| File name: | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.7z |
| Full analysis: | https://app.any.run/tasks/1b5a3154-d7f7-496e-9f56-96833adfd7e5 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | July 09, 2024, 16:39:01 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 1F23581F27340E9A2A11027B805CE5F5 |
| SHA1: | D59F7E0909337F87F7D8258E104CA88618F2B8DD |
| SHA256: | 94DEEB4FE1AFBE0292B0572B5CA372428BBBD368CE3D9BDD50DE00D9438AEC85 |
| SSDEEP: | 98304:Ow/jMeZH8LAlb8KL4rCkpIYDcEp031hEJ9yMxH1wDb0qPT84SiOpUL7UJbzzLuyS:giupU |
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3128 | "C:\Users\admin\Desktop\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe" | C:\Users\admin\Desktop\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: 2707spapool0907 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3160 | "C:\Users\admin\Desktop\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe" | C:\Users\admin\Desktop\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: 2707spapool0907 Version: 1.0.0.0 Modules
Remcos(PID) Process(3160) AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe C2 (1)areaseguras.con-ip.com:2707 Botnetspacolombia2707 Options Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Install_HKLM\Winlogon\Shell100000 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueTrue Hide_fileFalse Mutex_nameRmc12145501-89YHUH Keylog_flag1 Keylog_path%APPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirloggsd | |||||||||||||||
| 3344 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.7z" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3700 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.7z | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3344) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3128 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | C:\Users\admin\AppData\Roaming\Onafuktmb.exe | executable | |
MD5:89099414438569A524EDDD71DA8C1CD1 | SHA256:281A5E7F53893EDFEFBD54AA90A8A8D5E99526F11AF7C0D837FDC9D86F7E050D | |||
| 3344 | WinRAR.exe | C:\Users\admin\Desktop\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA\AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | executable | |
MD5:89099414438569A524EDDD71DA8C1CD1 | SHA256:281A5E7F53893EDFEFBD54AA90A8A8D5E99526F11AF7C0D837FDC9D86F7E050D | |||
| 3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].json | binary | |
MD5:C30D5431E93C18F6EC71AAA9BAAC3A3D | SHA256:BC3DEA96CBA0AAE0D671AA4FFDCC6C497CF2EAE8B206454A0B8EDC3C05503E03 | |||
| 3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\json[1].json | binary | |
MD5:7D2C1033CB0F811535A7762848299012 | SHA256:8BE748A0BAB5A7027B46D851ECFD3C33C8E7BFCE7C175D36BD5F3EA617DAC7E0 | |||
| 3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | C:\Users\admin\AppData\Roaming\loggsd\logs.dat | binary | |
MD5:627BE380E29DE25BA21F3E478E411074 | SHA256:1B0A1829183EB3CCE1FD07515748814DBDE748CF7AD263F4A754748E93B72F2D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1372 | svchost.exe | GET | 304 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
1060 | svchost.exe | GET | 304 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b | unknown | — | — | unknown |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | unknown |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | unknown |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1372 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 239.255.255.250:3702 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
1372 | svchost.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1372 | svchost.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | 86.104.72.183:2707 | areaseguras.con-ip.com | Mouk, LLC | CA | unknown |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
areaseguras.con-ip.com |
| malicious |
geoplugin.net |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
|---|---|---|---|
1060 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com) |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
3160 | AVISO SOPORTE DE PAGO TRASLADO DE FONDOS ENVIADO POR MEDIO DE TRANSFERENCIA INTERBANCARIA.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |