analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PL%2C_INV%2C_BL-PACKING_DOCUMENTS%2Cpdf.zip

Full analysis: https://app.any.run/tasks/417d72d8-4372-411c-9401-fa7e4ab6a406
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: July 12, 2020, 08:39:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
trojan
keylogger
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

17BF1D1EB30A1020C0CDAD5E393D12D9

SHA1:

A25CDE38A2CB5C303D04FD95A9DC329D619815A8

SHA256:

A6648EC6FE21E85A64A16F562655CDC1F48FE06B27157968F6AE431250366EE9

SSDEEP:

6144:sifGAonD7QlHaRYH8mcSMUBWgeINbx02IbpruB3IzXBMpI9f3aI:sifM70THBWgJbiMBKXBV1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3968)
    • Uses Task Scheduler to run other applications

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1956)
    • Connects to CnC server

      • vbc.exe (PID: 1008)
    • REMCOS was detected

      • vbc.exe (PID: 1008)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • WinRAR.exe (PID: 2216)
    • Creates files in the user directory

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • vbc.exe (PID: 1008)
    • Executes scripts

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3968)
    • Writes files like Keylogger logs

      • vbc.exe (PID: 1008)
  • INFO

    • Manual execution by user

      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3640)
      • PL, INV, BL-PACKING DOCUMENTS,pdf.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: PL, INV, BL-PACKING DOCUMENTS,pdf.exe
ZipUncompressedSize: 303616
ZipCompressedSize: 211515
ZipCRC: 0x27e3d489
ZipModifyDate: 2020:07:12 09:11:19
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe pl, inv, bl-packing documents,pdf.exe pl, inv, bl-packing documents,pdf.exe no specs schtasks.exe no specs #REMCOS vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2129f06f-4910-46e3-b147-13a91e24e74e.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3640"C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Tetris
Exit code:
0
Version:
1.0.0.0
3968"C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exe" C:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Tetris
Exit code:
0
Version:
1.0.0.0
1956"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bqrsxoTw" /XML "C:\Users\admin\AppData\Local\Temp\tmp9B28.tmp"C:\Windows\System32\schtasks.exePL, INV, BL-PACKING DOCUMENTS,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1008"{path}"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PL, INV, BL-PACKING DOCUMENTS,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Version:
14.7.3062.0
2648"{path}"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exePL, INV, BL-PACKING DOCUMENTS,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
1
Version:
14.7.3062.0
Total events
507
Read events
490
Write events
17
Delete events
0

Modification events

(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2216) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2216) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\2129f06f-4910-46e3-b147-13a91e24e74e.zip
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3640PL, INV, BL-PACKING DOCUMENTS,pdf.exeC:\Users\admin\AppData\Local\Temp\tmp9B28.tmp
MD5:
SHA256:
2216WinRAR.exeC:\Users\admin\Desktop\PL, INV, BL-PACKING DOCUMENTS,pdf.exeexecutable
MD5:875D1341464339F98E80899903D51A41
SHA256:1F08995FAF8B4AF6A6CB979A890F6DCF4A6E526382E63F9E8B27ADD0140BFF33
1008vbc.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:E3ACC016B7BD4382B6720A13D355B9C6
SHA256:A5E9CE888C739E0A0387974AED3E7D2ED4CF0F2FCE9A2A32A4646EC17BBB55CC
3640PL, INV, BL-PACKING DOCUMENTS,pdf.exeC:\Users\admin\AppData\Roaming\bqrsxoTw.exeexecutable
MD5:875D1341464339F98E80899903D51A41
SHA256:1F08995FAF8B4AF6A6CB979A890F6DCF4A6E526382E63F9E8B27ADD0140BFF33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1008
vbc.exe
185.244.30.19:1965
jamesanderson68986.ddns.net
malicious

DNS requests

Domain
IP
Reputation
jamesanderson68986.ddns.net
  • 185.244.30.19
malicious

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
1008
vbc.exe
A Network Trojan was detected
REMOTE [PTsecurity] Remcos.RAT
16 ETPRO signatures available at the full report
No debug info