File name:

5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63

Full analysis: https://app.any.run/tasks/006da351-17c7-4106-8182-8b816368e095
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: January 10, 2025, 22:06:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
remcos
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

15214C528C41DE4D5E542EBD3D4AC075

SHA1:

BDAB48D323AB0E0C4689061DB5FB08ADFE1AFEC8

SHA256:

5AEB1293C473A66795BF0FF3A7892E6A6CF70AEA5248A38F204632A5FDBE1F63

SSDEEP:

49152:/7JoM+hSQIhrl+dek2farVLMiZ9at7JHOGPq8iGG+aFx9Id3bhU2GPritwMLHez3:Th+hBIhAdEaZYiDat75DbiGGNId3qPU0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Changes the autorun value in the registry

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • REMCOS mutex has been found

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • REMCOS has been detected

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Executable content was dropped or overwritten

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Application launched itself

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Checks Windows Trust Settings

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Reads security settings of Internet Explorer

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Connects to unusual port

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
  • INFO

    • The sample compiled with english language support

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Checks supported languages

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Reads the computer name

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Create files in a temporary directory

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Creates files or folders in the user directory

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6488)
    • Checks proxy server information

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Reads the machine GUID from the registry

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
    • Reads the software policy settings

      • 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe (PID: 6988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 2.0.0.0
OriginalFileName: capillitia.exe
LegalTrademarks: Science Applications Intl. Inc.
InternalName: capillitia.exe
FileDescription: Beverly Enterprises, Inc.
Comments: Cincinnati Financial Corp.
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 2.0.0.0
FileVersionNumber: 2.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3384
UninitializedDataSize: 1024
InitializedDataSize: 118784
CodeSize: 25088
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2019:12:16 00:50:50+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe #REMCOS 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe

Process information

PID
CMD
Path
Indicators
Parent process
6488"C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe" C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Beverly Enterprises, Inc.
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6988"C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe" C:\Users\admin\AppData\Local\Temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Beverly Enterprises, Inc.
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
701
Read events
697
Write events
4
Delete events
0

Modification events

(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Startup key
Value:
C:\Users\admin\AppData\Local\Temp\subfolder1\Reaccented.scr
(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-A65UIX
Operation:writeName:exepath
Value:
485474EB288CF884300FD019A7A5ADAB1DDEECE265DE49DECE3C0571BC63AF5A08D0B2697B87405FD77565E166459DAC8E804A9134391AC9ACA81C833733859B868A6042819CF883113056762C4457F3947FE0623FB3D1F09356D0306AF4C5E1B5556589DF2962C2B860F16D3F75E0724F859B06025F51EF132CA01B82FE318BC4A2600F8EB3ABCF43ACFE89A974DA14A377BC75F1DE40EEC29F40AD1F5665359F8BAD4221E070D83C21770432400DD550712BD82CEF1A51C925375CC7CA6D88A4C1B8D7D8FE3E82899BFA923BFD
(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-A65UIX
Operation:writeName:licence
Value:
1CD412A4B30C4D2A45A11E95E89EBD6F
(PID) Process:(6988) 5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-A65UIX
Operation:writeName:time
Value:
Executable files
1
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\Afprikkendes.pse
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\brolins.par
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\gruffness.mis
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\ptca.ant
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\understaaet.sno
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Local\Temp\nsq595F.tmp
MD5:
SHA256:
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\udstyringsindikatoren.inwbinary
MD5:7F2BF13C70E094999CA92A423DCCDB92
SHA256:3A2304AABDE64DDBB367916594F86E9E8016A35119914FB51316BAF272B7A99B
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\Unshieldable.txttext
MD5:78D840110C9709A6F508016469DB3D70
SHA256:C5B25CB253F46AA344C6543D87B93B973337D71CFE28D82F1A138E35A957F81C
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\Carettochelydidae.Flabinary
MD5:4E7C6200C8B194A91D15B4206F109CAA
SHA256:CA639A96999216A68DAEAB7529D09DBA8F35D4449DCD36DC036C8E8BABB3078B
64885aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Acrimoniousness\kamik.senbinary
MD5:0507D743AD7E1ABA22BC2024E4813353
SHA256:FF629154C61F5DBC70FFA5604F7D4F0DE88A982E0E034EAA72339B5B52A92404
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
39
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.198.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2224
svchost.exe
GET
200
2.19.198.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2224
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
7040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6292
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
7040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6988
5aeb1293c473a66795bf0ff3a7892e6a6cf70aea5248a38f204632a5fdbe1f63.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.19.198.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2224
svchost.exe
2.19.198.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2224
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.19.198.43
  • 23.32.238.88
  • 23.32.238.106
  • 23.32.238.112
  • 23.32.238.155
  • 23.32.238.97
  • 2.19.198.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.160
  • 104.126.37.185
  • 104.126.37.137
  • 104.126.37.131
  • 104.126.37.171
  • 104.126.37.130
  • 104.126.37.170
  • 104.126.37.129
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info