analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Prime LTD Purchase Order.rar

Full analysis: https://app.any.run/tasks/8ca95d35-9885-454a-bd9e-4bfaa09c600b
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 07:18:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
trojan
keylogger
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E545B361CEC661783ACF8B20064AD294

SHA1:

FCC015833F08F8CE927D82D36AECAB569D10FAD5

SHA256:

3D033B69D09F5FEBE9DFD8D0568338B0C840280AE98C2444978A553716EDD97A

SSDEEP:

12288:6I5ZUWsY/Qc0VurgFODnseuBvBhtrVU81pqAf5okB9CXFE:55ZUWsedkF66vlhU81j2kBkXFE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)
      • remcos.exe (PID: 2076)

    • REMCOS RAT was detected

      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2076)

    • Changes the autorun value in the registry

      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)
      • remcos.exe (PID: 2076)

    • Detected logs from REMCOS RAT

      • remcos.exe (PID: 2076)

    • Connects to CnC server

      • remcos.exe (PID: 2076)

  • SUSPICIOUS

    • Application launched itself

      • crypted6.exe (PID: 2508)
      • remcos.exe (PID: 2196)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2808)
      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)

    • Creates files in the user directory

      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2076)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2184)

    • Executes scripts

      • crypted6.exe (PID: 2948)

    • Writes files like Keylogger logs

      • remcos.exe (PID: 2076)

    • Connects to unusual port

      • remcos.exe (PID: 2076)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2812)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2808)
      • crypted6.exe (PID: 2508)
      • crypted6.exe (PID: 2948)
      • remcos.exe (PID: 2196)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
12
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe crypted6.exe PhotoViewer.dll no specs winword.exe no specs #REMCOS crypted6.exe explorer.exe no specs wscript.exe no specs cmd.exe no specs remcos.exe #REMCOS remcos.exe explorer.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2808"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Prime LTD Purchase Order.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2508"C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe
WinRAR.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
2460C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2812"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\goesgeorgia.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2948"C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exe
crypted6.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
3108"C:\Windows\explorer.exe"C:\Windows\explorer.exe—crypted6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2184"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\System32\WScript.exe—crypted6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3576"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Roaming\remcos\remcos.exe"C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2196C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
cmd.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Exit code:
0
Version:
6, 18, 7, 1
2076C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
remcos.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM Integration module
Version:
6, 18, 7, 1
Total events
1 849
Read events
1 476
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
1
Text files
7
Unknown types
3

Dropped files

PID
Process
Filename
Type
2812WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR1C24.tmp.cvr —
MD5:—
SHA256:—
2812WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:66EA7F35461EE567646ED79F4059C50F
SHA256:111F347DFBAB58786B97DB15E830676EBFAFD8F8B02111876F935D1CF39550D0
2812WINWORD.EXEC:\Users\admin\Desktop\~$esgeorgia.rtfpgc
MD5:57CC730166851D9F72DC9CC2FF5E6D34
SHA256:39C2AD1E5E511B2EF73A696FCEFE8BF39D0BFC2CF40865F62D2484B474089699
2948crypted6.exeC:\Users\admin\AppData\Local\Temp\install.vbsbinary
MD5:E7C11A4D55205EF93C91D048024EF0D3
SHA256:5CC1044DC54D1DB552A8DF065EE40E476E4724642917EE4B17EF3B15A1EA927D
2812WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\goesgeorgia.rtf.LNKlnk
MD5:A053B796CA5FC7C665A7420E0057B099
SHA256:2C1F5E338AE80CA9BDB43A7CB20556661C42258A414BD2FFF06E8B9899574932
2812WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:EE8A8FE67BAE1A6BB9F407B4D9E13B6A
SHA256:8E7F49AAE036BB954BEA92FC91594C5195D1DB5B05A4BBA6F3563AF0488DFBAC
2808WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2808.42401\crypted6.exeexecutable
MD5:87D155199D02C4795414B284863D1907
SHA256:025A16666F3F46ED93944A25B7BD52D2DA614FC88A490F96B8847727855B18ED
2508crypted6.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exeexecutable
MD5:87D155199D02C4795414B284863D1907
SHA256:025A16666F3F46ED93944A25B7BD52D2DA614FC88A490F96B8847727855B18ED
2508crypted6.exeC:\Users\admin\AppData\Local\Temp\Disk.sysexecutable
MD5:87D155199D02C4795414B284863D1907
SHA256:025A16666F3F46ED93944A25B7BD52D2DA614FC88A490F96B8847727855B18ED
2196remcos.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exeexecutable
MD5:87D155199D02C4795414B284863D1907
SHA256:025A16666F3F46ED93944A25B7BD52D2DA614FC88A490F96B8847727855B18ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2076
remcos.exe
213.183.58.20:7892
—
Melbikomas UAB
RU
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
2076
remcos.exe
A Network Trojan was detected
ET TROJAN Remcos RAT Checkin 23
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
2076
remcos.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Prime LTD Purchase Order.rar