File name:

release.exe

Full analysis: https://app.any.run/tasks/bc0b8eed-596e-4602-8b79-e70c02cd23fa
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: December 15, 2024, 14:50:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

BE4CBE10F071B583895EB48B532E837A

SHA1:

CF7FE65594AA9D74A23B35CB608C01E6A7912014

SHA256:

610F0AC7F61D0E450281941A5476F6316FA14DDD6FD06210029905246B56B0EF

SSDEEP:

12288:wOEReW+1UKKiFpIXZTc4w7SzWce0cPlA3+GpWVVVVVVVVVVVVVVVVV8Z:wPReW+1UZTc4w55AuGpZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS has been detected

      • release.exe (PID: 5564)
    • REMCOS mutex has been found

      • release.exe (PID: 5564)
    • REMCOS has been detected (YARA)

      • release.exe (PID: 5564)
    • REMCOS has been detected (SURICATA)

      • release.exe (PID: 5564)
  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • release.exe (PID: 5564)
    • Connects to unusual port

      • release.exe (PID: 5564)
  • INFO

    • Reads the machine GUID from the registry

      • release.exe (PID: 5564)
    • Checks supported languages

      • release.exe (PID: 5564)
    • Reads the computer name

      • release.exe (PID: 5564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:08:20 16:46:22+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 303616
InitializedDataSize: 128512
UninitializedDataSize: -
EntryPoint: 0x2acdc
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REMCOS release.exe

Process information

PID
CMD
Path
Indicators
Parent process
5564"C:\Users\admin\Desktop\release.exe" C:\Users\admin\Desktop\release.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\release.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 793
Read events
1 792
Write events
1
Delete events
0

Modification events

(PID) Process:(5564) release.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-KV6OTY
Operation:writeName:licence
Value:
139E2953A103495EC6D700A5F8A9E2F5
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
139
DNS requests
6
Threats
242

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
192.168.100.255:137
whitelisted
3508
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
104.126.37.177:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.168.100.255:138
whitelisted
5564
release.exe
204.10.194.175:4444
Advin Services LLC
CA
malicious
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3508
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.177
  • 104.126.37.153
  • 104.126.37.161
  • 104.126.37.184
  • 104.126.37.154
  • 104.126.37.179
  • 104.126.37.162
  • 104.126.37.176
  • 104.126.37.178
whitelisted
google.com
  • 172.217.23.110
whitelisted
self.events.data.microsoft.com
  • 20.189.173.8
whitelisted

Threats

PID
Process
Class
Message
5564
release.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5564
release.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5564
release.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5564
release.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5564
release.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5564
release.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5564
release.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5564
release.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5564
release.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5564
release.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info