File name:

2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/5a3480ba-85c8-4954-915f-7cbb68c2491e
Verdict: Malicious activity
Analysis date: March 25, 2025, 03:52:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

4B1A0D1EBC9698300741114434B8F09B

SHA1:

D3E8D24C3E02B81F6A7D1B08F8AF21ABC888321A

SHA256:

4EBD649D7AD423A966882750490FEA1ABEC3FD2A458E8EFBCF7C147A499D3D72

SSDEEP:

98304:iefUuZuKAuf5jTFGkOefUuZuKAuf5jTFziy9/W10abzzpQXPJP0jjiGHaGx/LOLg:uySbzzdr0ijelYJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader~4.exe (PID: 7724)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 7788)
      • cmd.exe (PID: 7828)
      • net.exe (PID: 6808)
      • cmd.exe (PID: 7796)
      • net.exe (PID: 1272)
      • net.exe (PID: 1348)
      • net.exe (PID: 6040)
      • cmd.exe (PID: 7804)
      • net.exe (PID: 5380)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 7860)
      • net.exe (PID: 5352)

    • Uses NET.EXE to stop Windows Update service

      • cmd.exe (PID: 7796)
      • net.exe (PID: 6040)

    • Starts NET.EXE to view/change users localgroup

      • cmd.exe (PID: 7872)
      • net.exe (PID: 3176)

    • Uses NET.EXE to stop Windows Security Center service

      • cmd.exe (PID: 7804)
      • net.exe (PID: 5380)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Starts CMD.EXE for commands execution

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Starts a Microsoft application from unusual location

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7432)

    • Executable content was dropped or overwritten

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Executing commands from a ".bat" file

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7924)
      • sc.exe (PID: 7944)
      • sc.exe (PID: 7968)
      • sc.exe (PID: 7900)
      • sc.exe (PID: 7988)

    • Creates file in the systems drive root

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Starts itself from another location

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)

  • INFO

    • Creates files in the program directory

      • UpdatAuto.exe (PID: 7656)
      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)

    • The sample compiled with chinese language support

      • UpdatAuto.exe (PID: 7656)
      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)

    • Checks supported languages

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader~4.exe (PID: 7724)
      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Create files in a temporary directory

      • 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe (PID: 7528)
      • UpdatAuto.exe (PID: 7656)

    • Reads the computer name

      • UpdatAuto.exe (PID: 7656)

    • Reads the software policy settings

      • slui.exe (PID: 1196)

    • Checks proxy server information

      • slui.exe (PID: 1196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (33.5)
.exe | Win32 Executable MS Visual C++ (generic) (12.7)
.dll | Win32 Dynamic Link Library (generic) (2.6)
.exe | Win32 Executable (generic) (1.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:03:12 04:30:52+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 102400
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x27dc
OSVersion: 4
ImageVersion: 6.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.1.0.0
ProductVersionNumber: 6.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: Windows Update Manager for NT
CompanyName: Microsoft Corporation
FileDescription: Windows Update Manager for NT
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
ProductName: Microsoft(R) Windows (R) 2000 Operating System
FileVersion: 6.01
ProductVersion: 6.01
InternalName: INCUBUS
OriginalFileName: INCUBUS.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
48
Malicious processes
4
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe cmd.exe no specs conhost.exe no specs updatauto.exe cmd.exe no specs conhost.exe no specs 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader~4.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs slui.exe 2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904C:\WINDOWS\system32\net1 stop wscsvcC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1196C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1272net start TlntSvrC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1348net stop srserviceC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2432C:\WINDOWS\system32\net1 localgroup administrators helpassistant /addC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
3156C:\WINDOWS\system32\net1 start TlntSvrC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
3176net localgroup administrators helpassistant /addC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5352net user helpassistant 123456C:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5380net stop wscsvcC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6040net stop wuauservC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 977
Read events
3 977
Write events
0
Delete events
0

Modification events

No data
Executable files
19
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\ntldr~6executable
MD5:7BA125F12E8FF2464E4AE9F5FA164101
SHA256:826D84669941F4EB468634076AFEB3A3C77DB072FF5BA639A88AF15045174F30
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe —
MD5:—
SHA256:—
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe —
MD5:—
SHA256:—
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe —
MD5:—
SHA256:—
7656UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exeexecutable
MD5:E570C976FD2FFC673A95751735F43FDF
SHA256:33730FC6E3DE5093CC37012F77240DB1908AA1E3E4E34BAF1D1EABEBD6C3D36D
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\ntldr~8executable
MD5:7BA125F12E8FF2464E4AE9F5FA164101
SHA256:826D84669941F4EB468634076AFEB3A3C77DB072FF5BA639A88AF15045174F30
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exeexecutable
MD5:6F4950C49B691152F45F8D9CA3A82FAA
SHA256:3B8C959365F2312E5CCB35ECC0C55F276738C8E6AC53EAF4386D23C5BEF40B20
7656UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exeexecutable
MD5:6DB126FD2A8492356751E7156FE1D721
SHA256:7879C133FF83944D881FF9CF3AA97AD26346C5A8FFD1B0E769AC6EF0E4CBE648
7656UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exeexecutable
MD5:B12465BF3D6A2154487693817C2C39EB
SHA256:6AB34B2D980D39002749BC2830BC182A5B8D3C548EACB3F245A96A299B8326BE
75282025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exeexecutable
MD5:A9992C5717DCF8965FF8E50EF3C5C66B
SHA256:4E7A0900BE96E47B279B19D74BBE4CCB9CF430DF0B20A6DEA69AB0542AF1C23E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
22
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7348
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1196
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-25_4b1a0d1ebc9698300741114434b8f09b_hijackloader_remcos_rhadamanthys_smoke-loader