File name:

53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59

Full analysis: https://app.any.run/tasks/a57e554f-4314-4c82-9f20-fcb818fbd31e
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 00:52:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

AF601C308C50C6FDABC352CC9F7B4C5E

SHA1:

A65125A24E01AA7D015BFA67A5682C7ED5374397

SHA256:

53A4727B9456DEE6C0569D912FBC3184D953FB8009AB380204CC9B72FFD36C59

SSDEEP:

24576:RR6DWlBFtLgC23F9WC5WzS4IZjdNFEKid7Hwqgej:RoDWlBFtLgC23F9t5WzS4I9dNFEKid7h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • REMCOS has been detected

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

    • REMCOS mutex has been found

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

    • REMCOS has been detected (YARA)

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • Reads security settings of Internet Explorer

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • Application launched itself

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • There is functionality for taking screenshot (YARA)

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

    • Connects to unusual port

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

  • INFO

    • Reads the computer name

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)
      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

    • Checks supported languages

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)
      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

    • Reads the machine GUID from the registry

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • Process checks computer location settings

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • Creates files or folders in the user directory

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)
      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 632)

    • Create files in a temporary directory

      • 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe (PID: 5376)

    • Reads the software policy settings

      • slui.exe (PID: 6032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(632) 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
C2 (1)37.120.210.211:42830
BotnetLLC
Options
Connect_interval5
Install_flagFalse
Install_HKCU\RunTrue
Setup_path%APPDATA%
Copy_fileremcos.exe
Startup_valueremcos
Hide_fileFalse
Mutex_nameremcos_kxrqyvuobd
Keylog_flag1
Keylog_path%APPDATA%
Keylog_filellc.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreens
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%APPDATA%
Audio_diraudio
Connect_delay0
Copy_dirremcos
Keylog_dirllc
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:25 06:04:56+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 654848
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xa1d4e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Change Tracking
FileVersion: 1.0.0.0
InternalName: lRaT.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: lRaT.exe
ProductName: Change Tracking
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe sppextcomobj.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe no specs 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe no specs #REMCOS 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(632) 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
C2 (1)37.120.210.211:42830
BotnetLLC
Options
Connect_interval5
Install_flagFalse
Install_HKCU\RunTrue
Setup_path%APPDATA%
Copy_fileremcos.exe
Startup_valueremcos
Hide_fileFalse
Mutex_nameremcos_kxrqyvuobd
Keylog_flag1
Keylog_path%APPDATA%
Keylog_filellc.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreens
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%APPDATA%
Audio_diraudio
Connect_delay0
Copy_dirremcos
Keylog_dirllc
1244\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1600C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4408"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\htAGvcqop" /XML "C:\Users\admin\AppData\Local\Temp\tmp4822.tmp"C:\Windows\SysWOW64\schtasks.exe—53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5376"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe" C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6032"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6132"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe—53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6872"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe"C:\Users\admin\AppData\Local\Temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe—53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
1 218
Read events
1 217
Write events
1
Delete events
0

Modification events

(PID) Process:(632) 53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exeKey:HKEY_CURRENT_USER\SOFTWARE\remcos_kxrqyvuobd
Operation:writeName:EXEpath
Value:
õ} MãŸmB ÛWŠ½jn rÞ*ªC›„Ï3náZäo?rt¡I ä\x÷Õý†ãqÓiŽ¡ëçŒÃŸ×
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
537653a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exeC:\Users\admin\AppData\Roaming\htAGvcqop.exeexecutable
MD5:AF601C308C50C6FDABC352CC9F7B4C5E
SHA256:53A4727B9456DEE6C0569D912FBC3184D953FB8009AB380204CC9B72FFD36C59
63253a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exeC:\Users\admin\AppData\Roaming\llc\llc.dattext
MD5:89B5667E995FBEB88EDDA0BAC2FD47C4
SHA256:EE321AE724EA998CADB15526D3573191C892653D28A8AA7DE43413AE2DCE5E79
537653a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59.exeC:\Users\admin\AppData\Local\Temp\tmp4822.tmpxml
MD5:6B3CE483C64600CD44628600A323E618
SHA256:1191B227CF14A4AE6E133411DC3FC5CC8CB794EC00F2613637283C08328B6264
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2568
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2568
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.67
  • 20.190.160.131
  • 20.190.160.2
  • 40.126.32.72
  • 20.190.160.65
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59