analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | dmw.7z |
| Full analysis: | https://app.any.run/tasks/a1f93786-acb2-48af-92d4-5f857dd4308c |
| Verdict: | Malicious activity |
| Threats: | Remcos is a RAT type malware that attackers use to perform actions on infected machines remotely. This malware is extremely actively caped up to date with updates coming out almost every single month. |
| Analysis date: | April 01, 2023, 03:32:44 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 975835F89302280A3B2B7CFA98D39E8C |
| SHA1: | E638B8D61D472698BE3F7CDD481F9E3E6976272C |
| SHA256: | 52ABDCCA7E18EA77CA6FFF3BC2354B2A86955A518750F65E79CFE27A33303B4E |
| SSDEEP: | 12288:/xLFMgtvpAGmXnYJO2YZSTm76xV9jokAjn44GPKX:dFvtB7VL+6PikGnBeKX |
MALICIOUS
Uses Task Scheduler to run other applications
- cmd.exe (PID: 1788)
REMCOS detected by memory dumps
- RegAsm.exe (PID: 1848)
SUSPICIOUS
Starts CMD.EXE for commands execution
- dmw.exe (PID: 1700)
Connects to unusual port
- RegAsm.exe (PID: 1848)
INFO
Reads the machine GUID from the registry
- dmw.exe (PID: 1700)
The process checks LSA protection
- dmw.exe (PID: 1700)
Checks supported languages
- dmw.exe (PID: 1700)
- RegAsm.exe (PID: 1848)
Reads the computer name
- dmw.exe (PID: 1700)
- RegAsm.exe (PID: 1848)
Reads product name
- RegAsm.exe (PID: 1848)
Reads Environment values
- RegAsm.exe (PID: 1848)
Creates files or folders in the user directory
- cmd.exe (PID: 1564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Remcos
(PID) Process(1848) RegAsm.exe
Max_keylog_file10000
Keylog_dirKey
Copy_dirremcos
Connect_delay0
Audio_dirMicRecords
Audio_path%APPDATA%
Audio_record_time5
Delete_fileFalse
Mouse_optionFalse
Screenshot_cryptFalse
Screenshot_fileScreenshots
Screenshot_path%APPDATA%
Screenshot_namewikipedia;solitaire;
Take_ScreenshotFalse
Screenshot_time5
Screenshot_flagFalse
Hide_keylogFalse
Keylog_cryptFalse
Keylog_filelogs.dat
Keylog_path%APPDATA%
Keylog_flag1
Mutex_nameXvJh6JkpIuTr5CxWsZxQws0ktg8nKko3Tyui78IkmPLwQe3FbVsQA-0K16Y8
Hide_fileFalse
Startup_valueremcos
Copy_fileremcos.exe
Setup_path%APPDATA%
Install_HKLM\Explorer\Run1
Install_HKCU\RunTrue
Install_flagFalse
Connect_interval1
BotnetMARZO2023
Hosts (1)hotsdefender.webredirect.org:2404
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
44
Monitored processes
7
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2824 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\dmw.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 1700 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2824.47322\dmw.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2824.47322\dmw.exe | — | WinRAR.exe | |||||||||||
User: admin Company: AnyDesk Software GmbH Integrity Level: MEDIUM Description: AnyDesk Exit code: 4294967295 Version: 7.1.8 Modules
| |||||||||||||||
| 1848 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | dmw.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
Remcos(PID) Process(1848) RegAsm.exe Max_keylog_file10000 Keylog_dirKey Copy_dirremcos Connect_delay0 Audio_dirMicRecords Audio_path%APPDATA% Audio_record_time5 Delete_fileFalse Mouse_optionFalse Screenshot_cryptFalse Screenshot_fileScreenshots Screenshot_path%APPDATA% Screenshot_namewikipedia;solitaire; Take_ScreenshotFalse Screenshot_time5 Screenshot_flagFalse Hide_keylogFalse Keylog_cryptFalse Keylog_filelogs.dat Keylog_path%APPDATA% Keylog_flag1 Mutex_nameXvJh6JkpIuTr5CxWsZxQws0ktg8nKko3Tyui78IkmPLwQe3FbVsQA-0K16Y8 Hide_fileFalse Startup_valueremcos Copy_fileremcos.exe Setup_path%APPDATA% Install_HKLM\Explorer\Run1 Install_HKCU\RunTrue Install_flagFalse Connect_interval1 BotnetMARZO2023 Hosts (1)hotsdefender.webredirect.org:2404 | |||||||||||||||
| 1224 | "cmd" /c mkdir "C:\Users\admin\AppData\Roaming\creavt" | C:\Windows\System32\cmd.exe | — | dmw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1788 | "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\admin\AppData\Roaming\creavt\creavt.exe'" /f | C:\Windows\System32\cmd.exe | — | dmw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1564 | "cmd" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXa2824.47322\dmw.exe" "C:\Users\admin\AppData\Roaming\creavt\creavt.exe" | C:\Windows\System32\cmd.exe | — | dmw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3212 | schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\admin\AppData\Roaming\creavt\creavt.exe'" /f | C:\Windows\System32\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 548
Read events
3 516
Write events
32
Delete events
0
Modification events
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2824.47322\dmw.exe | — | |
MD5:— | SHA256:— | |||
| 1564 | cmd.exe | C:\Users\admin\AppData\Roaming\creavt\creavt.exe | — | |
MD5:— | SHA256:— | |||
| 1848 | RegAsm.exe | C:\Users\admin\AppData\Roaming\Key\logs.dat | binary | |
MD5:928AEAF806A8B1C76C5632CA314BCDCD | SHA256:564288DCB7F272D8B6FF6BB1A709BA292E5089CBE24282FBEDC5FAEA5303D0C3 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1848 | RegAsm.exe | 154.29.75.191:2404 | hotsdefender.webredirect.org | TIER-NET | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
hotsdefender.webredirect.org |
| malicious |