| File name: | Remcos v2.0.5 Professional Cracked By DzGhost.exe |
| Full analysis: | https://app.any.run/tasks/7ba094e0-1428-4ce3-8435-45cbad4b6a27 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | December 10, 2023, 15:37:12 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 94783ADD673806C56A1775BF207B62CD |
| SHA1: | 6D65F7F764B90CBE91B286DBFB0E034ED5906459 |
| SHA256: | A3EEBC6BA03876034285B56765B5C8390B8EB3BF009C86409F53D0D7369581E7 |
| SSDEEP: | 393216:F4QvBFpWnKyu+iWp0xgfbAlVktexY3ib9a:F3vAFi/xgfS8exY3iw |
MALICIOUS
Drops the executable file immediately after the start
- Remcos v2.0.5 Professional Cracked By DzGhost.exe (PID: 2956)
- HVHY.EXE (PID: 3924)
- remcos.exe (PID: 2600)
- hicham1.EXE (PID: 1988)
- StubSoftware.exe (PID: 1036)
- certutil.exe (PID: 3892)
- hicham1.EXE (PID: 4080)
- certutil.exe (PID: 2064)
REMCOS has been detected (YARA)
- remcos.exe (PID: 1936)
- remcos.exe (PID: 3496)
NJRAT has been detected (YARA)
- System.exe (PID: 3140)
NjRAT is detected
- HVHY.EXE (PID: 3340)
- System.exe (PID: 3140)
Changes the autorun value in the registry
- System.exe (PID: 3140)
SUSPICIOUS
Process drops legitimate windows executable
- StubSoftware.exe (PID: 1036)
Reads the Internet Settings
- StubSoftware.exe (PID: 1036)
- remcos.exe (PID: 2600)
- remcos.exe (PID: 1936)
- HVHY.EXE (PID: 3924)
The process creates files with name similar to system file names
- hicham1.EXE (PID: 1988)
- HVHY.EXE (PID: 3924)
- hicham1.EXE (PID: 4080)
Process drops legitimate windows executable (CertUtil.exe)
- hicham1.EXE (PID: 1988)
- hicham1.EXE (PID: 4080)
Uses NETSH.EXE to add a firewall rule or allowed programs
- System.exe (PID: 3140)
Starts itself from another location
- HVHY.EXE (PID: 3924)
INFO
Checks supported languages
- Remcos v2.0.5 Professional Cracked By DzGhost.exe (PID: 2956)
- StubSoftware.exe (PID: 1036)
- remcos.exe (PID: 2600)
- hicham1.EXE (PID: 1988)
- certutil.exe (PID: 3892)
- HVHY.EXE (PID: 3924)
- remcos.exe (PID: 1936)
- System.exe (PID: 3140)
- remcos.exe (PID: 3916)
- StubSoftware.exe (PID: 900)
- HVHY.EXE (PID: 3340)
- remcos.exe (PID: 3496)
- hicham1.EXE (PID: 4080)
- certutil.exe (PID: 2064)
Reads the computer name
- Remcos v2.0.5 Professional Cracked By DzGhost.exe (PID: 2956)
- StubSoftware.exe (PID: 1036)
- remcos.exe (PID: 2600)
- remcos.exe (PID: 1936)
- HVHY.EXE (PID: 3924)
- certutil.exe (PID: 3892)
- System.exe (PID: 3140)
- remcos.exe (PID: 3916)
- StubSoftware.exe (PID: 900)
- certutil.exe (PID: 2064)
- HVHY.EXE (PID: 3340)
- remcos.exe (PID: 3496)
Manual execution by a user
- remcos.exe (PID: 2600)
- remcos.exe (PID: 3916)
Reads the machine GUID from the registry
- remcos.exe (PID: 2600)
- StubSoftware.exe (PID: 1036)
- HVHY.EXE (PID: 3924)
- StubSoftware.exe (PID: 900)
- System.exe (PID: 3140)
- remcos.exe (PID: 3916)
- HVHY.EXE (PID: 3340)
Create files in a temporary directory
- remcos.exe (PID: 2600)
- hicham1.EXE (PID: 1988)
- StubSoftware.exe (PID: 1036)
- certutil.exe (PID: 3892)
- remcos.exe (PID: 3916)
- StubSoftware.exe (PID: 900)
- hicham1.EXE (PID: 4080)
- certutil.exe (PID: 2064)
Creates files or folders in the user directory
- HVHY.EXE (PID: 3924)
Checks proxy server information
- remcos.exe (PID: 1936)
Reads Environment values
- System.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(3140) System.exe
C2dzghost16.ddns.net
Ports7777
Botnetuploaded
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\28d82d8720ed7d5786de132ed11c43ff
Splitter|'|'|
Version0.7d
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:12:30 08:00:00+01:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 168960 |
| InitializedDataSize: | 53248 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x27796 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 18.6.0.0 |
| ProductVersionNumber: | 18.6.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Igor Pavlov |
| FileDescription: | 7z SFX |
| FileVersion: | 18.06 |
| InternalName: | 7z.sfx |
| LegalCopyright: | Copyright (c) 1999-2018 Igor Pavlov |
| OriginalFileName: | 7z.sfx.exe |
| ProductName: | 7-Zip |
| ProductVersion: | 18.06 |
Total processes
54
Monitored processes
15
Malicious processes
11
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 900 | "C:\Users\admin\AppData\Local\Temp\StubSoftware.exe" | C:\Users\admin\AppData\Local\Temp\StubSoftware.exe | — | remcos.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: StubBinder Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1036 | "C:\Users\admin\AppData\Local\Temp\StubSoftware.exe" | C:\Users\admin\AppData\Local\Temp\StubSoftware.exe | — | remcos.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: StubBinder Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1936 | "C:\Users\admin\AppData\Local\Temp\remcos.exe" | C:\Users\admin\AppData\Local\Temp\remcos.exe | StubSoftware.exe | ||||||||||||
User: admin Company: Breaking-Security.net Integrity Level: MEDIUM Description: REMCOS Remote Control & Surveillance Exit code: 0 Version: 1.7.0.0 Modules
| |||||||||||||||
| 1988 | "C:\Users\admin\AppData\Local\Temp\hicham1.EXE" | C:\Users\admin\AppData\Local\Temp\hicham1.EXE | — | StubSoftware.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2064 | CERTUTIL -DECODE NAME.TXT HVHY.EXE | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\certutil.exe | — | hicham1.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 0 Version: 6.1.7601.18151 (win7sp1_gdr.130512-1533) Modules
| |||||||||||||||
| 2600 | "C:\Users\admin\Desktop\remcos.exe" | C:\Users\admin\Desktop\remcos.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 4294967295 Version: 0.0.0.0 Modules
| |||||||||||||||
| 2956 | "C:\Users\admin\AppData\Local\Temp\Remcos v2.0.5 Professional Cracked By DzGhost.exe" | C:\Users\admin\AppData\Local\Temp\Remcos v2.0.5 Professional Cracked By DzGhost.exe | — | explorer.exe | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7z SFX Exit code: 0 Version: 18.06 Modules
| |||||||||||||||
| 3140 | "C:\Users\admin\AppData\Roaming\System.exe" | C:\Users\admin\AppData\Roaming\System.exe | HVHY.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
NjRat(PID) Process(3140) System.exe C2dzghost16.ddns.net Ports7777 Botnetuploaded Options Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\28d82d8720ed7d5786de132ed11c43ff Splitter|'|'| Version0.7d | |||||||||||||||
| 3276 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\System.exe" "System.exe" ENABLE | C:\Windows\System32\netsh.exe | — | System.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3340 | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\HVHY.EXE | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\HVHY.EXE | hicham1.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
6 614
Read events
6 251
Write events
363
Delete events
0
Modification events
| (PID) Process: | (2956) Remcos v2.0.5 Professional Cracked By DzGhost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2956) Remcos v2.0.5 Professional Cracked By DzGhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | Browse For Folder Width |
Value: 318 | |||
| (PID) Process: | (2956) Remcos v2.0.5 Professional Cracked By DzGhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | Browse For Folder Height |
Value: 288 | |||
| (PID) Process: | (2600) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2600) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2600) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2600) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (1036) StubSoftware.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1036) StubSoftware.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1036) StubSoftware.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
Executable files
10
Suspicious files
0
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2956 | Remcos v2.0.5 Professional Cracked By DzGhost.exe | C:\Users\admin\Desktop\Remcos Loader.exe | executable | |
MD5:75792B5B38EDD028D13EEF62C0D828E6 | SHA256:B7F82678830C34DB745A16D5551386F15FF28FDA563F10C6903F6471A58E243E | |||
| 1988 | hicham1.EXE | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\name.txt | text | |
MD5:2731A47D64258AE6C88302F48A86B625 | SHA256:CB6BD69E43E19039459F153CA6B2228ADC463D4C43C650B7DBECFFCEFFFEA3A8 | |||
| 2600 | remcos.exe | C:\Users\admin\AppData\Local\Temp\StubSoftware.exe | executable | |
MD5:71B5F28D3FB45C0AFA2B06B6AF206854 | SHA256:8BB63AF07358259AD749B1AFB5D3EE4B715DB2D4CC35EB5AB97D2275AD465387 | |||
| 4080 | hicham1.EXE | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\certutil.exe | executable | |
MD5:0D52559AEF4AA5EAC82F530617032283 | SHA256:48850FB7229D99E48C3A749556684E962587058D612C659C58F8B8DB2D00ABEE | |||
| 3924 | HVHY.EXE | C:\Users\admin\AppData\Roaming\System.exe | executable | |
MD5:EA260276AF817A36713D082A1C78B453 | SHA256:89A1D2F76FBD5309CA67BDDBFD4806134F415BA1E01DC26C91A07C6146C432E0 | |||
| 2064 | certutil.exe | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\HVHY.EXE | executable | |
MD5:EA260276AF817A36713D082A1C78B453 | SHA256:89A1D2F76FBD5309CA67BDDBFD4806134F415BA1E01DC26C91A07C6146C432E0 | |||
| 4080 | hicham1.EXE | C:\Users\admin\AppData\Local\Temp\IXP001.TMP\name.txt | text | |
MD5:2731A47D64258AE6C88302F48A86B625 | SHA256:CB6BD69E43E19039459F153CA6B2228ADC463D4C43C650B7DBECFFCEFFFEA3A8 | |||
| 1988 | hicham1.EXE | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\certutil.exe | executable | |
MD5:0D52559AEF4AA5EAC82F530617032283 | SHA256:48850FB7229D99E48C3A749556684E962587058D612C659C58F8B8DB2D00ABEE | |||
| 1036 | StubSoftware.exe | C:\Users\admin\AppData\Local\Temp\hicham1.EXE | executable | |
MD5:D9018424E06E42A1C1D912CF1E1A76E6 | SHA256:72FDB61D67BDC3109196A0A7EA27868FA7D08BD07658830D5FBF894D6DA87770 | |||
| 3892 | certutil.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\HVHY.EXE | executable | |
MD5:EA260276AF817A36713D082A1C78B453 | SHA256:89A1D2F76FBD5309CA67BDDBFD4806134F415BA1E01DC26C91A07C6146C432E0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
2
Threats
1
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
breakingsec01.co.nf |
| unknown |
dzghost16.ddns.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |