File name:

Scan.ace

Full analysis: https://app.any.run/tasks/5389e209-86e1-42ab-9c3f-59d2673e7720
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: July 12, 2020, 21:44:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
rat
remcos
Indicators:
MIME: application/octet-stream
File info: ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid
MD5:

CBE4016BB46DB65886899C497D97965B

SHA1:

F6CC29063DF44C8FEF22FF16452594721E6A74F3

SHA256:

853EC08028FFABA08B6F2F3F6B222F7695DD02B6A81BCBB5673F7AC1289513B9

SSDEEP:

3072:v/JJU0azVINUaaxihgin+npVN0wPP+IeDVPvZlTuR1O7N6QEd:s0azOHhpK0wPP+BxrxQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NWAA.exe (PID: 840)
      • NWAA.exe (PID: 2488)
      • remcos.exe (PID: 2104)
      • remcos.exe (PID: 1200)
      • NWAA.exe (PID: 3720)
      • NWAA.exe (PID: 1036)
      • NWAA.exe (PID: 3928)
    • Changes the autorun value in the registry

      • remcos.exe (PID: 1200)
      • NWAA.exe (PID: 1036)
    • REMCOS was detected

      • remcos.exe (PID: 1200)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2044)
      • NWAA.exe (PID: 1036)
    • Application launched itself

      • NWAA.exe (PID: 840)
      • remcos.exe (PID: 2104)
      • NWAA.exe (PID: 2488)
    • Writes files like Keylogger logs

      • WinRAR.exe (PID: 2044)
      • NWAA.exe (PID: 1036)
    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 1676)
    • Executes scripts

      • NWAA.exe (PID: 1036)
    • Creates files in the user directory

      • remcos.exe (PID: 1200)
      • NWAA.exe (PID: 1036)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ace | ACE compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
10
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start winrar.exe nwaa.exe no specs nwaa.exe nwaa.exe no specs wscript.exe no specs cmd.exe no specs remcos.exe no specs #REMCOS remcos.exe nwaa.exe no specs nwaa.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
840"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.18011\NWAA.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.18011\NWAA.exeWinRAR.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
0
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.18011\nwaa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1036"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.18011\NWAA.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.18011\NWAA.exe
NWAA.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
0
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.18011\nwaa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1200"C:\Users\admin\AppData\Roaming\vlc\remcos.exe"C:\Users\admin\AppData\Roaming\vlc\remcos.exe
remcos.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
0
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\roaming\vlc\remcos.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1676"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\System32\WScript.exeNWAA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2044"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Scan.ace"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2104C:\Users\admin\AppData\Roaming\vlc\remcos.exeC:\Users\admin\AppData\Roaming\vlc\remcos.execmd.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
0
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\roaming\vlc\remcos.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2488"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.29957\NWAA.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.29957\NWAA.exeWinRAR.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
0
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.29957\nwaa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3452"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Roaming\vlc\remcos.exe"C:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3720"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.29957\NWAA.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.29957\NWAA.exeNWAA.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
1
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.29957\nwaa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3928"C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.20810\NWAA.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2044.20810\NWAA.exeWinRAR.exe
User:
admin
Company:
f|7HL3a($M8jJk/2
Integrity Level:
MEDIUM
Description:
r!2P*4Lxd)5N#
Exit code:
0
Version:
8.12.16.20
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2044.20810\nwaa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
889
Read events
849
Write events
40
Delete events
0

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Scan.ace
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0
Operation:writeName:Count
Value:
0
Executable files
4
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1036NWAA.exeC:\Users\admin\AppData\Local\Temp\install.vbsbinary
MD5:76F7E9C81FD29F7436CEE6ED3D669FA5
SHA256:04D71D52AF854E57C16FE846BE9F4B59F4DD2200C3354C727A79A326BB94FA99
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.18011\NWAA.exeexecutable
MD5:2E3C900B4BEBE6456C4EBB313ABC7FA8
SHA256:DFA62653C2606C14BE6B244FDC19C07C2D31FE4553F2CEBBA08C972E92F27434
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.29957\NWAA.exeexecutable
MD5:2E3C900B4BEBE6456C4EBB313ABC7FA8
SHA256:DFA62653C2606C14BE6B244FDC19C07C2D31FE4553F2CEBBA08C972E92F27434
1200remcos.exeC:\Users\admin\AppData\Roaming\app\logs.datbinary
MD5:
SHA256:
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2044.20810\NWAA.exeexecutable
MD5:2E3C900B4BEBE6456C4EBB313ABC7FA8
SHA256:DFA62653C2606C14BE6B244FDC19C07C2D31FE4553F2CEBBA08C972E92F27434
1036NWAA.exeC:\Users\admin\AppData\Roaming\vlc\remcos.exeexecutable
MD5:2E3C900B4BEBE6456C4EBB313ABC7FA8
SHA256:DFA62653C2606C14BE6B244FDC19C07C2D31FE4553F2CEBBA08C972E92F27434
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
79
DNS requests
79
Threats
79

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
212.154.23.103:5149
noapology.myq-see.com
TurkNet Iletisim Hizmetleri A.S
TR
unknown
1200
remcos.exe
212.154.23.103:5149
noapology.myq-see.com
TurkNet Iletisim Hizmetleri A.S
TR
unknown

DNS requests

Domain
IP
Reputation
noapology.myq-see.com
  • 212.154.23.103
malicious

Threats

PID
Process
Class
Message
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
1044
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to .myq-see .com DDNS Domain
No debug info