analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.rar

Full analysis: https://app.any.run/tasks/cfcf9f9f-cbe6-4271-bfa1-2997648b966b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 14, 2019, 14:35:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
remcos
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

DF6FC1C76E89902584BC7EC7F48532CF

SHA1:

3227C95BC64B8B5A7B9A79932916D9B7006E390C

SHA256:

92AFE5BDBEA01345F62BDB1C7F1C11CF61F3C97C13071FBA8D162AF1A76554D5

SSDEEP:

6144:v11ookLtaX4vJfiXOvzx2YwCfbyWosT0AicJpWCYyopyK:deoc7MpYwCzpo2pim1ayK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.exe (PID: 3100)
    • Writes to a start menu file

      • DllHost.exe (PID: 3996)
    • REMCOS was detected

      • WerFault.exe (PID: 3436)
    • Connects to CnC server

      • WerFault.exe (PID: 3436)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2836)
      • DllHost.exe (PID: 3996)
    • Creates files in the user directory

      • DllHost.exe (PID: 3996)
      • WerFault.exe (PID: 3436)
    • Connects to unusual port

      • WerFault.exe (PID: 3436)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO N? 146054.exe
PackingMethod: Normal
ModifyDate: 2019:03:14 09:00:15
OperatingSystem: Win32
UncompressedSize: 524288
CompressedSize: 270119
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe anexo fotos hora y fecha de foto comparendo nº 146054.exe no specs Copy/Move/Rename/Delete/Link Object #REMCOS werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3100"C:\Users\admin\Desktop\ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.exe" C:\Users\admin\Desktop\ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.exeexplorer.exe
User:
admin
Company:
Business Objects
Integrity Level:
MEDIUM
Description:
Excel Plugin
Exit code:
0
Version:
11.5.9.1229
3996C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3436"C:\Windows\System32\WerFault.exe"C:\Windows\System32\WerFault.exe
ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
841
Read events
829
Write events
12
Delete events
0

Modification events

(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2836) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.rar
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2836) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3436) WerFault.exeKey:HKEY_CURRENT_USER\Software\interjets-FDSXSS
Operation:writeName:exepath
Value:
E261DC139A0AF3E20128B46C9B396607B0EB1E3EFCD5E8206AE019E431144A87881312E9165F690033760455FE755489F6A3A91F8DF7DB4B8533FC7FF51917AE5268
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3100ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.exeC:\Users\admin\AppData\Local\Temp\Liebert.bmp
MD5:
SHA256:
3436WerFault.exeC:\Users\admin\AppData\Roaming\xtreall\logs.datbinary
MD5:B245104CF8A1E31ABA6A773745E7C423
SHA256:E0FF2A9C4C24091E0BDF2F3789358EADC4073108C1A0C9DAB62CFE3063D1CDAD
2836WinRAR.exeC:\Users\admin\Desktop\ANEXO FOTOS HORA Y FECHA DE FOTO COMPARENDO Nº 146054.exeexecutable
MD5:DA4ABCEEE7BA9E5568023A69CB4379CC
SHA256:E77E47CD626AFFE1105519365258A01FA5046250BFC825885D15C15FC8255AB9
3996DllHost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Licensee.exeexecutable
MD5:DA4ABCEEE7BA9E5568023A69CB4379CC
SHA256:E77E47CD626AFFE1105519365258A01FA5046250BFC825885D15C15FC8255AB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3436
WerFault.exe
181.57.221.10:4851
lacoste587.lacoste587.agency
Telmex Colombia S.A.
CO
suspicious

DNS requests

Domain
IP
Reputation
lacoste587.lacoste587.agency
  • 181.57.221.10
malicious
dsquared21.dsquared21.rocks
  • 181.57.221.10
malicious
hugoboss01.hugoboss01.store
  • 181.57.221.10
malicious

Threats

PID
Process
Class
Message
3436
WerFault.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Remcos RAT Checkin 72
3436
WerFault.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
3436
WerFault.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Remcos RAT Checkin 72
3436
WerFault.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
3436
WerFault.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Remcos RAT Checkin 72
3436
WerFault.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
3436
WerFault.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
3436
WerFault.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Remcos RAT Checkin 72
3436
WerFault.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Remcos RAT Checkin
3436
WerFault.exe
A Network Trojan was detected
ET TROJAN [PTsecurity] Remcos RAT Checkin 72
3 ETPRO signatures available at the full report
No debug info