File name:

Doc_00998899.xls.z

Full analysis: https://app.any.run/tasks/76fe2eb4-74e0-4c77-82a6-6be197c64030
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: February 19, 2019, 09:07:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
stealer
keylogger
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B5A5186FA2C6E1E59DA22EF323C7EEE7

SHA1:

E7A888A549B2F2E5C28021D5299A37134AE2F703

SHA256:

3EC56E67DE6D46A9411DA9F3412CA56102D444C50E7B1A865499B3BFF57C17E9

SSDEEP:

6144:A545OYcuXJ69BumsbMQtadg2F1Mr/kprkipuUqJoVGeJsEknu:7bcvaMQt0g2FE/QXVqJoVJJstu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Doc_00998899.exe (PID: 764)
      • Doc_00998899.exe (PID: 1684)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3760)
      • Doc_00998899.exe (PID: 2652)
      • Doc_00998899.exe (PID: 1204)
      • Doc_00998899.exe (PID: 3028)
      • Doc_00998899.exe (PID: 3200)
    • REMCOS RAT was detected

      • Doc_00998899.exe (PID: 1684)
    • Connects to CnC server

      • Doc_00998899.exe (PID: 1684)
    • Actions looks like stealing of personal data

      • Doc_00998899.exe (PID: 2652)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3200)
      • Doc_00998899.exe (PID: 1204)
    • Stealing of credential data

      • Doc_00998899.exe (PID: 2652)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3200)
      • Doc_00998899.exe (PID: 1204)
    • Detected logs from REMCOS RAT

      • Doc_00998899.exe (PID: 1684)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3068)
    • Application launched itself

      • Doc_00998899.exe (PID: 764)
      • Doc_00998899.exe (PID: 1684)
    • Connects to unusual port

      • Doc_00998899.exe (PID: 1684)
    • Loads DLL from Mozilla Firefox

      • Doc_00998899.exe (PID: 3760)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3028)
      • Doc_00998899.exe (PID: 1204)
    • Creates files in the user directory

      • Doc_00998899.exe (PID: 1684)
    • Writes files like Keylogger logs

      • Doc_00998899.exe (PID: 1684)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
9
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe doc_00998899.exe no specs #REMCOS doc_00998899.exe doc_00998899.exe doc_00998899.exe doc_00998899.exe no specs doc_00998899.exe doc_00998899.exe no specs doc_00998899.exe

Process information

PID
CMD
Path
Indicators
Parent process
764"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1204C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\jbvralpqwvnpsi"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1684C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2444C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\owimiybvioqandcoseyvusseamfvgo"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2652C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\isaqkj"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3028C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\tvbkbdarkdfuuolpk"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exeDoc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3068"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Doc_00998899.xls.z.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3200C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\eyoccwllglxhechttztd"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3760C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\yqvxjqmpwwifxrysbpkwxfnnbaoezzksx"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exeDoc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3068.30126\doc_00998899.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
465
Read events
451
Write events
14
Delete events
0

Modification events

(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3068) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Doc_00998899.xls.z.rar
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3068) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
1
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exeexecutable
MD5:
SHA256:
764Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\~DFC62D9D79C09C3D68.TMPbinary
MD5:
SHA256:
1684Doc_00998899.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:
SHA256:
1204Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\jbvralpqwvnpsitext
MD5:
SHA256:
2444Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\owimiybvioqandcoseyvusseamfvgotext
MD5:
SHA256:
2652Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\isaqkjtext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
3200Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\eyoccwllglxhechttztdtext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
43

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1684
Doc_00998899.exe
185.244.31.116:2409
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
ET TROJAN Remcos RAT Checkin 23
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
5 ETPRO signatures available at the full report
No debug info