File name:

Remcos-v5.1.0-Light.zip

Full analysis: https://app.any.run/tasks/45c79a8d-ccc0-4678-a22e-839114c6ff16
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: July 27, 2024, 09:19:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
evasion
remcos
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

0CBBD1F2AED39B032719B9B6F4A0705B

SHA1:

AA47105A1B997CC028A644F26613190FE1BC20CE

SHA256:

35AFCC81505046A5572387993F57FCCA2DE3480CD5B7E4778521756DE88E6765

SSDEEP:

393216:SGvT7XZtjDpZF2r8CY1RHgbai3J/sWTZyp0TkX:SQ7XPDHFaQgbai+WbkX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • Remcos v5.1.0 Light.exe (PID: 6676)
    • REMCOS has been detected

      • remcos_a.exe (PID: 3140)
      • remcos_a.exe (PID: 3140)
    • REMCOS has been detected (YARA)

      • remcos_a.exe (PID: 3140)
  • SUSPICIOUS

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 3384)
    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3384)
      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Creates files like ransomware instruction

      • WinRAR.exe (PID: 1468)
    • Executable content was dropped or overwritten

      • Remcos v5.1.0 Light.exe (PID: 6676)
    • Checks for external IP

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • There is functionality for taking screenshot (YARA)

      • remcos_a.exe (PID: 3140)
  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 3384)
      • WinRAR.exe (PID: 1468)
      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 3384)
    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1428)
    • Reads Environment values

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Checks supported languages

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads the computer name

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Checks proxy server information

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads the machine GUID from the registry

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Creates files or folders in the user directory

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3140) remcos_a.exe
C2 (1)127.0.0.1:2404
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run0
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-JJ7H5E
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2024:06:29 17:18:38
ZipCRC: 0x29df0f26
ZipCompressedSize: 40259661
ZipUncompressedSize: 40667136
ZipFileName: Remcos v5.1.0 Light.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe no specs remcos v5.1.0 light.exe #REMCOS remcos_a.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1428"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb3384.34723\zip_password.txtC:\Windows\System32\notepad.exeWinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1468"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2996\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeremcos_a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3140"C:\Users\admin\Desktop\remcos_a.exe" C:\Users\admin\Desktop\remcos_a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\remcos_a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(3140) remcos_a.exe
C2 (1)127.0.0.1:2404
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run0
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-JJ7H5E
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3188"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zipC:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3384"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6676"C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe" C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe
explorer.exe
User:
admin
Company:
BreakingSecurity.net
Integrity Level:
MEDIUM
Description:
REMCOS Remote Control & Surveillance
Version:
5.1.0.0
Modules
Images
c:\users\admin\desktop\remcos v5.1.0 light.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
18 563
Read events
18 438
Write events
122
Delete events
3

Modification events

(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
5
Suspicious files
1
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
1468WinRAR.exeC:\Users\admin\Desktop\Remcos v5.1.0 Light.exe
MD5:
SHA256:
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\tls\ssleay32.dllexecutable
MD5:2117E31688AEF8ECF267978265BFCDCD
SHA256:0A4031AB00664CC5E202C8731798800F0475EF76800122CEBD71D249655D725F
3384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3384.34723\zip_password.txttext
MD5:9FD587FF1F1A40B278B64341B1887795
SHA256:BC52305FD2292EB8001BD03DE9225259B53CD5759E82E133240F1B508B31BC04
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\Remcos_Settings.initext
MD5:5EF6EDD2053BA7DAE1C9B137DEDDFF92
SHA256:4EF0B5F5085EE7B911B8F64A66C40C45CC3049B74E1E8154ACC8338337AB717F
1468WinRAR.exeC:\Users\admin\Desktop\ReadMe.txttext
MD5:7E1F726D092C5572AE1A667A09B541EB
SHA256:58018082DC30315BBC09F006BC55F922D2388EF6B64885FB6D2D12CA97A0C510
6676Remcos v5.1.0 Light.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\upd_free[1].txttext
MD5:4D3B38441D3358E49E5DFE9F45D3DCC7
SHA256:74144AD0A6F9EE30760DCB1BB618E0CDBDE208F2F4DE7155FFA8B606B761F51F
1468WinRAR.exeC:\Users\admin\Desktop\zip_password.txttext
MD5:9FD587FF1F1A40B278B64341B1887795
SHA256:BC52305FD2292EB8001BD03DE9225259B53CD5759E82E133240F1B508B31BC04
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\BuilderProfiles\DefaultProfile.initext
MD5:E2D57396C13D597855EB6FEA1122667A
SHA256:6422F98D8A559EC4F886892A806B427AF84B8814A114CDE4BBEC14B6B0B9AC50
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\tls\WBATZ2YG.crttext
MD5:181467B2D55F3AF4B5395B38BE9C8110
SHA256:4C99356C265EE06C0AE0502E74D38231263513726D001CFE28EA25E70AF2CC7F
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\tls\libeay32.dllexecutable
MD5:FA5DEF992198121D4BB5FF3BDE39FDC9
SHA256:5264A4A478383F501961F2BD9BEB1F77A43A487B76090561BBA2CBFE951E5305
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
35
DNS requests
11
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/GetIP.php
unknown
unknown
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/upd_free.txt
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
3140
remcos_a.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
184.86.251.14:443
www.bing.com
Akamai International B.V.
DE
unknown
40.91.76.224:443
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
239.255.255.250:1900
whitelisted
4
System
192.168.100.255:137
whitelisted
4132
OfficeClickToRun.exe
20.189.173.1:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1544
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6676
Remcos v5.1.0 Light.exe
95.172.86.122:80
breakingsec.io
SINGLEHOP-LLC
GB
unknown

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 184.86.251.14
  • 184.86.251.10
  • 184.86.251.4
  • 184.86.251.24
  • 184.86.251.7
  • 184.86.251.11
  • 184.86.251.9
  • 184.86.251.15
  • 184.86.251.20
whitelisted
google.com
  • 142.250.185.78
whitelisted
self.events.data.microsoft.com
  • 20.189.173.1
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
breakingsec.io
  • 95.172.86.122
unknown
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
6676
Remcos v5.1.0 Light.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
1 ETPRO signatures available at the full report
No debug info