File name:

Prime LTD Purchase Order.rar

Full analysis: https://app.any.run/tasks/8ca95d35-9885-454a-bd9e-4bfaa09c600b
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: December 14, 2018, 07:18:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
trojan
keylogger
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E545B361CEC661783ACF8B20064AD294

SHA1:

FCC015833F08F8CE927D82D36AECAB569D10FAD5

SHA256:

3D033B69D09F5FEBE9DFD8D0568338B0C840280AE98C2444978A553716EDD97A

SSDEEP:

12288:6I5ZUWsY/Qc0VurgFODnseuBvBhtrVU81pqAf5okB9CXFE:55ZUWsedkF66vlhU81j2kBkXFE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)
      • remcos.exe (PID: 2076)
    • REMCOS RAT was detected

      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2076)
    • Application was dropped or rewritten from another process

      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)
      • remcos.exe (PID: 2076)
    • Connects to CnC server

      • remcos.exe (PID: 2076)
    • Detected logs from REMCOS RAT

      • remcos.exe (PID: 2076)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • crypted6.exe (PID: 2948)
      • WinRAR.exe (PID: 2808)
      • crypted6.exe (PID: 2508)
      • remcos.exe (PID: 2196)
    • Creates files in the user directory

      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2076)
    • Application launched itself

      • crypted6.exe (PID: 2508)
      • remcos.exe (PID: 2196)
    • Executes scripts

      • crypted6.exe (PID: 2948)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2184)
    • Writes files like Keylogger logs

      • remcos.exe (PID: 2076)
    • Connects to unusual port

      • remcos.exe (PID: 2076)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2812)
    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2808)
      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
12
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe crypted6.exe PhotoViewer.dll no specs winword.exe no specs #REMCOS crypted6.exe explorer.exe no specs wscript.exe no specs cmd.exe no specs remcos.exe #REMCOS remcos.exe explorer.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2076C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
remcos.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2184"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\System32\WScript.execrypted6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2196C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
cmd.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2384"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2460C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2508"C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe
WinRAR.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2808.42401\crypted6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2808"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Prime LTD Purchase Order.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2812"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\goesgeorgia.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
2948"C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe
crypted6.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2808.42401\crypted6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3108"C:\Windows\explorer.exe"C:\Windows\explorer.execrypted6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
Total events
1 849
Read events
1 476
Write events
366
Delete events
7

Modification events

(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2808) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Prime LTD Purchase Order.rar
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
6
Suspicious files
1
Text files
7
Unknown types
3

Dropped files

PID
Process
Filename
Type
2812WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR1C24.tmp.cvr
MD5:
SHA256:
2808WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exeexecutable
MD5:
SHA256:
2812WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\goesgeorgia.rtf.LNKlnk
MD5:
SHA256:
2812WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:
SHA256:
2812WINWORD.EXEC:\Users\admin\Desktop\~$esgeorgia.rtfpgc
MD5:
SHA256:
2508crypted6.exeC:\Users\admin\AppData\Local\Temp\Disk.sysexecutable
MD5:
SHA256:
2076remcos.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:
SHA256:
2196remcos.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exeexecutable
MD5:
SHA256:
2508crypted6.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exeexecutable
MD5:
SHA256:
2196remcos.exeC:\Users\admin\AppData\Local\Temp\Disk.sysexecutable
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
0
Threats
59

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2076
remcos.exe
213.183.58.20:7892
Melbikomas UAB
RU
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
2076
remcos.exe
A Network Trojan was detected
ET TROJAN Remcos RAT Checkin 23
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
5 ETPRO signatures available at the full report
No debug info