File name:

7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe

Full analysis: https://app.any.run/tasks/c1b861be-ec66-4fd0-b514-2e43c7637abc
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: March 24, 2026, 21:43:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 84 sections
MD5:

DAD00F247B47AF97E6990AC7CB7EC46C

SHA1:

C20FC50AFEAB4AF87421788392C712780420C353

SHA256:

7FDDA7BE8BD55D65A3606574A27999946CCD315C80FB8C5C14E79CD2FDD832D9

SSDEEP:

12288:4WIauIoXnpLIaGsMpQbZZmQffD633rc2PcYTIZZZApWVVVVVVVVVVVVVVVVVrpvO:voXnhLyQf83lCZZypIvhLs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS mutex has been found

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

    • REMCOS has been detected

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)
      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

    • REMCOS has been detected (YARA)

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Environment values

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

    • Checks supported languages

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

    • Reads the computer name

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

    • Creates files in the program directory

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)

    • There is functionality for taking screenshot (YARA)

      • 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe (PID: 2576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2576) 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe
C2 (1)xweb.ddns.net:6776
BotnetGrace
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-20QRBG
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:01 08:29:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 352256
InitializedDataSize: 139776
UninitializedDataSize: -
EntryPoint: 0x33b3a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REMCOS 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2576"C:\Users\admin\Desktop\7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe" C:\Users\admin\Desktop\7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(2576) 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe
C2 (1)xweb.ddns.net:6776
BotnetGrace
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-20QRBG
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
4260C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 740
Read events
3 736
Write events
4
Delete events
0

Modification events

(PID) Process:(2576) 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-20QRBG
Operation:writeName:exepath
Value:
22BE216FD1FC5E20A4183DADEB1786576B07F008A7BC562F81EB52FF2D7800FB8BB3AC9DFE8A52B2398E11037C5D82632AFAAC2934A6A86A4C9F3B2BB24BE9CD1A90728AE27A57CDC3DA1F91E9A8AEDE738DC589743F690D25762054F73844DE14B0ADDFEB3C43DBEE908DD305866CE23436451CEA5950D0AA72E12A585E1655B1941B6F19BE72B6FE075ED5D6A77633E0F3A4B8A10083658D155C320A0BA168EDC3E6F4C07B00A7038A5EC19A2FDD6522726E2D8B54EC56
(PID) Process:(2576) 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-20QRBG
Operation:writeName:licence
Value:
E192372ED6FC99C540613E16EFA15B2D
(PID) Process:(2576) 7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-20QRBG
Operation:writeName:time
Value:
(PID) Process:(4260) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
25767fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exeC:\ProgramData\remcos\logs.datbinary
MD5:7DDA21A4A6D240E690265B50EACA88F8
SHA256:EF06053255351D47FFAD73787FAC881434DE8D081387F4740FC8995A7E3CADEE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
45
DNS requests
22
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2016
SIHClient.exe
GET
304
135.232.92.137:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
4260
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
text
512 b
whitelisted
2332
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5316
svchost.exe
POST
200
40.126.32.138:443
https://login.live.com/RST2.srf
US
binary
1.24 Kb
whitelisted
4260
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
text
512 b
whitelisted
5316
svchost.exe
POST
200
20.190.159.131:443
https://login.live.com/RST2.srf
US
binary
1.24 Kb
whitelisted
—
—
POST
400
20.190.159.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
binary
203 b
whitelisted
2016
SIHClient.exe
GET
200
135.232.92.97:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
—
—
POST
400
20.190.159.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
binary
203 b
whitelisted
2016
SIHClient.exe
GET
200
135.232.92.137:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1656
slui.exe
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
92.123.104.17:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
2332
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
2332
svchost.exe
184.24.77.24:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2332
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
2576
7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe
20.121.56.47:6776
xweb.ddns.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
www.bing.com
  • 92.123.104.17
  • 92.123.104.24
  • 92.123.104.16
  • 92.123.104.21
  • 92.123.104.26
  • 92.123.104.29
  • 92.123.104.14
  • 92.123.104.18
  • 92.123.104.25
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 184.24.77.24
  • 184.24.77.21
  • 184.24.77.26
  • 184.24.77.19
  • 184.24.77.22
  • 184.24.77.29
  • 184.24.77.34
  • 184.24.77.25
  • 184.24.77.18
  • 184.24.77.41
  • 184.24.77.11
  • 184.24.77.12
  • 184.24.77.42
  • 184.24.77.14
  • 184.24.77.6
  • 184.24.77.38
  • 184.24.77.7
  • 184.24.77.15
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
xweb.ddns.net
  • 20.121.56.47
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.64
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.4
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 135.232.92.137
whitelisted

Threats

PID
Process
Class
Message
2232
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2232
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2232
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7fdda7be8bd55d65a3606574a27999946ccd315c80fb8c5c14e79cd2fdd832d9.exe