File name:

DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe

Full analysis: https://app.any.run/tasks/febece60-cac4-4c81-a0f8-44d46b474942
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: April 15, 2024, 13:21:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1DC05BB88E08081AA12630A145E74A61

SHA1:

664D10D7690745E2F5648B1169C0E1742848BBCC

SHA256:

5C1EEA51F3ADD814120CC406D6850A632341E438F814A127E7D7B86444F76E7E

SSDEEP:

98304:IyK5gZXFj8cf8uCiM6mAUyRSNTBrUiln602NGokrOiLl/:oxT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 1020)

    • Changes the autorun value in the registry

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 1020)

    • REMCOS has been detected

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)
      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)
      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

    • REMCOS has been detected (YARA)

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 1020)

    • Application launched itself

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 1020)

    • Connects to unusual port

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

    • Writes files like Keylogger logs

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

  • INFO

    • Checks supported languages

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 1020)
      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

    • Reads the computer name

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

    • Reads Environment values

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

    • Reads product name

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)

    • Creates files in the program directory

      • DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe (PID: 948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(948) DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe
C2 (1)chichonexpress.con-ip.com:1993
BotnetBENDECIDO
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-P18SUH
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:06:16 08:47:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 1508352
InitializedDataSize: 1238528
UninitializedDataSize: -
EntryPoint: 0x137e99
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 11.1.0.2037
ProductVersionNumber: 11.1.0.2037
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Disc Soft Ltd
FileDescription: DAEMON Tools Lite
FileVersion: 11.1.0.2037
InternalName: DTLite.exe
LegalCopyright: © 2007-2022 Disc Soft Ltd.
LegalTrademarks: -
OriginalFileName: DTLite.exe
ProductName: DAEMON Tools Lite
ProductVersion: 11.1.0.2037
AssemblyVersion: 11.1.0.2037
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dema no 2146541165161645161644561 abril 12 del 2024.exe #REMCOS dema no 2146541165161645161644561 abril 12 del 2024.exe

Process information

PID
CMD
Path
Indicators
Parent process
948"C:\Users\admin\AppData\Local\Temp\DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe"C:\Users\admin\AppData\Local\Temp\DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe
DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe
User:
admin
Company:
Disc Soft Ltd
Integrity Level:
MEDIUM
Description:
DAEMON Tools Lite
Version:
11.1.0.2037
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Remcos
(PID) Process(948) DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe
C2 (1)chichonexpress.con-ip.com:1993
BotnetBENDECIDO
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-P18SUH
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
1020"C:\Users\admin\AppData\Local\Temp\DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe" C:\Users\admin\AppData\Local\Temp\DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe
explorer.exe
User:
admin
Company:
Disc Soft Ltd
Integrity Level:
MEDIUM
Description:
DAEMON Tools Lite
Exit code:
0
Version:
11.1.0.2037
Modules
Images
c:\users\admin\appdata\local\temp\dema no 2146541165161645161644561 abril 12 del 2024.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
257
Read events
253
Write events
4
Delete events
0

Modification events

(PID) Process:(1020) DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Msporadic3
Value:
C:\Users\admin\Documents\ChromeUpdate\MHOST.exe
(PID) Process:(948) DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exeKey:HKEY_CURRENT_USER\Software\Rmc-P18SUH
Operation:writeName:exepath
Value:
1DCA251AB4D9816C12E2C7E32A61B1E79DC1040692CB5C2BC97381246F66C77FF861CFD7AF7F53DA8A8AAABBC50F3BFE4AD0C2ECC071DD469F92B4941F51AA33FF33017D8739721DBA8DC861AF64963D26BC0EF35DB016DA06CF8DA2FA28FB9DDA533F510913ECA5F8825152FB10BBDC4E7B927931DDBC91372D4D3CBEF7F176C8499F9743E58C97A6CBC45C3AAC67F7C6292528F8507248AB8A3C6DC2FA7BFB92743C646123DBC18CE83F27C3A2E998994714D8
(PID) Process:(948) DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exeKey:HKEY_CURRENT_USER\Software\Rmc-P18SUH
Operation:writeName:licence
Value:
0D8C3C4C423A1D4F37D3E60828A45BCF
(PID) Process:(948) DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exeKey:HKEY_CURRENT_USER\Software\Rmc-P18SUH
Operation:writeName:time
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
948DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exeC:\ProgramData\remcos\logs.datbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
4
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
948
DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe
181.131.219.106:1993
chichonexpress.con-ip.com
EPM Telecomunicaciones S.A. E.S.P.
CO
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared
chichonexpress.con-ip.com
  • 181.131.219.106
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
—
—
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DEMA No 2146541165161645161644561 ABRIL 12 DEL 2024.exe