analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

kres2.exe

Full analysis: https://app.any.run/tasks/95a77968-ec6b-4da9-a6fc-bf9862d7e552
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: March 22, 2019, 08:22:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
rat
remcos
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DEA515C25081073EC2CEE293B2991EE1

SHA1:

811A254AC1F803D5707310F87E454BB7504F0757

SHA256:

9EE19D067EC19B2C6D07726448639C869D61138E2F53C9EED136C3A2622C881B

SSDEEP:

24576:swuUS2kI5NRwB2RTXGeZ6xRdbDpR39xep8bBOV+1JK9AHMx:swZrLwmGeZmbPL3Tep0BA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • kres2.exe (PID: 968)
      • vidccleaner.exe (PID: 260)
    • Detected logs from REMCOS RAT

      • vidccleaner.exe (PID: 2592)
  • SUSPICIOUS

    • Application launched itself

      • kres2.exe (PID: 968)
      • vidccleaner.exe (PID: 260)
    • Executable content was dropped or overwritten

      • kres2.exe (PID: 968)
      • vidccleaner.exe (PID: 260)
      • sethc.exe (PID: 2864)
    • Starts Internet Explorer

      • kres2.exe (PID: 716)
    • Creates files in the user directory

      • vidccleaner.exe (PID: 2592)
    • Writes files like Keylogger logs

      • vidccleaner.exe (PID: 2592)
    • Connects to unusual port

      • vidccleaner.exe (PID: 2592)
  • INFO

    • Application was crashed

      • iexplore.exe (PID: 1024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (53.2)
.exe | Win32 Executable Delphi generic (17.5)
.scr | Windows screen saver (16.1)
.exe | Win32 Executable (generic) (5.5)
.exe | Win16/32 Executable Delphi generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 775168
InitializedDataSize: 422912
UninitializedDataSize: -
EntryPoint: 0xbe224
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.99.0.1200
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Heaventools Software
FileDescription: PE Explorer
FileVersion: 1.99.0.1200
InternalName: PE Explorer
LegalCopyright: Copyright © 2000-2007 Heaventools Software
LegalTrademarks: PE Explorer is a trademark of Heaventools Software
OriginalFileName: pexplorer.exe
ProductName: PE Explorer
ProductVersion: 1.0.0.0
Comments: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • English - United States
CompanyName: Heaventools Software
FileDescription: PE Explorer
FileVersion: 1.99.0.1200
InternalName: PE Explorer
LegalCopyright: Copyright © 2000-2007 Heaventools Software
LegalTrademarks: PE Explorer is a trademark of Heaventools Software
OriginalFilename: pexplorer.exe
ProductName: PE Explorer
ProductVersion: 1.0.0.0
Comments: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x000BD2B8
0x000BD400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57174
DATA
0x000BF000
0x00002A88
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.64601
BSS
0x000C2000
0x00000D6D
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x000C3000
0x00002C0E
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.83293
.tls
0x000C6000
0x00000010
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x000C7000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.20692
.reloc
0x000C8000
0x0000BAB8
0x0000BC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.65975
.rsrc
0x000D4000
0x00055BE8
0x00055C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.34816

Resources

Title
Entropy
Size
Codepage
Language
Type
1
1.97381
1892
Latin 1 / Western European
English - United States
RT_VERSION
50
2.59322
816
Latin 1 / Western European
UNKNOWN
RT_ICON
51
3.06923
304
Latin 1 / Western European
UNKNOWN
RT_ICON
52
2.13551
176
Latin 1 / Western European
UNKNOWN
RT_ICON
53
7.9682
27230
Latin 1 / Western European
UNKNOWN
RT_ICON
54
4.31688
1640
Latin 1 / Western European
UNKNOWN
RT_ICON
55
4.31715
744
Latin 1 / Western European
UNKNOWN
RT_ICON
56
4.11138
488
Latin 1 / Western European
UNKNOWN
RT_ICON
57
3.53404
296
Latin 1 / Western European
UNKNOWN
RT_ICON
58
7.97472
29336
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

ADVAPI32.DLL
activeds.dll
adsldpc.dll
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
kernel32.dll
netapi32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start kres2.exe sethc.exe kres2.exe no specs iexplore.exe vidccleaner.exe sethc.exe no specs #REMCOS vidccleaner.exe

Process information

PID
CMD
Path
Indicators
Parent process
968"C:\Users\admin\Desktop\kres2.exe" C:\Users\admin\Desktop\kres2.exe
explorer.exe
User:
admin
Company:
Heaventools Software
Integrity Level:
MEDIUM
Description:
PE Explorer
Exit code:
0
Version:
1.99.0.1200
2864sethc.exeC:\Windows\system32\sethc.exe
kres2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility shortcut keys
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
716"C:\Users\admin\Desktop\kres2.exe" C:\Users\admin\Desktop\kres2.exekres2.exe
User:
admin
Company:
Heaventools Software
Integrity Level:
MEDIUM
Description:
PE Explorer
Exit code:
3
Version:
1.99.0.1200
1024"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
kres2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
3221225477
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
260C:\Users\admin\AppData\Local\Mozilla\vidccleaner.exeC:\Users\admin\AppData\Local\Mozilla\vidccleaner.exe
sethc.exe
User:
admin
Company:
Heaventools Software
Integrity Level:
MEDIUM
Description:
PE Explorer
Exit code:
0
Version:
1.99.0.1200
3824sethc.exeC:\Windows\system32\sethc.exevidccleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessibility shortcut keys
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2592C:\Users\admin\AppData\Local\Mozilla\vidccleaner.exeC:\Users\admin\AppData\Local\Mozilla\vidccleaner.exe
vidccleaner.exe
User:
admin
Company:
Heaventools Software
Integrity Level:
MEDIUM
Description:
PE Explorer
Version:
1.99.0.1200
Total events
22
Read events
15
Write events
5
Delete events
2

Modification events

(PID) Process:(968) kres2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Mozilla
Value:
C:\Users\admin\AppData\Local\Mozilla\MiniCalc.exe
(PID) Process:(716) kres2.exeKey:HKEY_CURRENT_USER\Software\Cosrem-W8U8RW
Operation:writeName:exepath
Value:
F1745C18E625A8501D141A877F35FEECE740103D341F8D85F4B90DC402F88B71876F562A984CD0D11311D0E79D27E4855E74A1419FAE7CBBF79D4EA21A318DC5923E
(PID) Process:(716) kres2.exeKey:HKEY_CURRENT_USER\Software\Cosrem-W8U8RW
Operation:writeName:licence
Value:
43143E0E52DC3EAD4EFC7C139E20093F
(PID) Process:(716) kres2.exeKey:HKEY_CURRENT_USER\Software\Cosrem-W8U8RW
Operation:writeName:Inj
Value:
1
(PID) Process:(260) vidccleaner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Mozilla
Value:
C:\Users\admin\AppData\Local\Mozilla\MiniCalc.exe
(PID) Process:(260) vidccleaner.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Mozilla
Value:
C:\Users\admin\AppData\Local\Mozilla\MiniCalc.exe
(PID) Process:(2592) vidccleaner.exeKey:HKEY_CURRENT_USER\Software\Cosrem-W8U8RW
Operation:delete valueName:Inj
Value:
1
Executable files
3
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2592vidccleaner.exeC:\Users\admin\AppData\Roaming\Screenshots\time_20190322_082402.pngimage
MD5:0E7C305E09570432137B37AE8F156B83
SHA256:3F0ACA6364648B62872EC1E5A52B8A11809B93FE5E2BF8EC1317241B905D70F0
2864sethc.exeC:\Users\admin\AppData\Local\Mozilla\Fox.pngbinary
MD5:3B22011C95F91BCF6EC77E3DC89C2448
SHA256:B507AB912B816C7C6B80FFEE2D59C9A360DF100209776DC76890A622C6E801F4
2592vidccleaner.exeC:\Users\admin\AppData\Roaming\cosrem\logs.dattext
MD5:D0852A15A3F9B0E4531856A273D59523
SHA256:6876B3B40F4697B68E7932438C5F97A71E226B16A6E5A35B15020BA3FA228CB7
260vidccleaner.exeC:\Users\admin\AppData\Local\Mozilla\MiniCalc.exeexecutable
MD5:DEA515C25081073EC2CEE293B2991EE1
SHA256:9EE19D067EC19B2C6D07726448639C869D61138E2F53C9EED136C3A2622C881B
968kres2.exeC:\Users\admin\AppData\Local\Mozilla\MiniCalc.exeexecutable
MD5:DEA515C25081073EC2CEE293B2991EE1
SHA256:9EE19D067EC19B2C6D07726448639C869D61138E2F53C9EED136C3A2622C881B
2864sethc.exeC:\Users\admin\AppData\Local\Mozilla\vidccleaner.exeexecutable
MD5:DEA515C25081073EC2CEE293B2991EE1
SHA256:9EE19D067EC19B2C6D07726448639C869D61138E2F53C9EED136C3A2622C881B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2592
vidccleaner.exe
185.244.29.195:1991
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2592
vidccleaner.exe
A Network Trojan was detected
MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection
No debug info