File name:

DOCUMENTO TRANSACCION USUARIO SOPORTE.tar

Full analysis: https://app.any.run/tasks/8200583b-ee11-472b-a93e-748a4d93ca8a
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 01, 2023, 03:03:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

EB1DD92FC7D37AF8080E2509B7565604

SHA1:

B5416834E62350011F4F7DA79A3CE9C44D1862C5

SHA256:

9E78D458C28C91DA62BED7F8756BDDF81D80FBDEC93EFEA67E6167755D182341

SSDEEP:

24576:X1U1bPyzJSXaJFQmpql56KCrLWiSHwYdaJjCwsjXIH6twJn72Oa:lU1buUMFQYI56KOq/YJ2XIa872j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3936)

    • Adds path to the Windows Defender exclusion list

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)

    • Starts Visual C# compiler

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)

    • REMCOS detected by memory dumps

      • csc.exe (PID: 3036)

    • Remcos is detected

      • csc.exe (PID: 3036)

  • SUSPICIOUS

    • Reads the Internet Settings

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)
      • csc.exe (PID: 3036)
      • powershell.exe (PID: 2868)

    • Starts CMD.EXE for commands execution

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)

    • The process hide an interactive prompt from the user

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)

    • Starts POWERSHELL.EXE for commands execution

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2868)

    • Connects to unusual port

      • csc.exe (PID: 3036)

  • INFO

    • Checks supported languages

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)
      • csc.exe (PID: 3036)
      • wmpnscfg.exe (PID: 3628)

    • Reads the computer name

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)
      • wmpnscfg.exe (PID: 3628)
      • csc.exe (PID: 3036)

    • The process checks LSA protection

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)
      • powershell.exe (PID: 2868)
      • csc.exe (PID: 3036)
      • wmpnscfg.exe (PID: 3628)

    • Reads the machine GUID from the registry

      • DOCUMENTO TRANSACCION USUARIO SOPORTE.exe (PID: 3788)
      • csc.exe (PID: 3036)
      • wmpnscfg.exe (PID: 3628)

    • Creates files or folders in the user directory

      • cmd.exe (PID: 568)
      • csc.exe (PID: 3036)

    • Create files in a temporary directory

      • powershell.exe (PID: 2868)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 2868)

    • Reads settings of System Certificates

      • powershell.exe (PID: 2868)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3628)

    • Checks proxy server information

      • csc.exe (PID: 3036)

    • Reads Environment values

      • csc.exe (PID: 3036)

    • Reads product name

      • csc.exe (PID: 3036)

    • Creates files in the program directory

      • csc.exe (PID: 3036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3036) csc.exe
Hosts (1)werverdsfefef.con-ip.com:1883
BotnetMEXICO
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRmc-KGQ7TN
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: DOCUMENTO TRANSACCION USUARIO SOPORTE.exe
PackingMethod: Normal
ModifyDate: 2023:03:29 08:44:06
OperatingSystem: Win32
UncompressedSize: 1153433600
CompressedSize: 1350507
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs documento transaccion usuario soporte.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs powershell.exe no specs #REMCOS csc.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568"cmd" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXb1048.21696\DOCUMENTO TRANSACCION USUARIO SOPORTE.exe" "C:\Users\admin\AppData\Roaming\AppData.exe"C:\Windows\System32\cmd.exe—DOCUMENTO TRANSACCION USUARIO SOPORTE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
1048"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DOCUMENTO TRANSACCION USUARIO SOPORTE.tar.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ntdll.dll
2200schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\admin\AppData\Roaming\AppData.exe'" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2868"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\admin\AppData\Local\Temp\Rar$EXb1048.21696\DOCUMENTO TRANSACCION USUARIO SOPORTE.exe'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—DOCUMENTO TRANSACCION USUARIO SOPORTE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3036"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
DOCUMENTO TRANSACCION USUARIO SOPORTE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(3036) csc.exe
Hosts (1)werverdsfefef.con-ip.com:1883
BotnetMEXICO
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRmc-KGQ7TN
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
3628"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3788"C:\Users\admin\AppData\Local\Temp\Rar$EXb1048.21696\DOCUMENTO TRANSACCION USUARIO SOPORTE.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1048.21696\DOCUMENTO TRANSACCION USUARIO SOPORTE.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1048.21696\documento transaccion usuario soporte.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3936"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\admin\AppData\Roaming\AppData.exe'" /fC:\Windows\System32\cmd.exe—DOCUMENTO TRANSACCION USUARIO SOPORTE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 654
Read events
11 510
Write events
138
Delete events
6

Modification events

(PID) Process:(1048) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1048) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
0
Suspicious files
8
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
1048WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1048.21696\DOCUMENTO TRANSACCION USUARIO SOPORTE.exe —
MD5:—
SHA256:—
568cmd.exeC:\Users\admin\AppData\Roaming\AppData.exe —
MD5:—
SHA256:—
3036csc.exeC:\ProgramData\remcos\logs.datbinary
MD5:—
SHA256:—
2868powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
3036csc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].jsonbinary
MD5:—
SHA256:—
2868powershell.exeC:\Users\admin\AppData\Local\Temp\w40x5beg.hoy.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2868powershell.exeC:\Users\admin\AppData\Local\Temp\3x2zpawe.fbv.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3036
csc.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
NL
binary
931 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3036
csc.exe
181.141.3.90:1883
werverdsfefef.con-ip.com
EPM Telecomunicaciones S.A. E.S.P.
CO
unknown
3036
csc.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
suspicious

DNS requests

Domain
IP
Reputation
werverdsfefef.con-ip.com
  • 181.141.3.90
malicious
geoplugin.net
  • 178.237.33.50
suspicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
3036
csc.exe
Unknown Classtype
ET JA3 Hash - Remcos 3.x TLS Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DOCUMENTO TRANSACCION USUARIO SOPORTE.tar