ZipCRC: | 0x29df0f26 |
| ZipCompressedSize: | 40259661 |
| ZipUncompressedSize: | 40667136 |
| ZipFileName: | Remcos v5.1.0 Light.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1428 | "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb3384.34723\zip_password.txt | C:\Windows\System32\notepad.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1468 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2996 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | remcos_a.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3140 | "C:\Users\admin\Desktop\remcos_a.exe" | C:\Users\admin\Desktop\remcos_a.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Remcos(PID) Process(3140) remcos_a.exe C2 (1)127.0.0.1:2404 BotnetRemoteHost Options Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run0 Install_HKLM\Winlogon\Shell100000 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueFalse Hide_fileFalse Mutex_nameRmc-JJ7H5E Keylog_flag0 Keylog_path%LOCALAPPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos | |||||||||||||||
| 3188 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3384 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 6676 | "C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe" | C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe | explorer.exe | ||||||||||||
User: admin Company: BreakingSecurity.net Integrity Level: MEDIUM Description: REMCOS Remote Control & Surveillance Version: 5.1.0.0 Modules
| |||||||||||||||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
| (PID) Process: | (3188) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\General |
| Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\Desktop | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1468 | WinRAR.exe | C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe | — | |
MD5:— | SHA256:— | |||
| 6676 | Remcos v5.1.0 Light.exe | C:\Users\admin\Desktop\tls\ssleay32.dll | executable | |
MD5:2117E31688AEF8ECF267978265BFCDCD | SHA256:0A4031AB00664CC5E202C8731798800F0475EF76800122CEBD71D249655D725F | |||
| 3384 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3384.34723\zip_password.txt | text | |
MD5:9FD587FF1F1A40B278B64341B1887795 | SHA256:BC52305FD2292EB8001BD03DE9225259B53CD5759E82E133240F1B508B31BC04 | |||
| 6676 | Remcos v5.1.0 Light.exe | C:\Users\admin\Desktop\Remcos_Settings.ini | text | |
MD5:5EF6EDD2053BA7DAE1C9B137DEDDFF92 | SHA256:4EF0B5F5085EE7B911B8F64A66C40C45CC3049B74E1E8154ACC8338337AB717F | |||
| 1468 | WinRAR.exe | C:\Users\admin\Desktop\ReadMe.txt | text | |
MD5:7E1F726D092C5572AE1A667A09B541EB | SHA256:58018082DC30315BBC09F006BC55F922D2388EF6B64885FB6D2D12CA97A0C510 | |||
| 6676 | Remcos v5.1.0 Light.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\upd_free[1].txt | text | |
MD5:4D3B38441D3358E49E5DFE9F45D3DCC7 | SHA256:74144AD0A6F9EE30760DCB1BB618E0CDBDE208F2F4DE7155FFA8B606B761F51F | |||
| 1468 | WinRAR.exe | C:\Users\admin\Desktop\zip_password.txt | text | |
MD5:9FD587FF1F1A40B278B64341B1887795 | SHA256:BC52305FD2292EB8001BD03DE9225259B53CD5759E82E133240F1B508B31BC04 | |||
| 6676 | Remcos v5.1.0 Light.exe | C:\Users\admin\Desktop\BuilderProfiles\DefaultProfile.ini | text | |
MD5:E2D57396C13D597855EB6FEA1122667A | SHA256:6422F98D8A559EC4F886892A806B427AF84B8814A114CDE4BBEC14B6B0B9AC50 | |||
| 6676 | Remcos v5.1.0 Light.exe | C:\Users\admin\Desktop\tls\WBATZ2YG.crt | text | |
MD5:181467B2D55F3AF4B5395B38BE9C8110 | SHA256:4C99356C265EE06C0AE0502E74D38231263513726D001CFE28EA25E70AF2CC7F | |||
| 6676 | Remcos v5.1.0 Light.exe | C:\Users\admin\Desktop\tls\libeay32.dll | executable | |
MD5:FA5DEF992198121D4BB5FF3BDE39FDC9 | SHA256:5264A4A478383F501961F2BD9BEB1F77A43A487B76090561BBA2CBFE951E5305 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/GetIP.php | unknown | — | — | unknown |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/upd_free.txt | unknown | — | — | suspicious |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
3140 | remcos_a.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | whitelisted |
6676 | Remcos v5.1.0 Light.exe | GET | 200 | 95.172.86.122:80 | http://breakingsec.io/Rmc/InternetCheck.php | unknown | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 131.253.33.254:443 | a-ring-fallback.msedge.net | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
— | — | 184.86.251.14:443 | www.bing.com | Akamai International B.V. | DE | unknown |
— | — | 40.91.76.224:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4132 | OfficeClickToRun.exe | 20.189.173.1:443 | self.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
1544 | slui.exe | 20.83.72.98:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6676 | Remcos v5.1.0 Light.exe | 95.172.86.122:80 | breakingsec.io | SINGLEHOP-LLC | GB | unknown |
Domain | IP | Reputation |
|---|---|---|
t-ring-fdv2.msedge.net |
| unknown |
settings-win.data.microsoft.com |
| whitelisted |
a-ring-fallback.msedge.net |
| unknown |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
breakingsec.io |
| unknown |
geoplugin.net |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
6676 | Remcos v5.1.0 Light.exe | Device Retrieving External IP Address Detected | SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request |