File name:

5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63

Full analysis: https://app.any.run/tasks/006da351-17c7-4106-8182-8b816368e095
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: January 10, 2025, 22:06:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
remcos
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

15214C528C41DE4D5E542EBD3D4AC075

SHA1:

BDAB48D323AB0E0C4689061DB5FB08ADFE1AFEC8

SHA256:

5AEB1293C473A66795BF0FF3A7892E6A6CF70AEA5248A38F204632A5FDBE1F63

SSDEEP:

49152:/7JoM+hSQIhrl+dek2farVLMiZ9at7JHOGPq8iGG+aFx9Id3bhU2GPritwMLHez3:Th+hBIhAdEaZYiDat75DbiGGNId3qPU0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS mutex has been found

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Executing a file with an untrusted certificate

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Changes the autorun value in the registry

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • REMCOS has been detected

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • The process creates files with name similar to system file names

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Application launched itself

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Executable content was dropped or overwritten

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Checks Windows Trust Settings

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Connects to unusual port

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
  • INFO

    • Creates files or folders in the user directory

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • The sample compiled with english language support

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Checks supported languages

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Reads the computer name

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Reads the software policy settings

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Checks proxy server information

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Reads the machine GUID from the registry

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Create files in a temporary directory

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 00:50:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x3384
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.0
ProductVersionNumber: 2.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Cincinnati Financial Corp.
FileDescription: Beverly Enterprises, Inc.
InternalName: capillitia.exe
LegalTrademarks: Science Applications Intl. Inc.
OriginalFileName: capillitia.exe
ProductVersion: 2.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe #REMCOS 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe

Process information

PID
CMD
Path
Indicators
Parent process
6488"C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe" C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Beverly Enterprises, Inc.
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6988"C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe" C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Beverly Enterprises, Inc.
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
701
Read events
697
Write events
4
Delete events
0

Modification events

(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Startup key
Value:
C:\Users\admin\AppData\Local\Temp\subfolder1\Reaccented.scr
(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-A65UIX
Operation:writeName:exepath
Value:
485474EB288CF884300FD019A7A5ADAB1DDEECE265DE49DECE3C0571BC63AF5A08D0B2697B87405FD77565E166459DAC8E804A9134391AC9ACA81C833733859B868A6042819CF883113056762C4457F3947FE0623FB3D1F09356D0306AF4C5E1B5556589DF2962C2B860F16D3F75E0724F859B06025F51EF132CA01B82FE318BC4A2600F8EB3ABCF43ACFE89A974DA14A377BC75F1DE40EEC29F40AD1F5665359F8BAD4221E070D83C21770432400DD550712BD82CEF1A51C925375CC7CA6D88A4C1B8D7D8FE3E82899BFA923BFD
(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-A65UIX
Operation:writeName:licence
Value:
1CD412A4B30C4D2A45A11E95E89EBD6F
(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-A65UIX
Operation:writeName:time
Value:
Executable files
1
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\Afprikkendes.pse
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\brolins.par
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\gruffness.mis
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\ptca.ant
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\understaaet.sno
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Local\Temp\nsq595F.tmp
MD5:
SHA256:
69885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\Unshieldable.txttext
MD5:78D840110C9709A6F508016469DB3D70
SHA256:C5B25CB253F46AA344C6543D87B93B973337D71CFE28D82F1A138E35A957F81C
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Local\Temp\nsi798A.tmp\System.dllexecutable
MD5:0063D48AFE5A0CDC02833145667B6641
SHA256:AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Local\Temp\BeConf.initext
MD5:F137EACC81A3C5E9073165BAB5FFAAFD
SHA256:79B76619F520E5E1CCFD2DE8802890CEA50E0052C21BE7777DBEC9F2F2BC626E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
39
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
2224
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.198.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
7040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
2224
svchost.exe
GET
200
2.19.198.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6988
5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
whitelisted
6292
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.19.198.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2224
svchost.exe
2.19.198.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2224
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.19.198.43
  • 23.32.238.88
  • 23.32.238.106
  • 23.32.238.112
  • 23.32.238.155
  • 23.32.238.97
  • 2.19.198.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.160
  • 104.126.37.185
  • 104.126.37.137
  • 104.126.37.131
  • 104.126.37.171
  • 104.126.37.130
  • 104.126.37.170
  • 104.126.37.129
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info