File name:

PL%2C_INV%2C_BL-PACKING_DOCUMENTS%2Cpdf.zip

Full analysis: https://app.any.run/tasks/417d72d8-4372-411c-9401-fa7e4ab6a406
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: July 12, 2020, 08:39:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
trojan
keylogger
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

17BF1D1EB30A1020C0CDAD5E393D12D9

SHA1:

A25CDE38A2CB5C303D04FD95A9DC329D619815A8

SHA256:

A6648EC6FE21E85A64A16F562655CDC1F48FE06B27157968F6AE431250366EE9

SSDEEP:

6144:sifGAonD7QlHaRYH8mcSMUBWgeINbx02IbpruB3IzXBMpI9f3aI:sifM70THBWgJbiMBKXBV1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3968)
    • Uses Task Scheduler to run other applications

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1956)
    • Connects to CnC server

      • vbc.exe (PID: 1008)
    • REMCOS was detected

      • vbc.exe (PID: 1008)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2216)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
    • Creates files in the user directory

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • vbc.exe (PID: 1008)
    • Executes scripts

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3968)
    • Writes files like Keylogger logs

      • vbc.exe (PID: 1008)
  • INFO

    • Manual execution by user

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:07:12 09:11:19
ZipCRC: 0x27e3d489
ZipCompressedSize: 211515
ZipUncompressedSize: 303616
ZipFileName: PL, INV, BL-PACKING DOCUMENTS,pdf.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe pl, inv, bl-packing documents,pdf.exe pl, inv, bl-packing documents,pdf.exe no specs schtasks.exe no specs #REMCOS vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1008"{path}"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PL, INV, BL-PACKING DOCUMENTS,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
14.7.3062.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1956"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bqrsxoTw" /XML "C:\Users\admin\AppData\Local\Temp\tmp9B28.tmp"C:\Windows\System32\schtasks.exePL, INV, BL-PACKING DOCUMENTS,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2129f06f-4910-46e3-b147-13a91e24e74e.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2648"{path}"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exePL, INV, BL-PACKING DOCUMENTS,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
1
Version:
14.7.3062.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3640"C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Tetris
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\pl, inv, bl-packing documents,pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3968"C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Tetris
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\pl, inv, bl-packing documents,pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
507
Read events
490
Write events
17
Delete events
0

Modification events

(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2216) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2216) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\2129f06f-4910-46e3-b147-13a91e24e74e.zip
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3640PL, INV, BL-PACKING DOCUMENTS,pdf.exeC:\Users\admin\AppData\Local\Temp\tmp9B28.tmp
MD5:
SHA256:
1008vbc.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:
SHA256:
2216WinRAR.exeC:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exeexecutable
MD5:
SHA256:
3640PL, INV, BL-PACKING DOCUMENTS,pdf.exeC:\Users\admin\AppData\Roaming\bqrsxoTw.exeexecutable
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
66

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1008
vbc.exe
185.244.30.19:1965
jamesanderson68986.ddns.net
malicious

DNS requests

Domain
IP
Reputation
jamesanderson68986.ddns.net
  • 185.244.30.19
malicious

Threats

PID
Process
Class
Message
1048
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
16 ETPRO signatures available at the full report
No debug info