| File name: | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe |
| Full analysis: | https://app.any.run/tasks/ddc65aa3-1a18-4c99-ae01-2ce453647a3a |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | July 08, 2024, 20:41:55 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 69D965D1EF86FA8F3128D18004A6A51A |
| SHA1: | 68DF5A5CE717319E0A902E111F9C74474B3DCB31 |
| SHA256: | A360D39F4F0CBF35D94D76ECE306A9259DF783256A793C8FBE04823974C40DE4 |
| SSDEEP: | 98304:Y/HdvSsb1myNioFrYaC8dsnmpau3//FM2KJP+dtbzAP2O0vviApWDTcPcA6jDLPI:nw |
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2009:06:21 18:26:03+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | - |
| CodeSize: | 1142784 |
| InitializedDataSize: | 1433600 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xc3508 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.2.587.0 |
| ProductVersionNumber: | 1.2.587.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | Debug |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| Comments: | Collector's Edition |
| CompanyName: | Big Fish Games, Inc |
| FileDescription: | Mystery Case Files: Dire Grove (TM) |
| FileVersion: | 1.2.587 |
| InternalName: | MCF6 |
| LegalCopyright: | Copyright 2009 |
| LegalTrademarks: | - |
| OriginalFileName: | MCF6.exe |
| PrivateBuild: | - |
| ProductName: | Mystery Case Files: Dire Grove (TM) |
| ProductVersion: | 1.2.587 |
| SpecialBuild: | - |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3272 | "C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe" | C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | ||||||||||||
User: admin Company: Big Fish Games, Inc Integrity Level: MEDIUM Description: Mystery Case Files: Dire Grove (TM) Version: 1.2.587 Modules
Remcos(PID) Process(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe C2 (1)higlkgligliygligly.con-ip.com:1666 BotnetFUERTES Options Connect_interval1 Install_flagFalse Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Install_HKLM\Winlogon\Shell100000 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueFalse Hide_fileFalse Mutex_nameRmc-VQ2QTP Keylog_flag1 Keylog_path%LOCALAPPDATA% Keylog_filelogs.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileScreenshots Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos | |||||||||||||||
| 3344 | "C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe" | C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | explorer.exe | ||||||||||||
User: admin Company: Big Fish Games, Inc Integrity Level: MEDIUM Description: Mystery Case Files: Dire Grove (TM) Exit code: 0 Version: 1.2.587 Modules
| |||||||||||||||
| (PID) Process: | (3344) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | apocalipsa |
Value: C:\Users\admin\Documents\tuopac\susa.exe | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Rmc-VQ2QTP |
| Operation: | write | Name: | exepath |
Value: 3D89C2FA9FB3B3BF045C774F27C737E7C1B9242C95589CA31825263C84477A96CC0A82C010EC2A41699D5F0A258CA3075F96299B05CE2106270A7BAE7C1F0899C51A4EF888B1C20263BDC5E4ED30870D8B35CA1FF5525B9D639E38E0C9507CBABB2F3E58BFFD3C16B0DEE0ABBA0F6952493CEA95D61C86D3FDE5AA43AFFC97D87E62CF91BABC70938CFFEF9C8883E803E9C0E9F3A8EFD43301E6A956EB65A83767EE6516D2189603EC92A014EC797274D20D34D7DB6E1BDA303DE5933679B0B39D9E491D2671B2722E9B4ED99DD4C3FE33C03BD71D0EE5E1F50E | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Rmc-VQ2QTP |
| Operation: | write | Name: | licence |
Value: 52C881E79273F9E397011DEBD9B6D8A3 | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Rmc-VQ2QTP |
| Operation: | write | Name: | time |
Value: | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyServer |
Value: | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyOverride |
Value: | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoConfigURL |
Value: | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoDetect |
Value: | |||
| (PID) Process: | (3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3272 | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].json | binary | |
MD5:0704661F80D9295BA2AE2BF580E8A97E | SHA256:77CFC2BA48F1256910C4C5233E0E7E43CD65294B7155A9070F42952025DAE9E6 | |||
| 3272 | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | C:\ProgramData\remcos\logs.dat | binary | |
MD5:AA72D5902613DD9D8FC48409C280DEFE | SHA256:5B11BD91CDA421BDC1B2AF448BCA207418972B85093AE0DF56A8B1A3A976C841 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1372 | svchost.exe | GET | 304 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
3272 | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1372 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1372 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1372 | svchost.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1372 | svchost.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
3272 | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | 179.15.133.126:1666 | higlkgligliygligly.con-ip.com | Colombia Movil | CO | unknown |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
higlkgligliygligly.con-ip.com |
| unknown |
geoplugin.net |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
1060 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com) |
3272 | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
3272 | TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |