Malware analysis SecuriteInfo.com.Win32.PWSX-gen.23527.24330 Malicious activity

Add for printing

File name:	SecuriteInfo.com.Win32.PWSX-gen.23527.24330
Full analysis:	https://app.any.run/tasks/58b397c7-04bf-4d4d-a001-1b5a6f73cf4d
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Remcos is a commercially distributed remote administration and surveillance tool that has been widely observed in unauthorized deployments, where threat actors use it to perform remote actions on compromised machines. It is actively maintained by its vendor, with new versions and feature updates released on a frequent, near-monthly basis. Remcos ist eine Malware vom Typ RAT, mit der Angreifer aus der Ferne Aktionen auf infizierten Computern durchführen können. Diese Malware ist extrem aktiv und wird fast jeden Monat mit Updates auf den neuesten Stand gebracht. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	December 14, 2023, 05:19:06
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:	rat remcos remote stealer
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	6B88C43C566BE0138CCF70C0D2B31B4B
SHA1:	3D0AAA136151F98960714CBFF25B634405F88A95
SHA256:	9496EA650A182FC8C1B87B205C226D44B7271186B473B156CFB727C2E81DCA0A
SSDEEP:	49152:RNGf0Z+Dt68rGsp7J3q7IHy/4D/nhIpXkyYu9pin1c0KE9+6UlLz5LDhLE:fd+h6Qt3q7I64Dn6kKpiFRUlLz5B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.0.9600.18860 KB4052978
Adobe Acrobat Reader DC MUI (15.007.20033)
Adobe Flash Player 27 ActiveX (27.0.0.187)
Adobe Flash Player 27 NPAPI (27.0.0.187)
Adobe Flash Player 27 PPAPI (27.0.0.187)
CCleaner (5.35)
Google Chrome (109.0.5414.120)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (64-bit) (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.8 (4.8.03761)
Microsoft .NET Framework 4.8 (4.8.03761)
Microsoft Edge (109.0.1518.115)
Microsoft Edge Update (1.3.177.11)
Microsoft Office Access MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Access MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Excel MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Groove MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Groove MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (French) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (German) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office InfoPath MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Language Pack 2010 - French/Français (14.0.4763.1000)
Microsoft Office Language Pack 2010 - German/Deutsch (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Italian/Italiano (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Japanese/日本語 (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Korean/한국어 (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Russian/русский (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Spanish/Español (14.0.4763.1000)
Microsoft Office Language Pack 2010 - Turkish/Türkçe (14.0.4763.1013)
Microsoft Office O MUI (French) 2010 (14.0.4763.1000)
Microsoft Office O MUI (German) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office O MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Office 32-bit Components 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (French) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (German) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office OneNote MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Outlook MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Outlook MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (French) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (German) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office PowerPoint MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Professional 2010 (14.0.4763.1000)
Microsoft Office Proof (Arabic) 2010 (14.0.4763.1000)
Microsoft Office Proof (Basque) 2010 (14.0.4763.1000)
Microsoft Office Proof (Catalan) 2010 (14.0.4763.1000)
Microsoft Office Proof (Dutch) 2010 (14.0.4763.1000)
Microsoft Office Proof (English) 2010 (14.0.4763.1000)
Microsoft Office Proof (French) 2010 (14.0.4763.1000)
Microsoft Office Proof (Galician) 2010 (14.0.4763.1000)
Microsoft Office Proof (German) 2010 (14.0.4763.1000)
Microsoft Office Proof (Italian) 2010 (14.0.4763.1000)
Microsoft Office Proof (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Proof (Korean) 2010 (14.0.4763.1000)
Microsoft Office Proof (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Proof (Russian) 2010 (14.0.4763.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Proof (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Proof (Ukrainian) 2010 (14.0.4763.1000)
Microsoft Office Proofing (English) 2010 (14.0.4763.1000)
Microsoft Office Proofing (French) 2010 (14.0.4763.1000)
Microsoft Office Proofing (German) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Italian) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Korean) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Russian) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Proofing (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Publisher MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Publisher MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office SharePoint Designer MUI (French) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (German) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Shared 32-bit MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Shared 32-bit MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Shared MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Shared MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Single Image 2010 (14.0.4763.1000)
Microsoft Office Word MUI (English) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (French) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (German) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office Word MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Office X MUI (French) 2010 (14.0.4763.1000)
Microsoft Office X MUI (German) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Italian) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Japanese) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Korean) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Russian) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Spanish) 2010 (14.0.4763.1000)
Microsoft Office X MUI (Turkish) 2010 (14.0.4763.1013)
Microsoft Visual C++ 2005 Redistributable (x64) (8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (11.0.61030.0)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (11.0.61030)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (11.0.61030)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (115.0.2)
Mozilla Maintenance Service (115.0.2)
Notepad++ (64-bit x64) (7.5.1)
PowerShell 7-x64 (7.2.11.0)
Skype version 8.100 (8.100)
Update for Microsoft .NET Framework 4.8 (KB4503575) (1)
VLC media player (2.2.6)
WinRAR 5.60 (64-bit) (5.60.0)

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
- Uses Task Scheduler to run other applications
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
- REMCOS has been detected (SURICATA)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Actions looks like stealing of personal data
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2940)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
- Steals credentials from Web Browsers
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
- Steals credentials
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
- REMCOS has been detected (YARA)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Uses NirSoft utilities to collect credentials
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
SUSPICIOUS
- Reads the Internet Settings
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Application launched itself
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Connects to unusual port
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Reads browser cookies
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Accesses Microsoft Outlook profiles
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
INFO
- Creates files or folders in the user directory
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Checks supported languages
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2940)
- Reads the computer name
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2940)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
- Reads the machine GUID from the registry
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2940)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
- Create files in a temporary directory
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 1012)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2940)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2156)
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2520)
- Reads Environment values
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)
- Checks proxy server information
  - SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe (PID: 2176)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

Remcos

(PID) Process(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

C2 (1)94.156.67.170:6657

BotnetHost

Options

Connect_interval1

Install_flagFalse

Install_HKCU\RunTrue

Install_HKLM\RunTrue

Install_HKLM\Explorer\Run1

Install_HKLM\Winlogon\Shell100000

Setup_path%LOCALAPPDATA%

Copy_fileremcos.exe

Startup_valueFalse

Hide_fileFalse

Mutex_nameRmc-UH491C

Keylog_flag0

Keylog_path%LOCALAPPDATA%

Keylog_filelogs.dat

Keylog_cryptFalse

Hide_keylogFalse

Screenshot_flagFalse

Screenshot_time5

Take_ScreenshotFalse

Screenshot_path%APPDATA%

Screenshot_fileScreenshots

Screenshot_cryptFalse

Mouse_optionFalse

Delete_fileFalse

Audio_record_time5

Audio_path%ProgramFiles%

Audio_dirMicRecords

Connect_delay0

Copy_dirRemcos

Keylog_dirremcos

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr	\|	Windows screen saver (12.9)
.dll	\|	Win32 Dynamic Link Library (generic) (6.4)
.exe	\|	Win32 Executable (generic) (4.4)
.exe	\|	Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2023:12:14 02:11:40+01:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	48
CodeSize:	908800
InitializedDataSize:	8704
UninitializedDataSize:	-
EntryPoint:	0xdfd22
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	14.0.4.0
ProductVersionNumber:	14.0.4.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	Gaming AI
CompanyName:	Spiel
FileDescription:	Minesweeper Spiel
FileVersion:	14.0.4.0
InternalName:	CPg.exe
LegalCopyright:	Spiel (C) 2024
LegalTrademarks:	Spiel
OriginalFileName:	CPg.exe
ProductName:	Minesweeper Spiel
ProductVersion:	14.0.4.0
AssemblyVersion:	5.0.2.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

272

"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

—

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

4294967295

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

712

"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

—

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

4294967295

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

1012

"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

—

explorer.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll

2156

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe /stext "C:\Users\admin\AppData\Local\Temp\ziemrobqbvnrufazqphtuaqptqbpv"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll

2176

"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll

Remcos

(PID) Process(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

C2 (1)94.156.67.170:6657

BotnetHost

Options

Connect_interval1

Install_flagFalse

Install_HKCU\RunTrue

Install_HKLM\RunTrue

Install_HKLM\Explorer\Run1

Install_HKLM\Winlogon\Shell100000

Setup_path%LOCALAPPDATA%

Copy_fileremcos.exe

Startup_valueFalse

Hide_fileFalse

Mutex_nameRmc-UH491C

Keylog_flag0

Keylog_path%LOCALAPPDATA%

Keylog_filelogs.dat

Keylog_cryptFalse

Hide_keylogFalse

Screenshot_flagFalse

Screenshot_time5

Take_ScreenshotFalse

Screenshot_path%APPDATA%

Screenshot_fileScreenshots

Screenshot_cryptFalse

Mouse_optionFalse

Delete_fileFalse

Audio_record_time5

Audio_path%ProgramFiles%

Audio_dirMicRecords

Connect_delay0

Copy_dirRemcos

Keylog_dirremcos

2264

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe /stext "C:\Users\admin\AppData\Local\Temp\jksfshljxefwelwlhzuvfnlycwtqojkt"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

—

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

2520

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe /stext "C:\Users\admin\AppData\Local\Temp\jksfshljxefwelwlhzuvfnlycwtqojkt"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll

2640

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe /stext "C:\Users\admin\AppData\Local\Temp\jksfshljxefwelwlhzuvfnlycwtqojkt"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

—

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

2688

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\koeswqLU" /XML "C:\Users\admin\AppData\Local\Temp\tmp9281.tmp"

C:\Windows\SysWOW64\schtasks.exe

—

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Manages scheduled tasks

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll

2852

"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

—

SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe

User:

admin

Company:

Spiel

Integrity Level:

MEDIUM

Description:

Minesweeper Spiel

Exit code:

4294967295

Version:

14.0.4.0

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.pwsx-gen.23527.24330.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

Add for printing

Total events

706

Read events

686

Write events

Delete events

Modification events


(PID) Process:	(1012) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(1012) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(1012) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(1012) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(2176) SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2156	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	C:\Users\admin\AppData\Local\Temp\bhv9A90.tmp		—
		MD5:—	SHA256:—
1012	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	C:\Users\admin\AppData\Local\Temp\tmp9281.tmp		xml
		MD5:D967AEF2E701A054C601C177B7CB415A	SHA256:3BFA456E4CACB2B9ACB9D6B8336D65BF3255F7DF492C4998D5099C8E2B953E17
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\json[1].json		binary
		MD5:29C82D71AD00D582E7248DF0F3C24B4C	SHA256:42F8E82B15FD6BF501FC33EE01410758D967499D6123368F4285A6D2C134ED5A
1012	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	C:\Users\admin\AppData\Roaming\koeswqLU.exe		executable
		MD5:6B88C43C566BE0138CCF70C0D2B31B4B	SHA256:9496EA650A182FC8C1B87B205C226D44B7271186B473B156CFB727C2E81DCA0A
2520	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	C:\Users\admin\AppData\Local\Temp\jksfshljxefwelwlhzuvfnlycwtqojkt		text
		MD5:7FB9A9AD0FD9B1E0108ED71FBB276048	SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
2156	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	C:\Users\admin\AppData\Local\Temp\ziemrobqbvnrufazqphtuaqptqbpv		text
		MD5:2D9139D0CBF8301AE9DAD9173A0A6357	SHA256:2AFE12053A281037E21B2C83109E366E151B4848E9D5357E7B5AE6100CC1C481

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	GET	200	178.237.33.50:80	http://geoplugin.net/json.gp	unknown	binary	949 b	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
1956	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
324	svchost.exe	224.0.0.252:5355	—	—	—	unknown
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	94.156.67.170:6657	—	Terasyst Ltd	BG	malicious
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	178.237.33.50:80	geoplugin.net	Schuberg Philis B.V.	NL	malicious

DNS requests

Domain	IP	Reputation
geoplugin.net	178.237.33.50	malicious

Threats

PID	Process	Class	Message
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Malware Command and Control Activity Detected	ET JA3 Hash - Remcos 3.x TLS Connection
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	A Network Trojan was detected	REMOTE [ANY.RUN] REMCOS JA3 Hash
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Malware Command and Control Activity Detected	ET JA3 Hash - Remcos 3.x TLS Connection
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	A Network Trojan was detected	REMOTE [ANY.RUN] REMCOS JA3 Hash
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	Malware Command and Control Activity Detected	ET JA3 Hash - Remcos 3.x TLS Connection
2176	SecuriteInfo.com.Win32.PWSX-gen.23527.24330.exe	A Network Trojan was detected	REMOTE [ANY.RUN] REMCOS JA3 Hash

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

SecuriteInfo.com.Win32.PWSX-gen.23527.24330

6B88C43C566BE0138CCF70C0D2B31B4B

3D0AAA136151F98960714CBFF25B634405F88A95

9496EA650A182FC8C1B87B205C226D44B7271186B473B156CFB727C2E81DCA0A

49152:RNGf0Z+Dt68rGsp7J3q7IHy/4D/nhIpXkyYu9pin1c0KE9+6UlLz5LDhLE:fd+h6Qt3q7I64Dn6kKpiFRUlLz5B

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Uses Task Scheduler to run other applications

REMCOS has been detected (SURICATA)

Actions looks like stealing of personal data

Steals credentials from Web Browsers

Steals credentials

REMCOS has been detected (YARA)

Uses NirSoft utilities to collect credentials

SUSPICIOUS

Reads the Internet Settings

Application launched itself

Connects to unusual port

Reads browser cookies

Accesses Microsoft Outlook profiles

INFO

Creates files or folders in the user directory

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Create files in a temporary directory

Reads Environment values

Checks proxy server information

Malware configuration

Remcos

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Malware configuration

Remcos

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings