analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://docs.google.com/uc?export=download&id=1qAjKhtlLy6CjzLNWxuVhd05VGh2qQNvz

Full analysis: https://app.any.run/tasks/190aff6e-e785-41f2-80ce-c02b7b494dfb
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: April 08, 2024, 16:22:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
keylogger
Indicators:
MD5:

CD2726D521C9D9083F9C57B76A122E05

SHA1:

770BA146F0F2C972F0AA399AF9BE79B7DC0F830F

SHA256:

67A73193665E5BFCBD4A96168AD3D6CA5B13C2CBBCE7BC51AB8039F2C36DD6B3

SSDEEP:

3:N8SP3u2NAaBrC29P6A4fgQXVmiFtHf:2Sm2BB+2FtQIiLf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected

      • Soport 051286392111582029996158203200002.exe (PID: 1772)
      • Soport 051286392111582029996158203200002.exe (PID: 1772)
      • Soport 051286392111582029996158203200002.exe (PID: 1772)
      • Soport 051286392111582029996158203200002.exe (PID: 2568)

    • REMCOS has been detected (YARA)

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

  • SUSPICIOUS

    • Application launched itself

      • Soport 051286392111582029996158203200002.exe (PID: 1340)
      • Soport 051286392111582029996158203200002.exe (PID: 2620)

    • Reads security settings of Internet Explorer

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Connects to unusual port

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Reads the Internet Settings

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Writes files like Keylogger logs

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2072)
      • iexplore.exe (PID: 2120)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2072)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2072)

    • Application launched itself

      • iexplore.exe (PID: 2120)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Manual execution by a user

      • Soport 051286392111582029996158203200002.exe (PID: 1340)
      • Soport 051286392111582029996158203200002.exe (PID: 2620)

    • Checks supported languages

      • Soport 051286392111582029996158203200002.exe (PID: 1340)
      • Soport 051286392111582029996158203200002.exe (PID: 1772)
      • Soport 051286392111582029996158203200002.exe (PID: 2620)
      • Soport 051286392111582029996158203200002.exe (PID: 2568)

    • Reads the computer name

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Reads product name

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Reads Environment values

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Checks proxy server information

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Reads the machine GUID from the registry

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Creates files or folders in the user directory

      • Soport 051286392111582029996158203200002.exe (PID: 1772)

    • Creates files in the program directory

      • Soport 051286392111582029996158203200002.exe (PID: 1772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(1772) Soport 051286392111582029996158203200002.exe
C2 (1)abril04.con-ip.com:7770
BotnetFENIX
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-MG1REZ
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe soport 051286392111582029996158203200002.exe #REMCOS soport 051286392111582029996158203200002.exe soport 051286392111582029996158203200002.exe soport 051286392111582029996158203200002.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2120"C:\Program Files\Internet Explorer\iexplore.exe" "https://docs.google.com/uc?export=download&id=1qAjKhtlLy6CjzLNWxuVhd05VGh2qQNvz"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3092"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2072"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Soport 051286392111582029996158203200002.tar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1340"C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe" C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe
explorer.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
HIGH
Description:
µTorrent
Exit code:
0
Version:
3.5.5.46348
Modules
Images
c:\users\admin\desktop\soport 051286392111582029996158203200002.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1772"C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe"C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe
Soport 051286392111582029996158203200002.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
HIGH
Description:
µTorrent
Version:
3.5.5.46348
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Remcos
(PID) Process(1772) Soport 051286392111582029996158203200002.exe
C2 (1)abril04.con-ip.com:7770
BotnetFENIX
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-MG1REZ
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
2620"C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe" C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe
explorer.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
HIGH
Description:
µTorrent
Exit code:
0
Version:
3.5.5.46348
Modules
Images
c:\users\admin\desktop\soport 051286392111582029996158203200002.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2568"C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe"C:\Users\admin\Desktop\Soport 051286392111582029996158203200002.exe—Soport 051286392111582029996158203200002.exe
User:
admin
Company:
BitTorrent Inc.
Integrity Level:
HIGH
Description:
µTorrent
Exit code:
2
Version:
3.5.5.46348
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
34 510
Read events
34 345
Write events
130
Delete events
35

Modification events

(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31099344
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
11107630
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31099345
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
1
Suspicious files
18
Text files
14
Unknown types
9

Dropped files

PID
Process
Filename
Type
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15der
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15binary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91der
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91binary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Soport%20051286392111582029996158203200002[1].tarcompressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
27
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3092
iexplore.exe
GET
304
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bd117e088266f0f9
unknown
—
—
unknown
3092
iexplore.exe
GET
304
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3092
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCb04uMpoGrFRCW8s8fxxYV
unknown
—
—
unknown
3092
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
3092
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
—
—
unknown
3092
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCcqF43p7MAExLbHeQJlvxP
unknown
—
—
unknown
2120
iexplore.exe
GET
304
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b23edf5cfbe16fd7
unknown
—
—
unknown
2120
iexplore.exe
GET
304
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d416ea50f343b89b
unknown
—
—
unknown
2120
iexplore.exe
GET
304
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4ad9b1827f1f75f1
unknown
—
—
unknown
1080
svchost.exe
GET
200
178.79.208.1:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3092
iexplore.exe
142.250.185.142:443
docs.google.com
GOOGLE
US
whitelisted
3092
iexplore.exe
178.79.208.1:80
ctldl.windowsupdate.com
LLNW
NL
unknown
3092
iexplore.exe
142.250.74.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3092
iexplore.exe
172.217.16.193:443
doc-0k-9c-docs.googleusercontent.com
GOOGLE
US
whitelisted
1080
svchost.exe
178.79.208.1:80
ctldl.windowsupdate.com
LLNW
NL
unknown
2120
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
2120
iexplore.exe
178.79.208.1:80
ctldl.windowsupdate.com
LLNW
NL
unknown

DNS requests

Domain
IP
Reputation
docs.google.com
  • 142.250.185.142
shared
ctldl.windowsupdate.com
  • 178.79.208.1
  • 87.248.202.1
whitelisted
ocsp.pki.goog
  • 142.250.74.195
whitelisted
doc-0k-9c-docs.googleusercontent.com
  • 172.217.16.193
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
abril04.con-ip.com
  • 181.131.216.70
unknown
geoplugin.net
  • 178.237.33.50
malicious
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
3092
iexplore.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
—
—
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
—
—
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
—
—
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://docs.google.com/uc?export=download&id=1qAjKhtlLy6CjzLNWxuVhd05VGh2qQNvz