File name:

dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d

Full analysis: https://app.any.run/tasks/59af88c7-1ff7-433f-bab1-24d584236138
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 19:58:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
remcos
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

0FC1C3545DE115D3F43A2547C3EB177C

SHA1:

CA7A75FFB9634541A35C7569392A9AC9FFA82489

SHA256:

46044E481BF35D33BBFB30C894A595770DB913208AE752B08AF014571BD95F1D

SSDEEP:

12288:iVVVVVeIS4utRhABCTZ3dUWQvHftPgFFBemW2WeTVVVVVt:vIS4utLABgtnEHftPEFBemW2WeH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS mutex has been found

      • nas0.exe (PID: 5124)
      • nas0.exe (PID: 6652)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 5324)
      • nas0.exe (PID: 4268)
      • nas0.exe (PID: 6564)
      • nas0.exe (PID: 6392)
      • nas0.exe (PID: 2140)
      • nas0.exe (PID: 5680)
      • nas0.exe (PID: 2384)
      • nas0.exe (PID: 2852)

    • REMCOS has been detected

      • nas0.exe (PID: 5124)

    • Changes the autorun value in the registry

      • nas0.exe (PID: 6388)
      • nas0.exe (PID: 5124)
      • nas0.exe (PID: 6652)
      • nas0.exe (PID: 5176)
      • nas0.exe (PID: 4652)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 3240)
      • nas0.exe (PID: 5324)
      • nas0.exe (PID: 2108)
      • nas0.exe (PID: 4268)
      • nas0.exe (PID: 6044)
      • nas0.exe (PID: 6564)
      • nas0.exe (PID: 6392)
      • nas0.exe (PID: 3268)
      • nas0.exe (PID: 2140)
      • nas0.exe (PID: 1324)
      • nas0.exe (PID: 6268)
      • nas0.exe (PID: 5680)
      • nas0.exe (PID: 4776)
      • nas0.exe (PID: 2384)
      • nas0.exe (PID: 1628)
      • nas0.exe (PID: 2852)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 2140)
      • wscript.exe (PID: 960)
      • wscript.exe (PID: 5548)
      • wscript.exe (PID: 4892)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 1388)
      • wscript.exe (PID: 6068)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 4040)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 6272)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2140)
      • wscript.exe (PID: 960)
      • wscript.exe (PID: 5548)
      • wscript.exe (PID: 4892)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 1388)
      • wscript.exe (PID: 6068)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 4040)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 6272)

    • Changes the login/logoff helper path in the registry

      • nas0.exe (PID: 5124)
      • nas0.exe (PID: 6652)

  • SUSPICIOUS

    • Application launched itself

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 6644)
      • nas0.exe (PID: 6388)
      • nas0.exe (PID: 5176)
      • remcos.exe (PID: 1072)
      • remcos.exe (PID: 4224)
      • nas0.exe (PID: 4652)
      • nas0.exe (PID: 3240)
      • remcos.exe (PID: 6272)
      • nas0.exe (PID: 2108)
      • remcos.exe (PID: 4812)
      • nas0.exe (PID: 6044)
      • remcos.exe (PID: 5304)
      • nas0.exe (PID: 3268)
      • nas0.exe (PID: 1324)
      • remcos.exe (PID: 4724)
      • remcos.exe (PID: 5056)
      • nas0.exe (PID: 6268)
      • remcos.exe (PID: 6068)
      • nas0.exe (PID: 4776)
      • remcos.exe (PID: 1676)
      • nas0.exe (PID: 1628)
      • remcos.exe (PID: 5608)
      • nas0.exe (PID: 6540)
      • remcos.exe (PID: 6816)
      • nas0.exe (PID: 6576)
      • nas0.exe (PID: 3156)
      • remcos.exe (PID: 3884)
      • remcos.exe (PID: 6668)
      • nas0.exe (PID: 4784)
      • remcos.exe (PID: 3176)
      • nas0.exe (PID: 660)
      • remcos.exe (PID: 6652)
      • nas0.exe (PID: 4000)
      • nas0.exe (PID: 4920)
      • remcos.exe (PID: 4756)
      • nas0.exe (PID: 900)
      • remcos.exe (PID: 5960)
      • remcos.exe (PID: 5512)
      • remcos.exe (PID: 4068)
      • remcos.exe (PID: 5124)
      • nas0.exe (PID: 4300)
      • nas0.exe (PID: 6876)
      • nas0.exe (PID: 4688)
      • remcos.exe (PID: 2852)
      • nas0.exe (PID: 664)
      • remcos.exe (PID: 2152)
      • nas0.exe (PID: 5400)
      • remcos.exe (PID: 6592)
      • nas0.exe (PID: 5756)
      • remcos.exe (PID: 1748)
      • nas0.exe (PID: 5260)
      • remcos.exe (PID: 4688)
      • remcos.exe (PID: 6072)
      • nas0.exe (PID: 6572)
      • remcos.exe (PID: 4920)
      • nas0.exe (PID: 2840)
      • nas0.exe (PID: 3268)
      • nas0.exe (PID: 900)
      • remcos.exe (PID: 1180)
      • nas0.exe (PID: 5728)
      • remcos.exe (PID: 680)
      • remcos.exe (PID: 6036)
      • remcos.exe (PID: 5756)
      • nas0.exe (PID: 3176)
      • nas0.exe (PID: 1196)
      • nas0.exe (PID: 1452)
      • remcos.exe (PID: 3032)
      • nas0.exe (PID: 2552)
      • nas0.exe (PID: 5796)
      • remcos.exe (PID: 5936)
      • remcos.exe (PID: 6072)
      • remcos.exe (PID: 5308)
      • nas0.exe (PID: 924)
      • remcos.exe (PID: 2152)
      • nas0.exe (PID: 2980)
      • nas0.exe (PID: 1912)
      • remcos.exe (PID: 1132)
      • nas0.exe (PID: 7020)
      • remcos.exe (PID: 3012)
      • remcos.exe (PID: 4868)
      • remcos.exe (PID: 6576)
      • remcos.exe (PID: 4736)
      • nas0.exe (PID: 1328)
      • nas0.exe (PID: 1388)
      • remcos.exe (PID: 2344)
      • nas0.exe (PID: 6828)
      • remcos.exe (PID: 4040)
      • nas0.exe (PID: 2780)
      • remcos.exe (PID: 6416)
      • nas0.exe (PID: 7100)
      • nas0.exe (PID: 3192)
      • remcos.exe (PID: 2980)
      • nas0.exe (PID: 5864)
      • nas0.exe (PID: 540)
      • remcos.exe (PID: 6388)
      • nas0.exe (PID: 6384)
      • remcos.exe (PID: 6148)
      • remcos.exe (PID: 5680)
      • nas0.exe (PID: 5452)
      • remcos.exe (PID: 6712)
      • nas0.exe (PID: 3768)
      • remcos.exe (PID: 4976)
      • remcos.exe (PID: 6656)
      • nas0.exe (PID: 7152)
      • remcos.exe (PID: 6048)
      • nas0.exe (PID: 4784)
      • nas0.exe (PID: 2664)
      • remcos.exe (PID: 736)
      • nas0.exe (PID: 7104)
      • remcos.exe (PID: 2664)
      • nas0.exe (PID: 668)
      • remcos.exe (PID: 5056)
      • nas0.exe (PID: 3024)
      • remcos.exe (PID: 6068)
      • nas0.exe (PID: 4528)
      • remcos.exe (PID: 3968)
      • nas0.exe (PID: 2284)
      • remcos.exe (PID: 5404)

    • Executable content was dropped or overwritten

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 5720)
      • remcos.exe (PID: 4040)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 856)
      • remcos.exe (PID: 6516)
      • remcos.exe (PID: 6592)
      • remcos.exe (PID: 5556)
      • remcos.exe (PID: 6108)
      • remcos.exe (PID: 5344)
      • remcos.exe (PID: 5436)
      • remcos.exe (PID: 6960)
      • remcos.exe (PID: 6300)
      • remcos.exe (PID: 6668)
      • remcos.exe (PID: 6816)
      • remcos.exe (PID: 6972)
      • remcos.exe (PID: 1512)
      • remcos.exe (PID: 4224)
      • remcos.exe (PID: 4012)
      • remcos.exe (PID: 2344)
      • remcos.exe (PID: 1628)
      • remcos.exe (PID: 4652)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 4380)
      • remcos.exe (PID: 208)
      • remcos.exe (PID: 5164)
      • remcos.exe (PID: 6068)
      • remcos.exe (PID: 6584)
      • remcos.exe (PID: 4040)
      • remcos.exe (PID: 5624)
      • remcos.exe (PID: 3008)
      • remcos.exe (PID: 5112)
      • remcos.exe (PID: 6252)
      • remcos.exe (PID: 7144)
      • remcos.exe (PID: 5188)
      • remcos.exe (PID: 2904)
      • remcos.exe (PID: 4000)
      • remcos.exe (PID: 896)
      • remcos.exe (PID: 900)
      • remcos.exe (PID: 2316)
      • remcos.exe (PID: 4692)
      • remcos.exe (PID: 456)
      • remcos.exe (PID: 6300)
      • remcos.exe (PID: 5756)
      • remcos.exe (PID: 672)
      • remcos.exe (PID: 4724)
      • remcos.exe (PID: 2240)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 5552)
      • remcos.exe (PID: 7012)
      • remcos.exe (PID: 2796)
      • remcos.exe (PID: 6384)
      • remcos.exe (PID: 2040)
      • remcos.exe (PID: 6268)
      • remcos.exe (PID: 5392)
      • remcos.exe (PID: 5116)
      • remcos.exe (PID: 2384)
      • remcos.exe (PID: 4692)

    • Reads the date of Windows installation

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 5720)
      • nas0.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 5720)
      • nas0.exe (PID: 6652)
      • remcos.exe (PID: 5892)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 5324)
      • remcos.exe (PID: 4040)
      • nas0.exe (PID: 4268)
      • remcos.exe (PID: 2136)
      • nas0.exe (PID: 6564)
      • remcos.exe (PID: 856)
      • nas0.exe (PID: 6392)
      • remcos.exe (PID: 6516)
      • nas0.exe (PID: 2140)
      • remcos.exe (PID: 6592)
      • nas0.exe (PID: 5680)
      • remcos.exe (PID: 5556)
      • nas0.exe (PID: 2384)
      • nas0.exe (PID: 2852)
      • remcos.exe (PID: 6108)
      • remcos.exe (PID: 5344)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2140)
      • wscript.exe (PID: 5548)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 1388)
      • wscript.exe (PID: 6068)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 4040)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 6272)
      • wscript.exe (PID: 4120)
      • wscript.exe (PID: 2284)
      • wscript.exe (PID: 536)
      • wscript.exe (PID: 3676)
      • wscript.exe (PID: 5304)
      • wscript.exe (PID: 2800)
      • wscript.exe (PID: 2284)
      • wscript.exe (PID: 2984)
      • wscript.exe (PID: 5116)
      • wscript.exe (PID: 5164)
      • wscript.exe (PID: 2432)
      • wscript.exe (PID: 7036)
      • wscript.exe (PID: 2040)
      • wscript.exe (PID: 5392)
      • wscript.exe (PID: 2240)
      • wscript.exe (PID: 3124)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 3156)
      • wscript.exe (PID: 5936)
      • wscript.exe (PID: 5800)
      • wscript.exe (PID: 632)
      • wscript.exe (PID: 2904)
      • wscript.exe (PID: 6560)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 4784)
      • wscript.exe (PID: 5436)
      • wscript.exe (PID: 2516)
      • wscript.exe (PID: 1020)
      • wscript.exe (PID: 900)
      • wscript.exe (PID: 6592)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 2240)
      • wscript.exe (PID: 4528)
      • wscript.exe (PID: 2064)
      • wscript.exe (PID: 4736)
      • wscript.exe (PID: 5800)
      • wscript.exe (PID: 5796)
      • wscript.exe (PID: 5668)
      • wscript.exe (PID: 232)
      • wscript.exe (PID: 672)
      • wscript.exe (PID: 2516)
      • wscript.exe (PID: 2088)
      • wscript.exe (PID: 2416)
      • wscript.exe (PID: 240)
      • wscript.exe (PID: 3016)
      • wscript.exe (PID: 1020)
      • wscript.exe (PID: 5544)
      • wscript.exe (PID: 6940)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2140)
      • wscript.exe (PID: 960)
      • wscript.exe (PID: 5548)
      • wscript.exe (PID: 4892)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 1388)
      • wscript.exe (PID: 6068)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 4040)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 6272)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 2140)
      • wscript.exe (PID: 5548)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 1388)
      • wscript.exe (PID: 6068)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 4040)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 6272)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2140)
      • wscript.exe (PID: 5800)
      • wscript.exe (PID: 5548)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 1388)
      • wscript.exe (PID: 6068)
      • wscript.exe (PID: 6044)
      • wscript.exe (PID: 4040)
      • wscript.exe (PID: 6816)
      • wscript.exe (PID: 6272)

    • The executable file from the user directory is run by the CMD process

      • remcos.exe (PID: 1072)
      • remcos.exe (PID: 6272)
      • remcos.exe (PID: 4812)
      • remcos.exe (PID: 5304)
      • remcos.exe (PID: 4724)
      • remcos.exe (PID: 5056)
      • remcos.exe (PID: 6068)
      • remcos.exe (PID: 1676)
      • remcos.exe (PID: 5608)
      • remcos.exe (PID: 6668)
      • remcos.exe (PID: 3884)
      • remcos.exe (PID: 6816)
      • remcos.exe (PID: 3176)
      • remcos.exe (PID: 6652)
      • remcos.exe (PID: 5960)
      • remcos.exe (PID: 5512)
      • remcos.exe (PID: 4756)
      • remcos.exe (PID: 5124)
      • remcos.exe (PID: 4068)
      • remcos.exe (PID: 2852)
      • remcos.exe (PID: 2152)
      • remcos.exe (PID: 6592)
      • remcos.exe (PID: 1748)
      • remcos.exe (PID: 4688)
      • remcos.exe (PID: 6072)
      • remcos.exe (PID: 4920)
      • remcos.exe (PID: 1180)
      • remcos.exe (PID: 680)
      • remcos.exe (PID: 6036)
      • remcos.exe (PID: 5756)
      • remcos.exe (PID: 3032)
      • remcos.exe (PID: 6072)
      • remcos.exe (PID: 5936)
      • remcos.exe (PID: 5308)
      • remcos.exe (PID: 2152)
      • remcos.exe (PID: 1132)
      • remcos.exe (PID: 4736)
      • remcos.exe (PID: 3012)
      • remcos.exe (PID: 6576)
      • remcos.exe (PID: 4868)
      • remcos.exe (PID: 4040)
      • remcos.exe (PID: 2344)
      • remcos.exe (PID: 6416)
      • remcos.exe (PID: 2980)
      • remcos.exe (PID: 6388)
      • remcos.exe (PID: 6148)
      • remcos.exe (PID: 6712)
      • remcos.exe (PID: 5680)
      • remcos.exe (PID: 4976)
      • remcos.exe (PID: 6656)
      • remcos.exe (PID: 6048)
      • remcos.exe (PID: 5056)
      • remcos.exe (PID: 736)
      • remcos.exe (PID: 2664)
      • remcos.exe (PID: 5404)
      • remcos.exe (PID: 6068)
      • remcos.exe (PID: 3968)

    • The process executes VB scripts

      • nas0.exe (PID: 5124)
      • nas0.exe (PID: 6652)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 5324)
      • nas0.exe (PID: 4268)
      • nas0.exe (PID: 6564)
      • nas0.exe (PID: 6392)
      • nas0.exe (PID: 2140)
      • nas0.exe (PID: 5680)
      • nas0.exe (PID: 2384)
      • nas0.exe (PID: 2852)
      • nas0.exe (PID: 6700)
      • nas0.exe (PID: 1388)
      • nas0.exe (PID: 6760)
      • nas0.exe (PID: 5072)
      • nas0.exe (PID: 1812)
      • nas0.exe (PID: 4728)
      • nas0.exe (PID: 2288)
      • nas0.exe (PID: 7156)
      • nas0.exe (PID: 6540)
      • nas0.exe (PID: 536)
      • nas0.exe (PID: 4628)
      • nas0.exe (PID: 6036)
      • nas0.exe (PID: 2288)
      • nas0.exe (PID: 2284)
      • nas0.exe (PID: 5512)
      • nas0.exe (PID: 1072)
      • nas0.exe (PID: 6248)
      • nas0.exe (PID: 660)
      • nas0.exe (PID: 5528)
      • nas0.exe (PID: 5400)
      • nas0.exe (PID: 6240)
      • nas0.exe (PID: 7036)
      • nas0.exe (PID: 6940)
      • nas0.exe (PID: 7148)
      • nas0.exe (PID: 4620)
      • nas0.exe (PID: 5176)
      • nas0.exe (PID: 4180)
      • nas0.exe (PID: 2104)
      • nas0.exe (PID: 3096)
      • nas0.exe (PID: 1600)
      • nas0.exe (PID: 3888)
      • nas0.exe (PID: 6960)
      • nas0.exe (PID: 1128)
      • nas0.exe (PID: 6572)
      • nas0.exe (PID: 6264)
      • nas0.exe (PID: 4300)
      • nas0.exe (PID: 3016)
      • nas0.exe (PID: 5112)
      • nas0.exe (PID: 6564)
      • nas0.exe (PID: 1628)
      • nas0.exe (PID: 4728)
      • nas0.exe (PID: 684)
      • nas0.exe (PID: 6620)
      • nas0.exe (PID: 6080)
      • nas0.exe (PID: 4284)
      • nas0.exe (PID: 5072)
      • nas0.exe (PID: 4736)
      • nas0.exe (PID: 5428)

    • Starts itself from another location

      • remcos.exe (PID: 5892)

  • INFO

    • Create files in a temporary directory

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 6644)
      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 6388)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 1072)
      • remcos.exe (PID: 5720)
      • nas0.exe (PID: 5176)
      • nas0.exe (PID: 6652)
      • nas0.exe (PID: 4652)
      • remcos.exe (PID: 4224)
      • remcos.exe (PID: 5892)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 3240)
      • nas0.exe (PID: 5324)
      • remcos.exe (PID: 6272)
      • remcos.exe (PID: 4040)
      • nas0.exe (PID: 2108)
      • nas0.exe (PID: 4268)
      • remcos.exe (PID: 4812)
      • remcos.exe (PID: 2136)
      • nas0.exe (PID: 6044)
      • nas0.exe (PID: 6564)
      • remcos.exe (PID: 5304)
      • remcos.exe (PID: 856)
      • nas0.exe (PID: 6392)
      • nas0.exe (PID: 3268)
      • remcos.exe (PID: 4724)
      • nas0.exe (PID: 2140)
      • remcos.exe (PID: 6516)
      • nas0.exe (PID: 1324)
      • remcos.exe (PID: 5056)
      • nas0.exe (PID: 6268)
      • nas0.exe (PID: 5680)
      • remcos.exe (PID: 6592)
      • remcos.exe (PID: 6068)
      • nas0.exe (PID: 4776)
      • nas0.exe (PID: 2384)
      • remcos.exe (PID: 5556)
      • remcos.exe (PID: 1676)
      • remcos.exe (PID: 6108)
      • nas0.exe (PID: 1628)
      • nas0.exe (PID: 2852)
      • remcos.exe (PID: 5608)
      • remcos.exe (PID: 5344)

    • The sample compiled with english language support

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 6644)
      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 5720)
      • remcos.exe (PID: 4040)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 856)
      • remcos.exe (PID: 6516)
      • remcos.exe (PID: 6592)
      • remcos.exe (PID: 5556)
      • remcos.exe (PID: 6108)
      • remcos.exe (PID: 5344)
      • remcos.exe (PID: 5436)
      • remcos.exe (PID: 6960)
      • remcos.exe (PID: 6816)
      • remcos.exe (PID: 6668)
      • remcos.exe (PID: 6300)
      • remcos.exe (PID: 1512)
      • remcos.exe (PID: 6972)
      • remcos.exe (PID: 4224)
      • remcos.exe (PID: 2344)
      • remcos.exe (PID: 4652)
      • remcos.exe (PID: 4012)
      • remcos.exe (PID: 4380)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 5164)
      • remcos.exe (PID: 208)
      • remcos.exe (PID: 5624)
      • remcos.exe (PID: 6584)
      • remcos.exe (PID: 4040)
      • remcos.exe (PID: 3008)
      • remcos.exe (PID: 6252)
      • remcos.exe (PID: 7144)
      • remcos.exe (PID: 5188)
      • remcos.exe (PID: 2904)
      • remcos.exe (PID: 4000)
      • remcos.exe (PID: 896)
      • remcos.exe (PID: 4692)
      • remcos.exe (PID: 2316)
      • remcos.exe (PID: 456)
      • remcos.exe (PID: 6300)
      • remcos.exe (PID: 900)
      • remcos.exe (PID: 672)
      • remcos.exe (PID: 2240)
      • remcos.exe (PID: 4724)
      • remcos.exe (PID: 5756)
      • remcos.exe (PID: 5552)
      • remcos.exe (PID: 7012)
      • remcos.exe (PID: 1276)
      • remcos.exe (PID: 2796)
      • remcos.exe (PID: 6384)
      • remcos.exe (PID: 5392)
      • remcos.exe (PID: 6268)
      • remcos.exe (PID: 2384)
      • remcos.exe (PID: 5116)
      • remcos.exe (PID: 4692)

    • Reads the computer name

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 6644)
      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 6388)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 5720)
      • nas0.exe (PID: 6652)
      • remcos.exe (PID: 1072)
      • nas0.exe (PID: 5176)
      • remcos.exe (PID: 4224)
      • nas0.exe (PID: 2088)
      • remcos.exe (PID: 5892)
      • nas0.exe (PID: 4652)
      • nas0.exe (PID: 3240)
      • nas0.exe (PID: 5324)
      • remcos.exe (PID: 6272)
      • remcos.exe (PID: 4040)
      • nas0.exe (PID: 2108)
      • nas0.exe (PID: 4268)
      • remcos.exe (PID: 4812)
      • nas0.exe (PID: 6044)
      • nas0.exe (PID: 6564)
      • remcos.exe (PID: 2136)
      • remcos.exe (PID: 5304)
      • remcos.exe (PID: 856)
      • nas0.exe (PID: 3268)
      • nas0.exe (PID: 6392)
      • remcos.exe (PID: 4724)
      • nas0.exe (PID: 1324)
      • nas0.exe (PID: 2140)
      • remcos.exe (PID: 6516)
      • remcos.exe (PID: 5056)
      • nas0.exe (PID: 6268)
      • nas0.exe (PID: 5680)
      • remcos.exe (PID: 6592)
      • remcos.exe (PID: 6068)
      • nas0.exe (PID: 4776)
      • nas0.exe (PID: 2384)
      • remcos.exe (PID: 5556)
      • remcos.exe (PID: 1676)
      • remcos.exe (PID: 6108)
      • nas0.exe (PID: 2852)
      • nas0.exe (PID: 1628)
      • remcos.exe (PID: 5608)
      • remcos.exe (PID: 5344)

    • Checks supported languages

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 6644)
      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 6388)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 1072)
      • nas0.exe (PID: 5176)
      • remcos.exe (PID: 5720)
      • nas0.exe (PID: 6652)
      • nas0.exe (PID: 4652)
      • remcos.exe (PID: 4224)
      • nas0.exe (PID: 2088)
      • remcos.exe (PID: 5892)
      • nas0.exe (PID: 3240)
      • nas0.exe (PID: 5324)
      • remcos.exe (PID: 6272)
      • remcos.exe (PID: 4040)
      • nas0.exe (PID: 2108)
      • nas0.exe (PID: 4268)
      • remcos.exe (PID: 4812)
      • remcos.exe (PID: 2136)
      • nas0.exe (PID: 6044)
      • nas0.exe (PID: 6564)
      • remcos.exe (PID: 856)
      • remcos.exe (PID: 5304)
      • nas0.exe (PID: 3268)
      • nas0.exe (PID: 6392)
      • remcos.exe (PID: 4724)
      • nas0.exe (PID: 2140)
      • remcos.exe (PID: 6516)
      • nas0.exe (PID: 1324)
      • remcos.exe (PID: 5056)
      • nas0.exe (PID: 6268)
      • remcos.exe (PID: 6592)
      • nas0.exe (PID: 5680)
      • remcos.exe (PID: 6068)
      • nas0.exe (PID: 2384)
      • remcos.exe (PID: 5556)
      • nas0.exe (PID: 4776)
      • remcos.exe (PID: 1676)
      • nas0.exe (PID: 1628)
      • nas0.exe (PID: 2852)
      • remcos.exe (PID: 6108)
      • remcos.exe (PID: 5344)
      • remcos.exe (PID: 5608)
      • nas0.exe (PID: 6540)

    • Auto-launch of the file from Registry key

      • nas0.exe (PID: 6388)
      • nas0.exe (PID: 5124)
      • nas0.exe (PID: 5176)
      • nas0.exe (PID: 6652)
      • nas0.exe (PID: 4652)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 3240)
      • nas0.exe (PID: 5324)
      • nas0.exe (PID: 4268)
      • nas0.exe (PID: 2108)
      • nas0.exe (PID: 6044)
      • nas0.exe (PID: 6564)
      • nas0.exe (PID: 3268)
      • nas0.exe (PID: 6392)
      • nas0.exe (PID: 2140)
      • nas0.exe (PID: 1324)
      • nas0.exe (PID: 6268)
      • nas0.exe (PID: 5680)
      • nas0.exe (PID: 4776)
      • nas0.exe (PID: 2384)
      • nas0.exe (PID: 1628)
      • nas0.exe (PID: 2852)

    • Reads Environment values

      • nas0.exe (PID: 5124)

    • Creates files or folders in the user directory

      • nas0.exe (PID: 5124)

    • Process checks computer location settings

      • dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe (PID: 2236)
      • nas0.exe (PID: 5124)
      • remcos.exe (PID: 5720)
      • nas0.exe (PID: 6652)
      • remcos.exe (PID: 5892)
      • nas0.exe (PID: 2088)
      • nas0.exe (PID: 5324)
      • remcos.exe (PID: 4040)
      • nas0.exe (PID: 4268)
      • remcos.exe (PID: 2136)
      • nas0.exe (PID: 6564)
      • remcos.exe (PID: 856)
      • nas0.exe (PID: 6392)
      • remcos.exe (PID: 6516)
      • nas0.exe (PID: 2140)
      • remcos.exe (PID: 6592)
      • nas0.exe (PID: 5680)
      • remcos.exe (PID: 5556)
      • nas0.exe (PID: 2384)
      • remcos.exe (PID: 6108)
      • nas0.exe (PID: 2852)
      • remcos.exe (PID: 5344)

    • Manual execution by a user

      • wscript.exe (PID: 5800)
      • remcos.exe (PID: 4224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:05:23 01:51:59+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 360448
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x12bc
OSVersion: 4
ImageVersion: 9.3
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.3.0.1
ProductVersionNumber: 9.3.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: sIemENs
ProductName: mem0
FileVersion: 9.03.0001
ProductVersion: 9.03.0001
InternalName: ste0
OriginalFileName: ste0.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
531
Monitored processes
412
Malicious processes
52
Suspicious processes
14

Behavior graph

Click at the process to see the details
start dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe no specs dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs wscript.exe no specs nas0.exe remcos.exe no specs remcos.exe no specs #REMCOS nas0.exe nas0.exe wscript.exe no specs #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe #REMCOS nas0.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs slui.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs nas0.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs remcos.exe no specs remcos.exe nas0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
remcos.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
9.03.0001
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
232"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\SysWOW64\wscript.exe—nas0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
240"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\SysWOW64\wscript.exe—nas0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
456C:\Users\admin\AppData\Roaming\remcos\remcos.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exe
remcos.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
9.03.0001
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
516"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Roaming\remcos\remcos.exe"C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
536"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\SysWOW64\wscript.exe—nas0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
536"C:\Users\admin\AppData\Local\Temp\nas0.exe" C:\Users\admin\AppData\Local\Temp\nas0.exe—nas0.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
9.03.0001
Modules
Images
c:\users\admin\appdata\local\temp\nas0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
540"C:\Users\admin\AppData\Local\Temp\nas0.exe" C:\Users\admin\AppData\Local\Temp\nas0.exe—remcos.exe
User:
admin
Company:
sIemENs
Integrity Level:
MEDIUM
Exit code:
0
Version:
9.03.0001
Modules
Images
c:\users\admin\appdata\local\temp\nas0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
Total events
89 526
Read events
89 331
Write events
195
Delete events
0

Modification events

(PID) Process:(6388) nas0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:men0
Value:
wscript "C:\Users\admin\AppData\Local\Temp\nas0.vbs"
(PID) Process:(2236) dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2236) dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2236) dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2236) dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5124) nas0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:remcos
Value:
"C:\Users\admin\AppData\Roaming\remcos\remcos.exe"
(PID) Process:(5124) nas0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Userinit
Value:
C:\WINDOWS\system32\userinit.exe, "C:\Users\admin\AppData\Roaming\remcos\remcos.exe"
(PID) Process:(5124) nas0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(5124) nas0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5124) nas0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
59
Suspicious files
295
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2236dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeC:\Users\admin\AppData\Local\Temp\nas0.exeexecutable
MD5:B57DC693A092B6AC0A574056C116C3E6
SHA256:B5BFECDFF7D6EA0AB0F9DA49C9FA818B9FC0802C55E4EE8E9AF175975D1C5556
6644dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeC:\Windows\win.inibinary
MD5:6BF517432F65EB7F0D18D574BF14124C
SHA256:6E2B70DFCCABF3CC651545676A3A566C9CFAE03F15F772886646ABCE1DA35B46
2236dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\win.inibinary
MD5:6BF517432F65EB7F0D18D574BF14124C
SHA256:6E2B70DFCCABF3CC651545676A3A566C9CFAE03F15F772886646ABCE1DA35B46
6644dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeC:\Users\admin\AppData\Local\Temp\~DFBD38E47705C76334.TMPbinary
MD5:04C1415D3344CC34F51763F132956894
SHA256:C852EF5871720E1F3EE651687020B35FE8744ACA0CF3FEB64089F7A3F0FDA299
2236dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeC:\Users\admin\AppData\Local\Temp\~DFE92E18BA021B382E.TMPbinary
MD5:04C1415D3344CC34F51763F132956894
SHA256:C852EF5871720E1F3EE651687020B35FE8744ACA0CF3FEB64089F7A3F0FDA299
6388nas0.exeC:\Users\admin\AppData\Local\Temp\~DFC3A7BF99AA65A7A6.TMPbinary
MD5:04C1415D3344CC34F51763F132956894
SHA256:C852EF5871720E1F3EE651687020B35FE8744ACA0CF3FEB64089F7A3F0FDA299
5124nas0.exeC:\Users\admin\AppData\Local\Temp\~DF7D5A6F4C6CECFA72.TMPbinary
MD5:04C1415D3344CC34F51763F132956894
SHA256:C852EF5871720E1F3EE651687020B35FE8744ACA0CF3FEB64089F7A3F0FDA299
5720remcos.exeC:\Users\admin\AppData\Local\Temp\~DF97A47BE48E23EFE0.TMPbinary
MD5:04C1415D3344CC34F51763F132956894
SHA256:C852EF5871720E1F3EE651687020B35FE8744ACA0CF3FEB64089F7A3F0FDA299
6652nas0.exeC:\Users\admin\AppData\Local\Temp\~DFD9AFF1C6678CD84B.TMPbinary
MD5:04C1415D3344CC34F51763F132956894
SHA256:C852EF5871720E1F3EE651687020B35FE8744ACA0CF3FEB64089F7A3F0FDA299
2236dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d.exeC:\Users\admin\AppData\Local\Temp\nas0.vbstext
MD5:9FAA21CC9D5456A442BFDE22B9BB04FF
SHA256:7E64C45254BFE67FB7D0445E9D2B5ED93F38176A2C6971B8C9937A5E22EFC67F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
20
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1116
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
644
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dc9375a06ad99fe6bf0f7ba9f425404303b525ce5b0d2ab6554d3a98c6317a8d