File name:

Remcos-v5.1.0-Light.zip

Full analysis: https://app.any.run/tasks/45c79a8d-ccc0-4678-a22e-839114c6ff16
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: July 27, 2024, 09:19:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
evasion
remcos
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

0CBBD1F2AED39B032719B9B6F4A0705B

SHA1:

AA47105A1B997CC028A644F26613190FE1BC20CE

SHA256:

35AFCC81505046A5572387993F57FCCA2DE3480CD5B7E4778521756DE88E6765

SSDEEP:

393216:SGvT7XZtjDpZF2r8CY1RHgbai3J/sWTZyp0TkX:SQ7XPDHFaQgbai+WbkX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • Remcos v5.1.0 Light.exe (PID: 6676)
    • REMCOS has been detected

      • remcos_a.exe (PID: 3140)
      • remcos_a.exe (PID: 3140)
    • REMCOS has been detected (YARA)

      • remcos_a.exe (PID: 3140)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3384)
      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 3384)
    • Creates files like ransomware instruction

      • WinRAR.exe (PID: 1468)
    • Executable content was dropped or overwritten

      • Remcos v5.1.0 Light.exe (PID: 6676)
    • Checks for external IP

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • There is functionality for taking screenshot (YARA)

      • remcos_a.exe (PID: 3140)
  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 3384)
      • WinRAR.exe (PID: 1468)
      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 3384)
    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1428)
    • Checks supported languages

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads Environment values

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads the computer name

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Checks proxy server information

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Reads the machine GUID from the registry

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
    • Creates files or folders in the user directory

      • Remcos v5.1.0 Light.exe (PID: 6676)
      • remcos_a.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3140) remcos_a.exe
C2 (1)127.0.0.1:2404
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run0
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-JJ7H5E
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2024:06:29 17:18:38
ZipCRC: 0x29df0f26
ZipCompressedSize: 40259661
ZipUncompressedSize: 40667136
ZipFileName: Remcos v5.1.0 Light.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe no specs remcos v5.1.0 light.exe #REMCOS remcos_a.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1428"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb3384.34723\zip_password.txtC:\Windows\System32\notepad.exeWinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1468"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2996\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeremcos_a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3140"C:\Users\admin\Desktop\remcos_a.exe" C:\Users\admin\Desktop\remcos_a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\remcos_a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(3140) remcos_a.exe
C2 (1)127.0.0.1:2404
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run0
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-JJ7H5E
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3188"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zipC:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3384"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6676"C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe" C:\Users\admin\Desktop\Remcos v5.1.0 Light.exe
explorer.exe
User:
admin
Company:
BreakingSecurity.net
Integrity Level:
MEDIUM
Description:
REMCOS Remote Control & Surveillance
Version:
5.1.0.0
Modules
Images
c:\users\admin\desktop\remcos v5.1.0 light.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
18 563
Read events
18 438
Write events
122
Delete events
3

Modification events

(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Remcos-v5.1.0-Light.zip
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(3188) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
5
Suspicious files
1
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
1468WinRAR.exeC:\Users\admin\Desktop\Remcos v5.1.0 Light.exe
MD5:
SHA256:
1468WinRAR.exeC:\Users\admin\Desktop\zip_password.txttext
MD5:9FD587FF1F1A40B278B64341B1887795
SHA256:BC52305FD2292EB8001BD03DE9225259B53CD5759E82E133240F1B508B31BC04
1468WinRAR.exeC:\Users\admin\Desktop\ReadMe.txttext
MD5:7E1F726D092C5572AE1A667A09B541EB
SHA256:58018082DC30315BBC09F006BC55F922D2388EF6B64885FB6D2D12CA97A0C510
3384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3384.34723\zip_password.txttext
MD5:9FD587FF1F1A40B278B64341B1887795
SHA256:BC52305FD2292EB8001BD03DE9225259B53CD5759E82E133240F1B508B31BC04
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\BuilderProfiles\DefaultProfile.initext
MD5:E2D57396C13D597855EB6FEA1122667A
SHA256:6422F98D8A559EC4F886892A806B427AF84B8814A114CDE4BBEC14B6B0B9AC50
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\remcos_a.exeexecutable
MD5:CC69CAC4B290FFE3A48EB97A84161C3C
SHA256:8DBAAF8394250340E282A70A69DAD00C21424E68D56CFC46816C1D0C2A2A0BD6
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\RCXEA24.tmpexecutable
MD5:9395F9FCACD028EB7834CA8E7A352B2E
SHA256:E61A2A89FDEF6054F50447D44510199D1B0D89FDB9F4668FF9AFEF23E95A9958
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\tls\remcos_client.keytext
MD5:9CD76099652E85865E93601C4B859804
SHA256:8C0837D3C4C092484B902673EBA5F0DE481DF56D24548F6D35972EB755821B57
3140remcos_a.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\json[1].jsonbinary
MD5:6F58BABFF529D3227B88AF77233C5CB7
SHA256:B458788268E746F829FA03D07C5A38A0B43B0EAD3D4A2F12BBF03175B1C06300
6676Remcos v5.1.0 Light.exeC:\Users\admin\Desktop\tls\libeay32.dllexecutable
MD5:FA5DEF992198121D4BB5FF3BDE39FDC9
SHA256:5264A4A478383F501961F2BD9BEB1F77A43A487B76090561BBA2CBFE951E5305
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
35
DNS requests
11
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/GetIP.php
unknown
unknown
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/upd_free.txt
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
6676
Remcos v5.1.0 Light.exe
GET
200
95.172.86.122:80
http://breakingsec.io/Rmc/InternetCheck.php
unknown
suspicious
3140
remcos_a.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
POST
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
unknown
POST
200
20.189.173.18:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
binary
9 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
184.86.251.14:443
www.bing.com
Akamai International B.V.
DE
unknown
40.91.76.224:443
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
239.255.255.250:1900
whitelisted
4
System
192.168.100.255:137
whitelisted
4132
OfficeClickToRun.exe
20.189.173.1:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1544
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6676
Remcos v5.1.0 Light.exe
95.172.86.122:80
breakingsec.io
SINGLEHOP-LLC
GB
unknown

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 184.86.251.14
  • 184.86.251.10
  • 184.86.251.4
  • 184.86.251.24
  • 184.86.251.7
  • 184.86.251.11
  • 184.86.251.9
  • 184.86.251.15
  • 184.86.251.20
whitelisted
google.com
  • 142.250.185.78
whitelisted
self.events.data.microsoft.com
  • 20.189.173.1
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
breakingsec.io
  • 95.172.86.122
unknown
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
6676
Remcos v5.1.0 Light.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
1 ETPRO signatures available at the full report
No debug info