analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Doc_00998899.xls.z

Full analysis: https://app.any.run/tasks/76fe2eb4-74e0-4c77-82a6-6be197c64030
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 09:07:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
stealer
keylogger
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B5A5186FA2C6E1E59DA22EF323C7EEE7

SHA1:

E7A888A549B2F2E5C28021D5299A37134AE2F703

SHA256:

3EC56E67DE6D46A9411DA9F3412CA56102D444C50E7B1A865499B3BFF57C17E9

SSDEEP:

6144:A545OYcuXJ69BumsbMQtadg2F1Mr/kprkipuUqJoVGeJsEknu:7bcvaMQt0g2FE/QXVqJoVJJstu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Doc_00998899.exe (PID: 764)
      • Doc_00998899.exe (PID: 1684)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 2652)
      • Doc_00998899.exe (PID: 3760)
      • Doc_00998899.exe (PID: 3028)
      • Doc_00998899.exe (PID: 3200)
      • Doc_00998899.exe (PID: 1204)

    • REMCOS RAT was detected

      • Doc_00998899.exe (PID: 1684)

    • Connects to CnC server

      • Doc_00998899.exe (PID: 1684)

    • Stealing of credential data

      • Doc_00998899.exe (PID: 2652)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3200)
      • Doc_00998899.exe (PID: 1204)

    • Actions looks like stealing of personal data

      • Doc_00998899.exe (PID: 2652)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3200)
      • Doc_00998899.exe (PID: 1204)

    • Detected logs from REMCOS RAT

      • Doc_00998899.exe (PID: 1684)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3068)

    • Application launched itself

      • Doc_00998899.exe (PID: 764)
      • Doc_00998899.exe (PID: 1684)

    • Connects to unusual port

      • Doc_00998899.exe (PID: 1684)

    • Loads DLL from Mozilla Firefox

      • Doc_00998899.exe (PID: 3760)
      • Doc_00998899.exe (PID: 2444)
      • Doc_00998899.exe (PID: 3028)
      • Doc_00998899.exe (PID: 1204)

    • Writes files like Keylogger logs

      • Doc_00998899.exe (PID: 1684)

    • Creates files in the user directory

      • Doc_00998899.exe (PID: 1684)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
9
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe doc_00998899.exe no specs #REMCOS doc_00998899.exe doc_00998899.exe doc_00998899.exe no specs doc_00998899.exe doc_00998899.exe doc_00998899.exe no specs doc_00998899.exe

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Doc_00998899.xls.z.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
764"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
1684C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Version:
1.05.0009
2444C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\owimiybvioqandcoseyvusseamfvgo"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
3760C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\yqvxjqmpwwifxrysbpkwxfnnbaoezzksx"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe—Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
2652C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\isaqkj"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
1204C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\jbvralpqwvnpsi"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
3028C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\tvbkbdarkdfuuolpk"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe—Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
3200C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe /stext "C:\Users\admin\AppData\Local\Temp\eyoccwllglxhechttztd"C:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exe
Doc_00998899.exe
User:
admin
Integrity Level:
MEDIUM
Description:
INTERDICTING5
Exit code:
0
Version:
1.05.0009
Total events
465
Read events
451
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2444Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\owimiybvioqandcoseyvusseamfvgotext
MD5:C48992AAE0E8FD5463A7B1617B2E0B88
SHA256:04802C51A3EE5E9F7D48462C50B17ABC0E84D54F5525D70E4C904BCC0634C3CE
3068WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3068.30126\Doc_00998899.exeexecutable
MD5:D14D76A39981618738B438F8E3403915
SHA256:4AB8825BA6F545CE5136CF21674E69003009F6237963759D6F36B99EBB137FFC
1204Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\jbvralpqwvnpsitext
MD5:C48992AAE0E8FD5463A7B1617B2E0B88
SHA256:04802C51A3EE5E9F7D48462C50B17ABC0E84D54F5525D70E4C904BCC0634C3CE
764Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\~DFC62D9D79C09C3D68.TMPbinary
MD5:1C4FA97D7208445C73653F2F372083EC
SHA256:68D7B261CC7DA6211ADFAD45EE419155E6983158E666378E724D3148EBA5B9F2
1684Doc_00998899.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:F615D8956B183ADFAE54400A655EF623
SHA256:6486E0906B59DAE2B497A0131FC67A51961891188F2D4978415546FDCEE72504
2652Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\isaqkjtext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
3200Doc_00998899.exeC:\Users\admin\AppData\Local\Temp\eyoccwllglxhechttztdtext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1684
Doc_00998899.exe
185.244.31.116:2409
—
—
—
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
ET TROJAN Remcos RAT Checkin 23
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Remcos RAT
1684
Doc_00998899.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Doc_00998899.xls.z