File name:

RuneLite.jar

Full analysis: https://app.any.run/tasks/2f9149dc-4f41-42ea-836e-2b254c419ae7
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: September 17, 2018, 02:13:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
trojan
rat
remcos
keylogger
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

F5EDF5D3B707D5C59974CFC6A07951E9

SHA1:

30807A33B71CE7B67C8FEC5EFF9FB3C8B52B64B0

SHA256:

6247726793E23829E78226B516EC19FDE2F685B11634AB3B185C07C52F5F8094

SSDEEP:

98304:tGWGy22SPBNBYIY7JYHvvlyVW4UgA1wb0:tjy2SPBlYaPv500

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • REMCOS RAT was detected

      • help.exe (PID: 3968)
    • Loads dropped or rewritten executable

      • java.exe (PID: 1028)
    • Detected logs from REMCOS RAT

      • help.exe (PID: 3968)
      • help.exe (PID: 3964)
    • Connects to CnC server

      • help.exe (PID: 3964)
    • REMCOS was detected

      • help.exe (PID: 3964)
  • SUSPICIOUS

    • Creates files in the user directory

      • help.exe (PID: 3964)
      • javaw.exe (PID: 2780)
      • help.exe (PID: 3968)
    • Modifies the open verb of a shell class

      • java.exe (PID: 1028)
    • Connects to unusual port

      • help.exe (PID: 3968)
      • java.exe (PID: 1028)
      • help.exe (PID: 3964)
    • Executable content was dropped or overwritten

      • java.exe (PID: 1028)
    • Writes files like Keylogger logs

      • help.exe (PID: 3964)
      • help.exe (PID: 3968)
    • Executes JAVA applets

      • javaw.exe (PID: 2780)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.maff | Mozilla Archive Format (gen) (63.6)
.zip | ZIP compressed archive (36.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2018:09:02 12:46:12
ZipCRC: 0x9a95955c
ZipCompressedSize: 65
ZipUncompressedSize: 69
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start javaw.exe clientnull.exe no specs clientnull64.exe no specs java.exe #REMCOS help.exe #REMCOS help.exe

Process information

PID
CMD
Path
Indicators
Parent process
1028"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -cp C:\Users\admin\.runelite\repository2\client-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\slf4j-api-1.7.25.jar;C:\Users\admin\.runelite\repository2\logback-classic-1.2.3.jar;C:\Users\admin\.runelite\repository2\logback-core-1.2.3.jar;C:\Users\admin\.runelite\repository2\jopt-simple-5.0.1.jar;C:\Users\admin\.runelite\repository2\guava-23.2-jre.jar;C:\Users\admin\.runelite\repository2\jsr305-1.3.9.jar;C:\Users\admin\.runelite\repository2\error_prone_annotations-2.0.18.jar;C:\Users\admin\.runelite\repository2\j2objc-annotations-1.1.jar;C:\Users\admin\.runelite\repository2\animal-sniffer-annotations-1.14.jar;C:\Users\admin\.runelite\repository2\guice-4.1.0-no_aop.jar;C:\Users\admin\.runelite\repository2\javax.inject-1.jar;C:\Users\admin\.runelite\repository2\aopalliance-1.0.jar;C:\Users\admin\.runelite\repository2\gson-2.8.5.jar;C:\Users\admin\.runelite\repository2\substance-8.0.02.jar;C:\Users\admin\.runelite\repository2\trident-1.5.00.jar;C:\Users\admin\.runelite\repository2\commons-text-1.2.jar;C:\Users\admin\.runelite\repository2\commons-lang3-3.7.jar;C:\Users\admin\.runelite\repository2\runelite-api-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\runescape-api-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\injected-client-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\http-api-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\okhttp-3.7.0.jar;C:\Users\admin\.runelite\repository2\okio-1.12.0.jar;C:\Users\admin\.runelite\repository2\commons-csv-1.4.jar;C:\Users\admin\.runelite\repository2\discord-1.0.jar;C:\Users\admin\.runelite\repository2\jna-4.5.1.jar -Xmx512m -Xss2m -XX:CompileThreshold=1500 -Xincgc -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -Djna.nosys=true -Dsun.java2d.noddraw=false -Dsun.java2d.opengl=false -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Drunelite.launcher.version=1.6.1-SNAPSHOT net.runelite.client.RuneLiteC:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1908C:\Users\admin\AppData\Roaming\clientNull64.exeC:\Users\admin\AppData\Roaming\clientNull64.exejavaw.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\users\admin\appdata\roaming\clientnull64.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2780"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\RuneLite.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3196C:\Users\admin\AppData\Roaming\clientNull.exeC:\Users\admin\AppData\Roaming\clientNull.exejavaw.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\users\admin\appdata\roaming\clientnull.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3964C:\Users\admin\AppData\Roaming\clientNull64.exeC:\Windows\System32\help.exe
clientNull64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Help Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\4v1q5bqbuiakkaao
c:\windows\system32\help.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3968C:\Users\admin\AppData\Roaming\clientNull.exeC:\Windows\System32\help.exe
clientNull.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Help Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\xkpkvlgtra9i94mn
c:\windows\system32\help.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
772
Read events
762
Write events
10
Delete events
0

Modification events

(PID) Process:(2780) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
javaw.exe
(PID) Process:(1028) java.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
java.exe
(PID) Process:(1028) java.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072
Operation:writeName:
Value:
URL:Run game 409416265891971072 protocol
(PID) Process:(1028) java.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072
Operation:writeName:URL Protocol
Value:
(PID) Process:(1028) java.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072\DefaultIcon
Operation:writeName:
Value:
C:\Program Files\Java\jre1.8.0_92\bin\java.exe
(PID) Process:(1028) java.exeKey:HKEY_CLASSES_ROOT\discord-409416265891971072\shell\open\command
Operation:writeName:
Value:
C:\Program Files\Java\jre1.8.0_92\bin\java.exe
(PID) Process:(3968) help.exeKey:HKEY_CURRENT_USER\Software\Remcos-6HE0XU
Operation:writeName:exepath
Value:
612511D384BFD073C601EB522FB15C6BE73ACC45779A3AB31BA5FC0468311E8471C5BD323ECA5C71C18EE235F2082D29298678903DF449AB9511
(PID) Process:(3968) help.exeKey:HKEY_CURRENT_USER\Software\Remcos-6HE0XU
Operation:writeName:lic
Value:
F8D6BAB3634D6C10651960716204A09C
(PID) Process:(3964) help.exeKey:HKEY_CURRENT_USER\Software\comesnGo-7P3I86
Operation:writeName:exepath
Value:
5B68BFBACC52CB1FDAEB46BC299292B36C8B457BD04083F16EF223E23E07A641C42A12264A40E250AD1BBF9E2C625F9104BC07EB7483C25A7FF4
(PID) Process:(3964) help.exeKey:HKEY_CURRENT_USER\Software\comesnGo-7P3I86
Operation:writeName:lic
Value:
679D3726C7FB319BFE2C3187137C2516
Executable files
9
Suspicious files
23
Text files
10
Unknown types
29

Dropped files

PID
Process
Filename
Type
2780javaw.exeC:\Users\admin\AppData\Roaming\clientNull.exe
MD5:
SHA256:
2780javaw.exeC:\Users\admin\AppData\Roaming\clientNull64.exe
MD5:
SHA256:
2780javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:
SHA256:
2780javaw.exeC:\Users\admin\AppData\Roaming\clientNull.zipcompressed
MD5:
SHA256:
2780javaw.exeC:\Users\admin\.runelite\repository2\client-1.4.17.1.jarcompressed
MD5:
SHA256:
2780javaw.exeC:\Users\admin\AppData\Roaming\clientNull64.zipcompressed
MD5:
SHA256:
2780javaw.exeC:\Users\admin\.runelite\repository2\slf4j-api-1.7.25.jarcompressed
MD5:CAAFE376AFB7086DCBEE79F780394CA3
SHA256:18C4A0095D5C1DA6B817592E767BB23D29DD2F560AD74DF75FF3961DBDE25B79
2780javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
2780javaw.exeC:\Users\admin\.runelite\repository2\jopt-simple-5.0.1.jarjava
MD5:C5ED11011FDEAC9EC50826801D5ADCBB
SHA256:9F0C8D50FA4B79B6FF1502DBEC8502179D6B9497CACBE17A13074001AED537EC
2780javaw.exeC:\Users\admin\.runelite\repository2\jsr305-1.3.9.jarjava
MD5:1D5A772E400B04BB67A7EF4A0E0996D8
SHA256:905721A0EEA90A81534ABB7EE6EF4EA2E5E645FA1DEF0A5CD88402DF1B46C9ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
18
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2780
javaw.exe
GET
200
172.64.198.2:80
http://repo.runelite.net/net/runelite/client/1.4.17.1/client-1.4.17.1.jar
US
compressed
2.39 Mb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/com/google/guava/guava/23.2-jre/guava-23.2-jre.jar
US
java
2.53 Mb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/net/sf/jopt-simple/jopt-simple/5.0.1/jopt-simple-5.0.1.jar
US
java
76.9 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar
US
compressed
460 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jar
US
compressed
40.2 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
US
compressed
4.36 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/com/google/code/findbugs/jsr305/1.3.9/jsr305-1.3.9.jar
US
java
32.2 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar
US
compressed
235 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/org/codehaus/mojo/animal-sniffer-annotations/1.14/animal-sniffer-annotations-1.14.jar
US
compressed
3.40 Kb
suspicious
2780
javaw.exe
GET
200
172.64.199.2:80
http://mvn.runelite.net/com/google/errorprone/error_prone_annotations/2.0.18/error_prone_annotations-2.0.18.jar
US
compressed
11.7 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1028
java.exe
91.235.140.148:80
oldschool.runescape.com
Level 3 Communications, Inc.
GB
suspicious
1028
java.exe
104.244.46.199:443
pbs.twimg.com
Twitter Inc.
US
unknown
1028
java.exe
217.163.53.218:80
oldschool33a.runescape.com
Level 3 Communications, Inc.
GB
unknown
1028
java.exe
217.163.53.218:43594
oldschool33a.runescape.com
Level 3 Communications, Inc.
GB
unknown
3964
help.exe
164.132.90.226:55420
secure100kserver.com
OVH SAS
GB
malicious
1028
java.exe
172.64.199.2:443
static.runelite.net
Cloudflare Inc
US
shared
3968
help.exe
154.16.137.160:55719
ezpz1.xyz
Cascade Divide Colo, Inc.
US
unknown
217.163.53.218:43594
oldschool33a.runescape.com
Level 3 Communications, Inc.
GB
unknown
2780
javaw.exe
172.64.199.2:80
static.runelite.net
Cloudflare Inc
US
shared
2780
javaw.exe
172.64.198.2:80
static.runelite.net
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
static.runelite.net
  • 172.64.199.2
  • 172.64.198.2
suspicious
ultrabot.org
  • 104.27.163.210
  • 104.27.162.210
malicious
repo.runelite.net
  • 172.64.198.2
  • 172.64.199.2
suspicious
mvn.runelite.net
  • 172.64.199.2
  • 172.64.198.2
suspicious
oldschool.runescape.com
  • 91.235.140.148
suspicious
oldschool33a.runescape.com
  • 217.163.53.218
unknown
api.runelite.net
  • 172.64.199.2
  • 172.64.198.2
suspicious
pbs.twimg.com
  • 104.244.46.199
  • 104.244.46.103
whitelisted
secure100kserver.com
  • 164.132.90.226
malicious
ezpz1.xyz
  • 154.16.137.160
malicious

Threats

PID
Process
Class
Message
3964
help.exe
A Network Trojan was detected
ET TROJAN Remcos RAT Checkin 23
No debug info