File name:

archer.exe

Full analysis: https://app.any.run/tasks/31c3b006-ed05-4b6c-9618-baeb871e4600
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: November 25, 2020, 04:42:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C3A01AD5077A232F04A4B09DA13C16B2

SHA1:

237A737F5DD3C9702FE8677A4BBF9149C40C1621

SHA256:

86A01EA326A334AAC27F886EE5B5D452893C2CE9D201DAD4F59015E30AA7D9E7

SSDEEP:

24576:h/2y2Qhxv+TcfRe/KpCImxF4xbHCVyd2S73t0V0D:l2y3Ucfg7I6F4pH8+73t0mD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 320)
    • Runs app for hidden code execution

      • rundll32.exe (PID: 320)
    • Drops executable file immediately after starts

      • cmd.exe (PID: 2988)
    • Loads the Task Scheduler DLL interface

      • cmd.exe (PID: 2652)
    • REMCOS was detected

      • cmd.exe (PID: 2652)
  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • archer.exe (PID: 760)
    • Drops a file that was compiled in debug mode

      • archer.exe (PID: 760)
    • Executable content was dropped or overwritten

      • archer.exe (PID: 760)
      • cmd.exe (PID: 2988)
    • Creates files in the user directory

      • archer.exe (PID: 760)
      • cmd.exe (PID: 2988)
      • cmd.exe (PID: 2652)
    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 320)
      • cmd.exe (PID: 2652)
    • Drops a file with too old compile date

      • archer.exe (PID: 760)
    • Drops a file with a compile date too recent

      • archer.exe (PID: 760)
    • Application launched itself

      • cmd.exe (PID: 2652)
    • Creates files in the Windows directory

      • cmd.exe (PID: 2652)
    • Writes files like Keylogger logs

      • cmd.exe (PID: 2652)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 01:51:03+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x33a9
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Dec-2019 00:51:03
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 16-Dec-2019 00:51:03
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006455
0x00006600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.43794
.rdata
0x00008000
0x0000134A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.23642
.data
0x0000A000
0x00025538
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.12894
.ndata
0x00030000
0x00010000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00040000
0x00004258
0x00004400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.12182

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29665
1059
UNKNOWN
English - United States
RT_MANIFEST
2
0
3752
UNKNOWN
English - United States
RT_ICON
3
0
2216
UNKNOWN
English - United States
RT_ICON
4
0
1384
UNKNOWN
English - United States
RT_ICON
5
0
1128
UNKNOWN
English - United States
RT_ICON
6
0
744
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
103
0.576486
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.89384
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start archer.exe rundll32.exe no specs #REMCOS cmd.exe cmd.exe

Process information

PID
CMD
Path
Indicators
Parent process
320rundll32.exe Posterior,QuestionariesC:\Windows\system32\rundll32.exearcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
760"C:\Users\admin\AppData\Local\Temp\archer.exe" C:\Users\admin\AppData\Local\Temp\archer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\archer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2652"C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2988C:\Windows\system32\cmd.exe /c "COPY /Y /B "C:\Users\admin\AppData\Local\Temp\archer.exe" "C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\rsopprov.exe""C:\Windows\system32\cmd.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
521
Read events
519
Write events
2
Delete events
0

Modification events

(PID) Process:(2652) cmd.exeKey:HKEY_CURRENT_USER\Software\Remcos-B754WS
Operation:writeName:exepath
Value:
489CB148832F6D26A6EC408906FEE37054196D24FB9FFB71E1AA48F5C7AF24FBE63752712A425E1A0776CD97F9EA87570BD2822768506938
(PID) Process:(2652) cmd.exeKey:HKEY_CURRENT_USER\Software\Remcos-B754WS
Operation:writeName:licence
Value:
4C5E08B49095200FDCF6E0EAF3887FF7
Executable files
8
Suspicious files
2
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
760archer.exeC:\Users\admin\AppData\Local\Temp\nsuEF17.tmp
MD5:
SHA256:
760archer.exeC:\Users\admin\AppData\Roaming\job\org.gnome.eog.gschema.xmltext
MD5:0939E20F6770B6B240BA9795FD977556
SHA256:E9BCD1CB56F11129D5CD6BC02ECD74DBFC6CEA85FBD797FAA7A8A06F8C3ED7AF
760archer.exeC:\Users\admin\AppData\Roaming\scans\x-zoo.xmlxml
MD5:80335F16AAA8A6C188AC9E1C5E27F1D9
SHA256:A5682204C0F3D3280183781E05DCA36C58A25A6823677CFA123F9BD672396E7C
760archer.exeC:\Users\admin\AppData\Local\Temp\Miserybinary
MD5:E37E4F820BC7524B737BF1B72177BDFA
SHA256:FBFB206E9F07176FE3815D4C03D79655CFE7C69E1EDD8E560C78197A69D226AD
2652cmd.exeC:\Users\admin\AppData\Roaming\system\logs.dattext
MD5:
SHA256:
760archer.exeC:\Users\admin\AppData\Roaming\job\SERVERLib.dllexecutable
MD5:4BE1885F7693F3734EFAB71DA9AEA77C
SHA256:E981BFA9D985DA036FFFE19905DCF7D607D8037F65C5F36999DD32C71A2C7E04
760archer.exeC:\Users\admin\AppData\Roaming\job\pgoui.dllexecutable
MD5:7597AA6C374743829358E543591C943F
SHA256:AEE7923FDE1AE19368B85FEDBCFEEF21C45D96DDBD2689662A0C4CC25EC40A3F
760archer.exeC:\Users\admin\AppData\Roaming\job\clstencilui.dllexecutable
MD5:6790A7CC406EFDB00E4FC418E15029E5
SHA256:52599B570E6B89BEB84A79BCC7FB8B5F90D90653623EA5C17082BABE6AF90FCE
760archer.exeC:\Users\admin\AppData\Roaming\job\hangul.xmlxml
MD5:9E4B6F839B749AAD23B0087ECB4C2166
SHA256:2685255AF2869570180E7CDD692CF39448A62E3AB4804D6A8A55F5699CF8EF5D
760archer.exeC:\Users\admin\AppData\Roaming\job\editbin.exeexecutable
MD5:EF322D97E0BF036E236A85A19D85235E
SHA256:51FF3FF717529746CCEA8412DA24A6D57B6C04D32AAD04059B53B49D93776DE4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
2
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2652
cmd.exe
179.14.171.7:9401
dominoduck2101.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
malicious
179.14.171.7:9401
dominoduck2101.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
malicious

DNS requests

Domain
IP
Reputation
dominoduck2101.duckdns.org
  • 179.14.171.7
malicious

Threats

PID
Process
Class
Message
1044
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1044
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info