File name:

Scan1089293847592.JS

Full analysis: https://app.any.run/tasks/a269abfe-626a-410b-abea-ecd3157113bd
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: July 16, 2025, 03:44:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
remcos
rat
auto-reg
remote
Indicators:
MIME: application/javascript
File info: JavaScript source, Unicode text, UTF-8 text, with very long lines (65510), with no line terminators
MD5:

E20A06DC35BF307E0B10FCFE63EF0E19

SHA1:

F5EEA96AE5FFCAC336579AAC6F14082F97C190DE

SHA256:

B1D4942E4C0F00286EB540823D48FC2CF88948FF42A4615A643E003CFDD28275

SSDEEP:

196608:3CzChUqJ+je8h27rajU8/tjep5cej+216QqMH18Ovxso+ljd:3CzChUqJ+je8h27rajUstj45cejXqMHk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 6240)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 6240)

    • Detects the decoding of a binary file from Base64 (SCRIPT)

      • wscript.exe (PID: 6240)

    • Loads dropped or rewritten executable

      • wall.css.exe (PID: 1192)
      • cmd.exe (PID: 7136)
      • cmd.exe (PID: 4192)
      • extrac32.exe (PID: 1052)
      • SndVol.exe (PID: 4820)
      • PING.EXE (PID: 3960)

    • REMCOS has been detected

      • SndVol.exe (PID: 4820)
      • SndVol.exe (PID: 4820)

    • REMCOS mutex has been found

      • SndVol.exe (PID: 4820)

    • REMCOS has been detected (SURICATA)

      • SndVol.exe (PID: 4820)

    • Changes the autorun value in the registry

      • wall.css.exe (PID: 1192)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • wscript.exe (PID: 6240)
      • extrac32.exe (PID: 1052)

    • Creates XML DOM element (SCRIPT)

      • wscript.exe (PID: 6240)

    • Script creates XML DOM node (SCRIPT)

      • wscript.exe (PID: 6240)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 6240)
      • extrac32.exe (PID: 1052)
      • wall.css.exe (PID: 1192)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 6240)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6240)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 6240)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6240)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 6240)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 6240)

    • Likely accesses (executes) a file from the Public directory

      • ScriptRunner.exe (PID: 2324)
      • wall.css.exe (PID: 1192)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6240)

    • There is functionality for taking screenshot (YARA)

      • wall.css.exe (PID: 1192)

    • Starts CMD.EXE for commands execution

      • wall.css.exe (PID: 1192)

    • Reads security settings of Internet Explorer

      • wall.css.exe (PID: 1192)

    • Executing commands from ".cmd" file

      • wall.css.exe (PID: 1192)

    • Connects to unusual port

      • SndVol.exe (PID: 4820)

    • Contacting a server suspected of hosting an CnC

      • SndVol.exe (PID: 4820)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7136)

  • INFO

    • The sample compiled with english language support

      • wscript.exe (PID: 6240)
      • extrac32.exe (PID: 1052)

    • Reads security settings of Internet Explorer

      • ScriptRunner.exe (PID: 2324)
      • SndVol.exe (PID: 4820)

    • Checks supported languages

      • wall.css.exe (PID: 1192)
      • extrac32.exe (PID: 1052)

    • Reads the computer name

      • wall.css.exe (PID: 1192)
      • extrac32.exe (PID: 1052)

    • Checks proxy server information

      • wall.css.exe (PID: 1192)
      • SndVol.exe (PID: 4820)
      • slui.exe (PID: 4132)

    • Compiled with Borland Delphi (YARA)

      • wall.css.exe (PID: 1192)

    • Creates files in the program directory

      • wall.css.exe (PID: 1192)
      • SndVol.exe (PID: 4820)

    • Launching a file from a Registry key

      • wall.css.exe (PID: 1192)

    • Reads the machine GUID from the registry

      • wall.css.exe (PID: 1192)

    • Creates files or folders in the user directory

      • SndVol.exe (PID: 4820)

    • Reads the software policy settings

      • slui.exe (PID: 4132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
12
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe scriptrunner.exe no specs conhost.exe no specs wall.css.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs extrac32.exe ping.exe no specs #REMCOS sndvol.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ScriptRunner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052extrac32 /C /Y "C:\\Windows\\SysWOW64\\AuthExt.dll" "C:\\Windows \\SysWOW64\\amsi.dll" C:\Windows\SysWOW64\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
1192"C:\Users\Public\Libraries\wall.css.exe" C:\Users\Public\Libraries\wall.css.exe
ScriptRunner.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\libraries\wall.css.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2324"C:\Windows\System32\ScriptRunner.exe" -appvscript C:\Users\Public\Libraries\wall.css.exeC:\Windows\System32\ScriptRunner.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
10.0.19041.3996
Modules
Images
c:\windows\system32\scriptrunner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3960ping 127.0.0.1 -n 10 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
4132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4192C:\WINDOWS\system32\cmd.exe /c C:\\ProgramData\\Iqvflzsz20496.cmdC:\Windows\SysWOW64\cmd.exe—wall.css.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4820C:\Windows\System32\SndVol.exeC:\Windows\SysWOW64\SndVol.exe
wall.css.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Volume Mixer
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sndvol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\win32u.dll
6140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 501
Read events
2 492
Write events
9
Delete events
0

Modification events

(PID) Process:(6240) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
AF58170000000000
(PID) Process:(1192) wall.css.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Iqvflzsz
Value:
C:\\ProgramData\\Iqvflzsz.url
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-X7NP08
Operation:writeName:exepath
Value:
B11F489CC15939D391350876FAD888B9B407A16CF6ECBFBAE53CF8B9DC4292AE9CCF747E6D8FABF12A2FA7EE957DAA411054F7CCC09EE4A603F7A02E65CB
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-X7NP08
Operation:writeName:licence
Value:
31C3FFA960BE7DC2B989D41CFCE8D910
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-X7NP08
Operation:writeName:time
Value:
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-X7NP08
Operation:writeName:UID
Value:
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4820) SndVol.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
6
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1192wall.css.exeC:\ProgramData\Iqvflzsz42.cmdtext
MD5:6B6C7BA01F0CF7011FEDF98DE8051581
SHA256:DBE81BBD0C3F8CB44EB45CD4D3669BD72BF95003804328D8F02417C2DF49C481
6240wscript.exeC:\Users\Public\Libraries\amsi.dllexecutable
MD5:CA0D0361E41D3273CD3D024B851CF9DB
SHA256:510DF12F1BFBF69308051DD58F68E70B5986DDBF7C665EF1C2319A96D05363B0
6240wscript.exeC:\Users\Public\Libraries\advapi32.dllexecutable
MD5:2FF9948A943C06A6C75C1692887166E3
SHA256:7AB879B49980034F361F1A0B98145A864F9E42EF1C58CBA9A0643D90E5102EC6
6240wscript.exeC:\Users\Public\Libraries\wall.css.exeexecutable
MD5:E2E949442460402FADAA3E71323D142E
SHA256:74C67467428ED96BF6D3BBD6EDC3215E3149F608302A86323DEC572130FBC2CD
1052extrac32.exeC:\Windows \SysWOW64\amsi.dllexecutable
MD5:CA0D0361E41D3273CD3D024B851CF9DB
SHA256:510DF12F1BFBF69308051DD58F68E70B5986DDBF7C665EF1C2319A96D05363B0
1192wall.css.exeC:\ProgramData\Iqvflzsz20496.cmdtext
MD5:E37AB9F7BAD39CBE6B1351136020F244
SHA256:EFD8444C42D4388251D4BC477FB712986676BC1752F30C9AD89DED67462A59A0
6240wscript.exeC:\Users\Public\Libraries\wall.csstext
MD5:046E213C7B32239F28E50AAA32E9B830
SHA256:D7493FB2C482C72395A56E2606E23F0562E98C531FCA3EEB23944AA12ABB1885
1192wall.css.exeC:\Users\admin\Links\Iqvflzsztext
MD5:046E213C7B32239F28E50AAA32E9B830
SHA256:D7493FB2C482C72395A56E2606E23F0562E98C531FCA3EEB23944AA12ABB1885
6240wscript.exeC:\Users\Public\Libraries\bcrypt.dllexecutable
MD5:C4CF85CE6B186CAD0E259231CE5E4E77
SHA256:30B70CA0E32798F5BC6F314E1E4AA2D14CBDD6AC40BF54DA31EDA14B0650CF5E
1192wall.css.exeC:\Users\admin\Links\Iqvflzsz.exeexecutable
MD5:E2E949442460402FADAA3E71323D142E
SHA256:74C67467428ED96BF6D3BBD6EDC3215E3149F608302A86323DEC572130FBC2CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
23
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6876
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4820
SndVol.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
2972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4400
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
6876
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 52.167.249.196
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.3
  • 20.190.159.23
  • 40.126.31.129
  • 20.190.159.0
  • 40.126.31.0
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
geoplugin.net
  • 178.237.33.50
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
—
—
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Scan1089293847592.JS