File name:

TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe

Full analysis: https://app.any.run/tasks/ddc65aa3-1a18-4c99-ae01-2ce453647a3a
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: July 08, 2024, 20:41:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
evasion
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

69D965D1EF86FA8F3128D18004A6A51A

SHA1:

68DF5A5CE717319E0A902E111F9C74474B3DCB31

SHA256:

A360D39F4F0CBF35D94D76ECE306A9259DF783256A793C8FBE04823974C40DE4

SSDEEP:

98304:Y/HdvSsb1myNioFrYaC8dsnmpau3//FM2KJP+dtbzAP2O0vviApWDTcPcA6jDLPI:nw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3344)
    • Drops the executable file immediately after the start

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3344)
    • REMCOS has been detected

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • REMCOS has been detected (SURICATA)

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • REMCOS has been detected (YARA)

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
  • SUSPICIOUS

    • Application launched itself

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3344)
    • Connects to unusual port

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Contacting a server suspected of hosting an CnC

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Reads the Internet Settings

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Reads security settings of Internet Explorer

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Checks for external IP

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Writes files like Keylogger logs

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • There is functionality for taking screenshot (YARA)

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
  • INFO

    • Checks supported languages

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3344)
    • Reads product name

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Reads Environment values

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Reads the computer name

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Reads the machine GUID from the registry

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Checks proxy server information

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Creates files or folders in the user directory

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
    • Creates files in the program directory

      • TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe (PID: 3272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
C2 (1)higlkgligliygligly.con-ip.com:1666
BotnetFUERTES
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-VQ2QTP
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:06:21 18:26:03+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: -
CodeSize: 1142784
InitializedDataSize: 1433600
UninitializedDataSize: -
EntryPoint: 0xc3508
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.587.0
ProductVersionNumber: 1.2.587.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Collector's Edition
CompanyName: Big Fish Games, Inc
FileDescription: Mystery Case Files: Dire Grove (TM)
FileVersion: 1.2.587
InternalName: MCF6
LegalCopyright: Copyright 2009
LegalTrademarks: -
OriginalFileName: MCF6.exe
PrivateBuild: -
ProductName: Mystery Case Files: Dire Grove (TM)
ProductVersion: 1.2.587
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start trans no 149824984984984984984984924654194984198498498 julio 8 de 2024.exe #REMCOS trans no 149824984984984984984984924654194984198498498 julio 8 de 2024.exe

Process information

PID
CMD
Path
Indicators
Parent process
3272"C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe"C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
User:
admin
Company:
Big Fish Games, Inc
Integrity Level:
MEDIUM
Description:
Mystery Case Files: Dire Grove (TM)
Version:
1.2.587
Modules
Images
c:\users\admin\appdata\local\temp\trans no 149824984984984984984984924654194984198498498 julio 8 de 2024.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Remcos
(PID) Process(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
C2 (1)higlkgligliygligly.con-ip.com:1666
BotnetFUERTES
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-VQ2QTP
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3344"C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe" C:\Users\admin\AppData\Local\Temp\TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
explorer.exe
User:
admin
Company:
Big Fish Games, Inc
Integrity Level:
MEDIUM
Description:
Mystery Case Files: Dire Grove (TM)
Exit code:
0
Version:
1.2.587
Modules
Images
c:\users\admin\appdata\local\temp\trans no 149824984984984984984984924654194984198498498 julio 8 de 2024.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
674
Read events
644
Write events
24
Delete events
6

Modification events

(PID) Process:(3344) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:apocalipsa
Value:
C:\Users\admin\Documents\tuopac\susa.exe
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Rmc-VQ2QTP
Operation:writeName:exepath
Value:
3D89C2FA9FB3B3BF045C774F27C737E7C1B9242C95589CA31825263C84477A96CC0A82C010EC2A41699D5F0A258CA3075F96299B05CE2106270A7BAE7C1F0899C51A4EF888B1C20263BDC5E4ED30870D8B35CA1FF5525B9D639E38E0C9507CBABB2F3E58BFFD3C16B0DEE0ABBA0F6952493CEA95D61C86D3FDE5AA43AFFC97D87E62CF91BABC70938CFFEF9C8883E803E9C0E9F3A8EFD43301E6A956EB65A83767EE6516D2189603EC92A014EC797274D20D34D7DB6E1BDA303DE5933679B0B39D9E491D2671B2722E9B4ED99DD4C3FE33C03BD71D0EE5E1F50E
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Rmc-VQ2QTP
Operation:writeName:licence
Value:
52C881E79273F9E397011DEBD9B6D8A3
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Rmc-VQ2QTP
Operation:writeName:time
Value:
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(3272) TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3272TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].jsonbinary
MD5:0704661F80D9295BA2AE2BF580E8A97E
SHA256:77CFC2BA48F1256910C4C5233E0E7E43CD65294B7155A9070F42952025DAE9E6
3272TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exeC:\ProgramData\remcos\logs.datbinary
MD5:AA72D5902613DD9D8FC48409C280DEFE
SHA256:5B11BD91CDA421BDC1B2AF448BCA207418972B85093AE0DF56A8B1A3A976C841
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
14
DNS requests
6
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
unknown
1372
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
3272
TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1060
svchost.exe
224.0.0.252:5355
whitelisted
2564
svchost.exe
239.255.255.250:3702
whitelisted
4
System
192.168.100.255:137
whitelisted
1372
svchost.exe
40.127.240.158:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
whitelisted
1372
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1372
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
3272
TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
179.15.133.126:1666
higlkgligliygligly.con-ip.com
Colombia Movil
CO
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
higlkgligliygligly.con-ip.com
  • 179.15.133.126
unknown
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
3272
TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
3272
TRANS NO 149824984984984984984984924654194984198498498 JULIO 8 DE 2024.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
1 ETPRO signatures available at the full report
No debug info